Privacy Policy
Last updated: 18 August 2026.
Laddro is built in Germany and used across Europe. This Privacy Policy explains what data we collect when you use Laddro, why we collect it, who we share it with, where it is stored, and what rights you have. We follow the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications and Digital Services Data Protection Act (TDDDG, formerly the TTDSG).
If anything here is unclear, write to [email protected] and a person will read it.
1. Who we are
The data controller responsible for processing your personal data under Article 4(7) GDPR is:
Laddro Digital UG (haftungsbeschränkt) Belziger Str. 69 to 71 10823 Berlin, Germany Handelsregister: HRB 285589 B, Amtsgericht Charlottenburg Managing Director: Oussama Bentaib Email: [email protected]
We have not appointed a Data Protection Officer under Article 37 GDPR. Our processing activities do not currently meet the threshold that requires one. If they do, we will appoint one and update this section.
2. Where this policy applies
This policy covers every Laddro surface:
- The marketing website at
www.laddro.com. - The application at
app.laddro.com, which includes the resume builder, the guided builder, the cover letter builder, the tailoring flow, the job application tracker, the template library, and your account settings. - Online resumes published from your account, which are served publicly at
www.laddro.com/r/{handle}. Section 5 covers these in full. - The community feed inside the application.
- The Developer Console at
console.laddro.comand the public Career API. - Connections you make between your Laddro account and an outside AI assistant such as Claude or ChatGPT.
- Our mobile applications for iOS and Android, when they are released.
3. The data we collect about you
3.1 Account and sign in
- Email address.
- Display name, which you can edit.
- Profile photo, if you upload one. It is cropped and resized in your browser and stored in Google Cloud Storage.
- A password hash, only if you set a password. Most people sign in with a magic link or a connected account and never set one.
- The provider account identifier returned by Google, Apple, LinkedIn or Microsoft when you sign in with one of them. We never receive your password for those services.
- Whether you arrived through a referral link, and which account referred you.
- Your locale, currency, theme and accent preferences.
- Session tokens, held in HTTP-only cookies.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR.
3.2 The content you create
Everything you put into a resume, a cover letter, a guided builder session, a presentation, or a job application record:
- Personal details such as name, contact details, location and links.
- Work history, education, certifications, skills, languages, projects and custom sections.
- Cover letter text, the employer you address it to, and the role.
- Guided builder answers, and any existing resume you upload to start from.
- Job applications: company, role, link, status, dates and your notes.
- Document settings such as the template, colours, fonts and document language.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR. This content is yours. We process it to run the features you ask for, and for nothing else. Resume and cover letter content is encrypted at rest.
3.3 AI inputs and outputs
When you use an AI feature we send your input to an AI provider and store the result back into your document. Section 7 sets out exactly what is sent and to whom.
We also keep a short usage record for each AI action: which action ran, which model answered, the timestamp, and the credit cost. Your resume and cover letter content is not stored in that usage record.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR.
3.4 Payments
If you subscribe or buy a credit pack on the web, we store:
- The plan or pack you chose and the currency it was charged in.
- Your Stripe customer identifier and, for a subscription, your Stripe subscription identifier.
- Payment status, invoice references, and the brand and last four digits of the card, as returned to us by Stripe.
- Billing history: date, amount, VAT and status.
- The currency locked to your account after your first successful payment. Section 12 explains this.
Stripe processes the card number, the security code and the expiry date on its own systems. We never see or store them.
If you buy through our iOS application, the purchase is processed by Apple under Apple's own terms. Apple sends us a signed receipt identifying the product you bought so that we can unlock it on your account. We do not receive your payment details from Apple.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR, and our legal obligations under German tax and accounting law, Article 6(1)(c) GDPR, for invoice retention.
3.5 Usage, device and error data
- IP address, user agent, browser and operating system.
- An approximate location derived from the IP address, at country or region level.
- Pages visited, features used, and events you trigger such as button clicks, document downloads and AI actions.
- Errors and stack traces when something breaks.
Legal basis: our legitimate interest in running, securing and improving the service, Article 6(1)(f) GDPR.
