Privacy Policy

Last updated: March 2026

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Bo Riedel-Petzold Prießnitzstraße 41 04179 Leipzig Email: boriedel(at)gmail.com Website: https://jobpic.io

2. Overview of Data Processing

We process personal data of our users to provide our AI-powered photography service. This includes in particular:

• Registration and login data (email address, password)
• Uploaded photos for AI processing
• Generated images and session data
• Payment information (processed by Stripe)
• Technical data (IP address, browser type, access time)

3. Hosting and Content Delivery

Our website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes technically necessary access data (IP address, time of access, pages accessed). The data processing is based on our legitimate interest in the secure and efficient provision of our website pursuant to Art. 6(1)(f) GDPR. We have a Data Processing Agreement with Vercel that includes the EU Standard Contractual Clauses (SCC) to ensure an adequate level of data protection for transfers to the USA.

4. User Registration and Authentication

Registration is required to use our service. We use Firebase Authentication, a service by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The following data is processed during registration:

• Email address
• Password (stored encrypted)
• Session tokens for authentication

Processing is carried out to fulfil the user contract pursuant to Art. 6(1)(b) GDPR.

5. Database and Storage

User data, session information and references to generated images are stored in Google Cloud Firestore. Uploaded photos and generated images are stored in Firebase Cloud Storage. Both services are operated by Google Ireland Limited.

Storage location: All data is stored and processed in the europe-west10 region (Berlin, Germany). Data does not leave the European Economic Area (EEA).

The stored data includes:

• User profile data and account information
• Uploaded original photos
• AI-generated images
• Session configurations (selected outfit, scene, style)
• Purchase history and credit balances

6. AI Image Processing

We use the Google Gemini API to generate professional headshots. Your uploaded photos are transmitted to Google servers and processed by the AI model.

Important notes on AI processing:

• Your photos are used exclusively for providing the contractually agreed service.
• Google does not use your photos to train its AI models.
• Processing serves contract fulfilment pursuant to Art. 6(1)(b) GDPR.

Additionally, the Gemini Vision API is used to analyse image quality (framing, lighting) to provide you with tips for optimising your photos.

Automated decision-making (Art. 22 GDPR): AI image generation constitutes automated processing. The result (generated image) is based on your uploaded photo and the selected settings. You can always request new images to be generated or choose not to use the service.

7. Payment Processing

For payment processing we use Stripe (Stripe Technology Europe Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). Stripe acts as the data controller for processing your payment data as a payment service provider.

We offer the following packages: Starter (€19.99), Plus (€34.99) and Pro (€59.99). When paying, you will be redirected to Stripe's secure payment page.

Jobpic does not store credit card numbers or complete payment data. We only receive from Stripe a confirmation of payment and a transaction ID. Processing by Stripe is based on Art. 6(1)(b) GDPR (contract fulfilment).

For more information on data protection at Stripe, please visit: https://stripe.com/de/privacy

8. Cookies and Local Storage

Our website uses the following cookies and local storage:

• Session cookies: Technically necessary cookies for authentication and maintaining your session.
• Language setting (NEXT_LOCALE): Cookie for storing your preferred language.
• localStorage: Storage of app state and user preferences (e.g. theme setting, onboarding status).

We do not use third-party tracking cookies. No tracking for advertising purposes takes place. The use of technically necessary cookies is based on our legitimate interest pursuant to Art. 6(1)(f) GDPR.

9. Legal Basis for Processing

We process personal data on the following legal bases pursuant to Art. 6(1) GDPR:

• Contract fulfilment (lit. b): Processing for registration, use of the service, AI image generation and payment processing.
• Consent (lit. a): Where you have given us consent to process your data.
• Legitimate interest (lit. f): Technically necessary cookies, hosting, security measures and analysis to improve our service.

10. Your Rights as a Data Subject

Under the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): You have the right to request information about the personal data we process about you.
• Right to rectification (Art. 16 GDPR): You can request the correction of inaccurate or the completion of incomplete data.
• Right to erasure (Art. 17 GDPR): You can request the deletion of your personal data. You can delete your account at any time in the profile settings.
• Right to restriction (Art. 18 GDPR): You can request the restriction of processing of your data.
• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21 GDPR): You can object at any time to the processing of your personal data if processing is based on legitimate interest.

To exercise your rights, please contact: boriedel(at)gmail.com

11. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with a data protection supervisory authority. You can in particular contact the supervisory authority of your usual place of residence, your place of work or the place of the alleged violation.

12. Data Retention and Deletion Periods

We store your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by statutory retention obligations.

• Account data: Stored as long as your account is active. Upon account deletion, all data is deleted immediately.
• Photos and generated images: Deleted with the account or the session.
• Payment data: Statutory retention obligations (e.g. 10 years for tax law purposes) are observed.
• Server logs: Automatically deleted after 30 days.

13. Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in the law or changes to the service or data processing. The current version is always available on our website at jobpic.io/datenschutz .

14. Contact

If you have questions about data protection or wish to exercise your rights, you can reach us at:

Email: boriedel(at)gmail.com