Privacy policy

Last updated: November 2026 · Applies to https://lilos-dreamjob.com

1. At a glance

This policy explains which personal data Lilo's Dream Job collects, what we use it for, who else receives it and which rights you have. Personal data is any information that relates to you as a person.

In short: we use your answers to find companies and jobs that fit you. We don't sell your data, show no ads and use no advertising trackers.

2. Hosting and visitor statistics

Vercel

This website runs on Vercel (Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA). When you visit, Vercel processes connection data (IP address, time of the request, the page requested, browser and operating system) to deliver the site and keep it secure, and keeps it in server logs for a short time. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in running the site securely).

Vercel Web Analytics

To see how many people visit and which pages they use, we use Vercel Web Analytics. It records the page address (without anything after a “?” or “#”, so no search terms or login codes), the referring website, browser, operating system, device type and the country derived from your IP address. The IP address itself is not stored. It sets no cookies and stores nothing on your device; visits are told apart by an anonymous value computed from the request that resets every 24 hours. The statistics are not linked to your account. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in knowing how the site is used).

Vercel processes data in the USA. Transfers are based on the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses (SCC). More: vercel.com/legal/privacy-policy

3. Your account and profile

Supabase

Accounts and everything you save are stored with Supabase (Supabase Inc., 970 Trestle Glen Rd, Oakland, CA 94610, USA) on servers in the EU (Ireland). This includes:

• your email address and password (the password only as a secure hash)
• your answers to Lilo, our onboarding assistant: job areas and roles, experience level, skills, interests, industries, places and ways of working, salary expectation, dealbreakers and, if you give it, your LinkedIn profile address
• the companies you pick or hide, and the jobs you save, dismiss or track on your board, with your notes
• your subscription status (see section 6)
• when the account was created and when you last signed in

Guest start: “Get started” lets you answer the questions before you create an account. For that we create a guest account without an email address; when you create your account at the end, it keeps your answers. Guest accounts that never become an account are deleted automatically, with all their answers, 30 days after they started.

Sign-in with Google: if you choose “Continue with Google”, you sign in on a page of Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We then receive your email address and, as Google shares them, your name and profile picture. More: policies.google.com/privacy

Legal basis: Art. 6 (1) (b) GDPR (providing the service you signed up for). We keep the data as long as your account exists. Supabase may access data from outside the EU for support and maintenance, based on the SCC. More: supabase.com/privacy

Storage on your device

So you stay signed in, your browser keeps your login in its local storage (sb-…-auth-token) until you sign out. Inside the app a cookie (sidebar_state, 7 days) remembers whether the sidebar is open. Both are strictly necessary for the service you asked for, so they need no consent (§ 25 (2) no. 2 TDDDG). We set no other cookies.

4. Spam protection

Signing in and “Get started” are protected by Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA), which checks that a person, not a bot, is using the form. For that, Cloudflare processes your IP address and information about your browser and device. Legal basis: Art. 6 (1) (f) GDPR (our legitimate interest in protecting the service from abuse). Transfers to the USA are based on the EU-U.S. Data Privacy Framework. More: cloudflare.com/privacypolicy/

5. AI features

Some features use AI models. We send the data to them through the Vercel AI Gateway (Vercel, see section 2), which passes it on to the model provider:

• Your answers to Lilo are turned into the profile fields above by a Gemini model from Google.
• Your CV, if you upload one, is read by a Gemini model from Google to suggest answers. We don't store the file, only the suggestions you then see and can change.
• Voice input, if you dictate an answer, is turned into text by a model from OpenAI (OpenAI, L.L.C., San Francisco, USA). We don't store the recording, only the text.

From time to time we also use Claude (Anthropic PBC, San Francisco, USA) to find more companies that fit your profile and to read the seniority level of the jobs in your feed. For this Claude receives the job preferences in your profile (areas, roles, level, places, ways of working, industries, company sizes) and an internal identifier or your email address, so we know whose feed it is; not your CV, salary or other answers.

Legal basis: Art. 6 (1) (b) GDPR (these features are what you use the service for). The providers process the data in the USA, as processors under the SCC or the EU-U.S. Data Privacy Framework, and under their terms for business customers do not use it to train their models. More: policies.google.com/privacy, openai.com/policies/privacy-policy, anthropic.com/legal/privacy

6. Payments

Subscriptions are paid through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). You enter your payment details on Stripe's own page; they never reach our servers. Stripe processes your email address, name, payment details, billing address if given, and the transaction (plan, amount, date, status). We receive only what we need to manage your subscription: a customer and subscription reference, the plan, its status and the billing period. “Manage subscription” opens Stripe's customer portal.

Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (legal obligation). Invoices and payment records are kept as long as tax and commercial law requires (up to 10 years, § 147 AO, § 257 HGB), even after your account is deleted. Stripe may transfer data to Stripe, Inc. in the USA (EU-U.S. Data Privacy Framework, SCC) and processes some data as an independent controller, for example to prevent fraud. More: stripe.com/privacy

7. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR)
• have wrong data corrected (Art. 16 GDPR)
• have your data deleted (Art. 17 GDPR), unless we must keep it by law
• restrict processing (Art. 18 GDPR)
• receive your data in a machine-readable format (Art. 20 GDPR)
• object to processing based on our legitimate interest (Art. 21 GDPR), on grounds relating to your situation
• withdraw a consent at any time, with effect for the future (Art. 7 (3) GDPR)

Write to lilos-dreamjob@heistventures.com to use any of these rights.

Deleting your account: under Profile → Delete account you can delete your account at any time. Your login, profile, companies, saved jobs and board are deleted right away and for good. If your subscription still renews, cancel it first (“Manage subscription” on your profile page); the page tells you if that's needed. Payment records stay with Stripe as long as tax law requires.

You can also complain to a data protection authority (Art. 77 GDPR), for example the one where you live or the one responsible for us: Berliner Beauftragte für Datenschutz und Informationsfreiheit.

8. Security

All connections use TLS encryption. Passwords are stored only as hashes. Your data is separated from other people's by row-level security in the database, and only the server can read the shared job and company data.

9. Minors

Lilo's Dream Job is not meant for people under 16. We don't knowingly collect data from them. If you are a parent and think your child gave us data, write to lilos-dreamjob@heistventures.com.

10. Changes

We update this policy when the service or the law changes. The current version is always on this page. If a change matters for you, we tell registered users by email.