3.6 Support
If you write to support or use a contact form, we keep your message, the address you wrote from, and our reply.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR, and our legitimate interest in providing support, Article 6(1)(f) GDPR.
3.7 Referrals
If you invite someone with a referral link we store the link, who signed up through it, and the credits each side earned. If you send an invitation by email we deliver that single message and do not add the recipient to any list.
By sending an invitation you confirm the recipient is content to receive one message from you.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR, and our legitimate interest in growing the service, Article 6(1)(f) GDPR.
3.8 Notifications
We send transactional messages such as sign in links, payment receipts, security alerts and account deletion confirmations, and, if you have opted in, product and referral updates. Channels are email, the in-app inbox, and push notifications once our mobile applications are released.
To deliver them we store your email address and locale, your notification preferences, a delivery record for each message so we can debug failures, and, on mobile, the push token issued by Apple or Google if you grant notification permission.
Legal basis: performance of our contract with you for transactional messages, Article 6(1)(b) GDPR, and your consent for anything optional, Article 6(1)(a) GDPR, which you can withdraw at any time from the notifications page.
3.9 Community feed
If you post to the community feed we store your post and link it to your account. Posts are shown to other signed in users under a stable pseudonymous handle such as "quiet-fox", not under your name, and you may attach a link to your published online resume. If you attach that link, everything on that resume becomes visible to anyone who follows it.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR.
3.10 LinkedIn profile generation
If you use the LinkedIn profile feature we generate profile text from a resume you choose and store the generated result on your account so you can come back to it. We also look up company brand and logo data by company name through Brandfetch, and cache the result for up to 30 days.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR.
3.11 The public API and connected AI assistants
If you use the public API we issue API keys tied to your account and log requests for rate limiting and debugging.
You can also connect your Laddro account to an outside AI assistant such as Claude or ChatGPT, or any other client that speaks the Model Context Protocol. When you authorise a connection, we record which client you connected, when, and the scopes you granted. From then on that assistant can read and write the Laddro data covered by those scopes, which includes your resumes and cover letters. That data then sits with the assistant's operator under their privacy policy, not ours. We are not able to see or control what they do with it. You can revoke a connection at any time from the connections page in your account, which stops any further access.
Legal basis: performance of our contract with you, Article 6(1)(b) GDPR.
4. Data about people other than you
Some parts of Laddro cause us to hold personal data about people who never signed up. We are the controller for that data, and this policy applies to them too.
- People named in your documents. Referees, managers and colleagues you name in a resume or cover letter. You are responsible for having a lawful reason to include them.
- People you invite. Referral invitees, who receive one message and are not added to a list.
- People who contact you through a published online resume. See Section 5.4.
- People who review a published online resume. See Section 5.5.
- People who visit a published online resume. See Section 5.6.
If you are one of these people and you want to know what we hold or want it deleted, write to [email protected]. You have the rights in Section 14 exactly as an account holder does.
5. Online resumes
An online resume turns a resume in your account into a public web page. Because this feature publishes personal data to the open internet, it works differently from the rest of Laddro and deserves its own section.
5.1 Nothing is public until you make it public
A new online resume is created as a draft. Nothing is reachable by anyone else while it is a draft. You choose the visibility yourself:
| Visibility | Who can see it |
|---|---|
| Draft | Only you |
| Unlisted | Anyone with the exact link, but it is never indexed |
| Password | Anyone with the link and the password |
| Public | Anyone with the link |
| Disabled | Nobody. The page stops resolving |
Search engine indexing is a separate switch. It is off by default, and it can only be turned on for a resume whose visibility is Public. When it is off we tell search engines not to index the page.
5.2 What actually gets published
Publishing does not publish your account. It publishes a snapshot of the resume you selected, containing the sections you chose to show: your summary, work history, education, skills, languages, certifications, projects, links, references, activities and any custom sections.
Contact details are handled separately and conservatively:
| Field | Default |
|---|---|
| Email address | Hidden |
| Phone number | Hidden |
| Location | Shown |
| Website or LinkedIn link | Shown when your resume has one |
Your email address and phone number are hidden by default and are removed by our servers before the page is sent to a visitor, so a hidden field is not present in the page source either. Your website or LinkedIn link has no separate switch and is published whenever your resume contains one.
