1. About this notice
DEAU helps schools and agencies organize candidate applications to employers in Germany and Austria. This notice describes the current pilot website and its Google-connected sending service. DEAU is the product name; the operator’s full legal name, postal address and establishment country are still awaiting confirmation. Contact the service team using the contact link below.
2. School and operator responsibilities
The school decides whose applications are prepared, which contacts are used and when messages are sent. For school-directed processing, the school generally acts as controller and the service operator as processor, subject to the agreed arrangement. The operator is responsible for its own account administration, billing and support processing. Before production use, the parties must confirm their roles, applicable lawful bases and a data-processing agreement where required. Google authorization permits account access; it does not replace the school’s lawful basis for processing applicant or employer data.
3. Information processed
Information includes staff identity and email, school branding and membership, subscription settings, candidate names and contact details, application goals, employer names and email addresses, selected spreadsheet rows or imported CSV contacts, message subjects and text, uploaded PDFs or selected Drive files, Google account identifiers and permissions, encrypted connection credentials, campaign progress, sending results and error details. The school supplies applicant and employer information; selected files and account information come from Google after authorization.
4. Purpose and Google permissions
Data is used to manage school access, prepare and review campaigns, read selected employer lists and attachments, send approved applications, record progress and provide support. Gmail access uses gmail.send to send messages; this version does not read your inbox or track replies. Drive access uses drive.file for files you select or make available to DEAU. Google account identity permissions identify the connected sender. DEAU does not ask for your Google password.
5. Limited use of Google data
DEAU’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy and Google Workspace user data and developer policy, including their Limited Use requirements. Google data is not sold, used for advertising or used to train general-purpose AI models. Human access to Google-derived content is limited to documented user permission for specific support, security needs, legal requirements or other exceptions permitted by these policies.
Google API Services User Data Policy ↗
Google Workspace user data and developer policy ↗
6. Providers, recipients and international processing
The pilot uses Sites/OpenAI for website hosting and authenticated access, Cloudflare database and file-storage services, Google for account authorization, selected files and email delivery, and n8n for configured campaign automation. Information shared depends on the school’s sending configuration; legacy automation may receive contacts, message content and attachments. Intended employers receive application emails and files. Service administrators have privileged access for administration and authorized support; school separation does not mean the operator has no access. Provider processing may occur outside your country, including outside the EEA. Storage regions, subprocessors and applicable transfer safeguards must be confirmed in the production agreement; this pilot notice does not certify a particular region or transfer arrangement.
7. Storage, disconnection and deletion
There is currently no automatic retention or deletion schedule for school records, campaigns and uploaded PDFs. A production retention schedule, including provider logs and backups, remains to be agreed. Request access or deletion through your school or the service contact. Disconnecting a Google account removes its saved connection and associated selected-file references and pauses running school campaigns; a message already being processed may still complete. Disconnection does not delete campaign history or uploaded PDFs. You can also revoke access in your Google account settings. Emails already delivered remain with recipients and in the sending account, subject to their own retention practices.
8. Security and browser storage
The app uses role and school-access checks, HTTPS and encrypted saved Google refresh credentials. These safeguards cannot guarantee absolute security. Browser storage remembers language and theme until cleared; the language preference cookie lasts up to one year. The sign-in cookie is HttpOnly and sessions last up to seven days. Supabase session tokens are encrypted in the server database. A temporary secure OAuth cookie lasts up to ten minutes. Hosting and Google services may use their own authentication cookies and operational logs. The current app does not include advertising trackers or a marketing analytics integration.
9. Your choices and rights
Where applicable, data-protection law may give you rights to access, correction, deletion, restriction, objection and portability, and to withdraw consent or complain to a supervisory authority. Applicants should first contact the school responsible for their campaign; staff can also contact the operator. We may need to verify identity and route school-data requests to that school. Do not send passwords, authentication codes or sensitive documents through WhatsApp; request a secure channel. DEAU does not make automated hiring decisions; staff can record interview outcomes manually. Changes to this notice will appear here with a revised date.