Privacy
Controller and contact
The controller for EXODEU is exotisches deutsch, Caferağa, Şifa Sk No:19, 34710 Kadıköy/İstanbul, Türkiye. Website: https://exodeu.com/. Privacy and deletion requests: [email protected].
Service and scope
EXODEU supports applications for jobs and vocational training places in Germany. This policy covers the information website and the separate application platform, which sends application emails on users’ behalf. Visiting this website does not connect a Google account or trigger email delivery.
Website and Cloudflare
The website and application platform infrastructure are provided through Cloudflare. When you visit the website, Cloudflare processes technically necessary connection data, including your IP address, access time, requested URL and browser information. This supports service delivery, availability and security. Where the GDPR applies, the legal basis is Article 6(1)(f) GDPR: our legitimate interest in secure operation. This website uses no analytics or advertising trackers of its own; images and fonts are served locally. Cloudflare processes technical data under its own applicable terms and retention rules. Providers’ retention rules are separate from our platform’s rules for deleting data and delivery logs. Further information: Cloudflare Privacy Policy.
Contact and application service
When you contact us, we process your email address, message and any attachments to respond to your enquiry. For the application service, we process the contact details, CVs, cover letters and application documents you provide. Where the GDPR applies, this is based on Article 6(1)(b) GDPR for pre-contractual steps or the agreed service. Where separate consent is required, we rely on Article 6(1)(a) GDPR. Support correspondence is retained only as long as necessary to handle the enquiry or meet legal obligations. Please send only necessary documents.
Google authorisation and Gmail data
The Gmail connection is voluntarily authorised through Google OAuth. The platform requests only two Google permissions: https://www.googleapis.com/auth/gmail.send to send application emails on the user’s behalf, and https://www.googleapis.com/auth/userinfo.email to identify the email address of the connected Google account. It does not read messages from the Gmail inbox. We do not receive your Google password. To send messages, we process the supplied recipient addresses, subject lines, message text and application attachments, together with technically necessary OAuth access tokens and, where applicable, refresh tokens. Google’s technical delivery response may contain a message identifier.
Purpose, recipients and access
Google permissions and application data are used for the agreed application service, including preparation and sending, and its technical operation. Applications are sent to the employers or training companies specified in the assignment. Google processes sent emails in the connected account; Cloudflare provides the technical infrastructure. Recipients process applications under their own privacy policies. To create cover letters and application emails, we send the CV, profile information and relevant job advertisement you provide to the AI service OpenRouter (OpenRouter, Inc., USA), which forwards the request to a language model. The legal basis is Article 6(1)(b) GDPR. Data received through Google APIs, including Gmail data and OAuth tokens, is not sent to AI services. It is not sold, used for personalised advertising or disclosed for other purposes. Only authorised staff have the access needed for their tasks; support access to content requires the user’s permission and must comply with Google’s requirements.
Storage, deletion and security
We store CVs, application documents, generated cover letters and the text of sent application emails for the duration of our work together, so applications can be prepared and tracked. At the end of the service, or at your request, we delete this data unless legal retention obligations prevent deletion. OAuth tokens are stored in encrypted form and deleted when the Gmail connection is removed or the service ends. Delivery logs contain delivery status, time, recipient address and Google’s message identifier, and are deleted together with the other data for the assignment. Access is limited to authorised people and necessary functions; data is transferred over encrypted connections. These deletion rules do not remove messages already sent from Gmail or from employers’ systems.
Google API Services and Limited Use
The use and disclosure of information EXODEU receives through Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements. Human access to this information is permitted only in the cases allowed by that policy, particularly with the user’s explicit consent for specific messages, for security reasons or to meet legal obligations. The information is not used to train general-purpose AI or machine-learning models.
Revoke access and delete data
You can revoke Google permission at any time in your Google account under Google Account: connections . The platform can then no longer send emails using that permission. To end the service, request deletion of stored connection tokens or make another deletion request, contact [email protected]. Revoking access does not recall applications already sent. Providing application data and authorising Gmail are voluntary; the relevant delivery assignment cannot be carried out without the necessary data or permission.
International processing
The provider operates from Türkiye. The website, application platform and Gmail connection use Cloudflare’s and Google’s international infrastructure. Cloudflare describes its safeguards for international transfers in its Data Processing Addendum and its GDPR documentation: EU Standard Contractual Clauses with supplementary safeguards and, for covered transfers to the USA, the EU–US Data Privacy Framework. Google explains its corresponding mechanisms, including Standard Contractual Clauses and the Data Privacy Framework, in its data transfer frameworks. We use OpenRouter (USA) to generate text; requests may be forwarded to language model providers outside the EU. Details of OpenRouter’s data processing are available in its privacy policy. Applicability depends on the service, the companies involved and the transfer route. These providers’ mechanisms do not automatically apply to a separate transfer to us in Türkiye. Users provide application data for the agreed delivery service; employers receive the applications addressed to them. Contact our privacy contact for information about specific recipients and the safeguards applicable to your data. Processing exclusively within Germany or the European Economic Area is not guaranteed.
Your rights and changes
Where the GDPR applies and the legal conditions are met, you have rights of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests. Consent may be withdrawn for the future; this does not affect earlier processing. You may complain to a competent data protection supervisory authority. For enquiries, contact [email protected]. If data processing changes, we update this policy and inform users; any necessary additional consent is obtained before a new use begins.