Your published address is www.laddro.com/r/{handle}, where the handle is the one you claim. ladd.ro links redirect to the same page.
5.3 Preview links
Every online resume has a secret preview link. Anyone holding that link can view the page even while it is a draft, which is the point of it: it exists so you can show work in progress to somebody you choose. Pages opened through a preview link are never indexed. Treat the link as private, and be aware that anyone you send it to can forward it.
5.4 The contact form
Published online resumes carry a contact form, which is on by default and which you can switch off in the site settings. When a visitor uses it, we store the name, email address, company and role they enter, along with their message, and show it to you in your account. We keep it so you can read and reply to it.
Legal basis: our legitimate interest, and yours, in letting an interested employer reach you, Article 6(1)(f) GDPR.
5.5 Review links and reviewer comments
You can create a review link and send it to someone whose opinion you want on your resume. A reviewer opening that link can leave comments pinned to specific parts of the page. For each comment we store the comment text, the part of the resume it points at and a copy of that text, the position of the comment marker and the reviewer's screen size so the marker lands in the right place, and the reviewer's name, email address and avatar image where they provide them. If the reviewer has a Laddro account, the comment is linked to it.
You can revoke a review link at any time, which ends further access.
Legal basis: our legitimate interest, and yours, in collecting feedback you asked for, Article 6(1)(f) GDPR.
5.6 Visitor statistics
For online resumes whose visibility is Public we count visits so you can see how your page performs. We record the type of event, the country the request came from, the device category, the referring website's domain, and how long the visit lasted.
To count the same person once without tracking them, we build a visitor identifier by hashing the date, the site identifier, the visitor's IP address, their user agent and a secret held on our server. The result is a 32 character string. We do not store the raw IP address or the user agent. The hash changes every day and is different for every online resume, so it cannot be used to follow anyone between days or between pages. We do not set a cookie and we do not store anything on the visitor's device, so no consent under Section 25 TDDDG is required.
We do not collect these statistics for drafts, unlisted pages, password protected pages or preview links.
Legal basis: our legitimate interest in providing audience statistics to the owner of the page, Article 6(1)(f) GDPR.
5.7 Taking a page down
You can change the visibility of an online resume at any time from your account, including setting it to Disabled, which stops the page resolving immediately. Revoking a review link ends further access through it.
Deleting your account deletes your online resumes together with everything attached to them: the published snapshots, the contact messages, the review links, the reviewer comments and the visitor statistics. If you want a single online resume and its attached data erased without closing your account, write to [email protected] and we will do it for you.
One thing we cannot undo: while a page was public and indexed, search engines, archives and other people may have taken their own copies. We have no control over those and cannot delete them for you. Please decide what to publish with that in mind.
6. Processors we use
These providers process personal data on our behalf. Each operates under a data processing agreement, and where data leaves the European Economic Area we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework.
| Provider | What they do for us | Where they process |
|---|---|---|
| Supabase | Production PostgreSQL database | European Union |
| Google Cloud Platform | Application hosting on Cloud Run, file storage, message bus, secrets | europe-west4, the Netherlands, with some control plane processing in the United States |
| Vercel | Hosting and edge runtime for our websites | European Union by default, United States fallback |
| Stripe Payments Europe | Card processing, subscriptions, invoicing | Ireland, with affiliate processing in the United States |
| Apple | In-App Purchase billing for the iOS application, Sign in with Apple, push notifications | Apple infrastructure, United States and European Union |
| Google (Gemini API) | The AI model behind our writing, tailoring, parsing and feedback features | European Union or United States depending on the model |
| OpenAI | Fallback AI model when the primary model is unavailable | United States |
| Laddro AI Core, operated by us | Our own EU hosted engine, which orchestrates every AI call and handles matching and normalisation itself | Cloud Run, europe-west4 |
| Resend | Delivery of transactional and notification email | European Union and United States |
| PostHog | Product analytics | European Union |
| Sentry | Error and performance monitoring | European Union primary, United States fallback |
| Brandfetch | Company logo and brand lookup from a company name you enter | United States |
| Cloudflare | DNS and edge routing for our domains | Global edge network |
We do not sell your data. We do not share it with advertisers. We do not use your resume or cover letter content for advertising.
7. AI features in detail
7.1 What is sent, and when
Nothing is sent to an AI provider unless you trigger a feature that needs it.
| Feature | What we send |
|---|---|
| Guided builder | Your answers, the resume you optionally uploaded to start from, and your language |
| Tailoring a resume to a job | The resume content, the job title and description you paste, and your language |
| Cover letter generation | The resume you selected, the role and company you are targeting, and your language |
| Suggestions inside the builder | The selected text, the field it belongs to, the surrounding resume context, and your language |
| Resume feedback and scoring | The resume content, the current score, and the target job description if you gave one |
| Skill suggestions | Your existing skills, the resume context, and the job description if you gave one |
| PDF parsing | The file you uploaded, in order to extract structured content from it |
| LinkedIn profile generation | The resume you selected |
7.2 Who processes it
Every AI call goes through Laddro AI Core, our own service in europe-west4. AI Core handles matching, normalisation and other structured work itself, and calls an outside model only for the generative steps. That model is Google's Gemini API, with OpenAI as a fallback when Gemini is unavailable.
Both providers are on paid API terms under which content sent through the API is not used to train or improve their models. They act as our processors under Article 28 GDPR.
7.3 What AI output is, and is not
AI output is a starting point. It can be wrong, generic or out of date. You are responsible for reading what it writes and correcting it so it is accurate, and you should not use a suggestion that misrepresents your experience. Where text has been generated or changed by AI, the interface tells you so.
Please do not paste information into an AI feature that you are not comfortable sending to an AI provider.
7.4 No automated decisions about you
Laddro does not make decisions about you with legal or similarly significant effects using automated processing. We do not score applicants, reject users, set individual prices or grant or withhold features on the basis of profiling. AI in Laddro only helps you write.
8. Where your data is stored
Our database, file storage and AI Core service run in the European Union. Some providers in Section 6 process data in the United States or globally. For each of them we rely on one or more of the following safeguards under Chapter V GDPR:
- The European Commission's Standard Contractual Clauses, Decision (EU) 2021/914.
- Certification under the EU-U.S. Data Privacy Framework, where the provider is certified.
- Supplementary measures including encryption in transit, encryption at rest and access control.
You can ask us for details of the safeguards applied to any transfer by writing to [email protected].
9. Security
We protect your data with measures appropriate to the risk, in line with Article 32 GDPR:
- TLS in transit, enforced on every Laddro domain.
- Encryption at rest for the database and for stored files. Resume and cover letter content is encrypted with AES-256 using a dedicated key.
- Passwords, where set, are stored as bcrypt hashes and never in readable form. Magic link codes are single use, short lived, and consumed on sign in.
- Session tokens are held in HTTP-only cookies with the Secure and SameSite attributes in production.
- Role based access control internally, with production access logged.
- Secrets are held in Google Cloud Secret Manager and never committed to source code.
- Dependency monitoring, and review of changes before they reach production.
- A documented incident response procedure, including notification to the supervisory authority within 72 hours under Article 33 GDPR and to affected users under Article 34 GDPR where the risk requires it.
No system is perfectly secure. If you find a security problem, please write to [email protected].
10. Cookies and local storage
We keep this deliberately small.
Strictly necessary cookies. Your session tokens. These are exempt from consent under Section 25(2) number 2 TDDDG because the service cannot work without them.
Local storage. We use your browser's local storage to remember your language, theme and accent, to hold resume and cover letter drafts if you are working without an account, to cache job applications for offline use, to remember view preferences, and to hold a random identifier used to rate limit public tools. None of this is sent to advertisers.
Analytics. We use PostHog for product analytics. It is configured with memory-only persistence, which means it writes no cookie and no local storage entry on your device, and its identifier does not survive a page reload. Because nothing is stored on or read from your device, Section 25 TDDDG does not require consent, and we rely on our legitimate interest under Article 6(1)(f) GDPR. We use Sentry for error monitoring, configured not to collect personal information.
We do not use Google Analytics, Google Tag Manager, advertising cookies, retargeting pixels or session recording. Because we set nothing that requires consent, we do not show a cookie banner.
You can object to product analytics at any time by writing to [email protected].
11. How long we keep things
| Category | Retention |
|---|---|
| Account data and the documents you create | Until you delete your account |
| Profile photo | Deleted when replaced, and when you delete your account |
| Job applications | Until you delete them, or until you delete your account |
| Online resumes, their published snapshots, messages, review links and comments | Until you delete your account, or earlier on request |
| Online resume visitor statistics | Kept in pseudonymous form for as long as the online resume exists |
| Community posts | Until you delete the post, or until you delete your account |
| Payment, invoice and tax records | Up to 10 years, as required by Section 147 AO and Section 257 HGB |
| Support correspondence | Up to 3 years after the matter is closed |
| Referral activity | Until you delete your account, plus a short audit window |
| Notification delivery records | 90 days |
| Error and security logs | Up to 90 days |
| API request logs | Up to 7 days |
When you delete your account we delete your documents, online resumes, job applications, photos, community posts and preferences. We anonymise the small amount we are legally required to keep, such as the link between an invoice and your name and country, which German tax law requires us to retain for 10 years.
You can delete your account yourself from your account settings. Deletion runs after a one hour grace period, during which we email you a link to cancel it.
12. Currency lock
Stripe ties each customer to a single currency at the first successful payment. The first currency you pay in therefore becomes the only currency we can charge you in afterwards. We show the locked currency in your billing pages. If you need it changed, write to [email protected] and we will explain the options.
13. Preferences and how we set them
When you sign up we guess your language and currency from the Accept-Language header your browser sends and from your region. Those guesses become preferences on your account, alongside theme and accent. We record whether each value was chosen by you or guessed by us, so that a guess never overrides a real choice. You can change any of them in your account settings.
14. Your rights
If you are in the EEA, the United Kingdom, or another jurisdiction with comparable rights, you have the right to:
- Access, Article 15. Ask for a copy of the data we hold about you.
- Rectification, Article 16. Ask us to correct anything wrong.
- Erasure, Article 17. Ask us to delete your data. You can also delete your account yourself in your account settings.
- Restriction, Article 18. Ask us to pause processing while something is checked.
- Portability, Article 20. Ask for the data you gave us in a structured, machine readable format. We currently handle this on request rather than through a self service export. Write to [email protected] and we will send it to you.
- Objection, Article 21. Object to processing based on legitimate interest. We stop immediately for direct marketing, and otherwise unless we can show overriding grounds.
- Withdraw consent, Article 7(3). Withdraw consent at any time, without affecting anything done before you withdrew.
- Not be subject to automated decisions, Article 22. We do not make such decisions. See Section 7.4.
- Complain to a supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information, or the authority where you live or work.
Write to [email protected] to exercise any of these. We may need to confirm your identity first. We reply within one month, as Article 12(3) GDPR requires. For a complex request we may extend by up to two further months and will tell you if we do.
15. Children
Laddro is not for children under 16, and we do not knowingly collect their data. If you believe a child has signed up without a parent's consent, write to [email protected] and we will investigate and delete the account.
16. Mobile applications
Our iOS and Android applications sign in to the same account through the same API. They keep a local cache of your account, documents and preferences so they work offline, and the cache is cleared when you sign out. They may ask for permission to send notifications, and store a push token if you grant it. Purchases made inside the iOS application are handled by Apple, as described in Section 3.4.
The applications contain no advertising SDKs and no third party tracking SDKs.
17. Changes to this policy
We may update this policy. When we do we change the date at the top. For a change that materially affects how we process your personal data, we give at least 30 days' notice by email or by a notice inside the application before it takes effect. If you do not agree with the new version you can stop using Laddro and delete your account.
18. Contact
Laddro Digital UG (haftungsbeschränkt) Belziger Str. 69 to 71 10823 Berlin, Germany Email: [email protected]