Privacy Policy | MirageScouting

1. Data Controller

The controller for the data in your own MirageScouting account and for operating the platform is Lehel Kakonyi (sole proprietorship trading as “Miragescouting.de”). When a company uses MirageScouting for its hiring process or for its employees (MirageScouting Office), that company is the controller of this data, and MirageScouting processes it on the company's behalf under the data processing agreement (AVV). If you have any questions about your data, contact our Data Protection Officer at privacy@miragescouting.de.

2. Personal Data We Collect

We collect data you provide directly (name, email, work history, skills, CV), data generated through platform use (skill assessment results, interview session transcripts, application status, academy progress), technical data (IP address, browser type, session identifiers), and communication data (support requests, newsletter opt-in). When a member of a company opens your full profile, we record which company it was and when (“Who viewed your profile”). We also note which member it was, only to count how many different people looked; we never show you who it was.

3. Legal Basis for Processing

We process your data on the following legal bases: performance of a contract (Art. 6(1)(b) GDPR) for account management and service delivery, including showing your profile to companies in People Scouting and passing on their invitations to apply; legitimate interests (Art. 6(1)(f) GDPR) for platform security and fraud prevention; your consent (Art. 6(1)(a) GDPR) for marketing communications and optional analytics; and compliance with a legal obligation (Art. 6(1)(c) GDPR) for tax and audit purposes. We show you which companies opened your profile on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in a transparent platform, and we send the weekly “Jobs for you” email only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

4. How We Use Your Data

We use your data to provide and improve the MirageScouting platform, match candidates to relevant roles, generate AI-assisted skill and career assessments, deliver personalised academy learning content, facilitate mentor sessions, send transactional communications, and comply with legal obligations. We do not sell personal data to third parties. If you switch on the weekly digest, we email you up to five open roles that match your profile and the companies that viewed it; switch it off in your account settings or with the link in any digest.

5. AI-Assisted Processing

MirageScouting uses AI models from Google (Gemini, including Gemini Live), Anthropic (Claude) and OpenAI to conduct structured voice interviews, generate evaluation summaries, and produce career insights. OpenAI is used to index role documents and as an alternative voice output. Interview transcripts are processed to generate synthesis reports. Raw audio is not stored beyond the session. AI-generated scores are never surfaced to candidates. You may request a copy of your evaluation report via the platform settings. The assessment is based on your answers and on the criteria set by the company, and every rating is backed by quotations from the conversation. A person decides on every hiring decision; MirageScouting does not decide on an application itself, so there is no decision based solely on automated processing within the meaning of Art. 22 GDPR.

6. Data Sharing

We share data with: employers, in two ways. When you apply for one of their jobs, they see your application. And while Incognito Mode is off, which is the default, companies using People Scouting on MirageScouting can find your profile and see the details you have not hidden; your salary expectation and motivation stay hidden unless you choose to show them. Companies can also invite you to apply for one of their published jobs. The invitation reaches you in the app and by e-mail, and the company never sees your e-mail address. You can switch on Incognito Mode, or switch off invitations, at any time in your profile's privacy settings. We also share data with service providers acting as processors under Data Processing Agreements (Art. 28 GDPR) (cloud infrastructure, AI model APIs, email delivery, analytics), and with competent authorities when required by law. All processors are contractually bound to process data only on our instructions. Profile views: you see the name of each company whose members opened your full profile and how many of them did — never who they were. A current list of these processors, with the service, location and transfer basis, is in Annex 2 of the Data Processing Agreement (DPA, linked in the footer). If a company chooses “Start a discussion on Discord” when it publishes a post, we send the company name, the post title and a link to Discord Inc. (USA); the post text, images and author are not sent. If a company has chosen to make its content available to AI agents (this is off by default), AI assistants connected to our MCP server can read that company's published stories as plain text, with the optional “Written by” name and the author's role exactly as every reader of the post page sees them; account IDs, e-mail addresses and images are not included.

7. International Data Transfers

Some processors operate outside the EEA (for example, cloud and AI model APIs). Where such transfers occur, we rely on the EU Standard Contractual Clauses (SCCs) approved by the European Commission to ensure an adequate level of protection.

8. Data Retention

We retain account data for the duration of your active account plus 3 years for audit purposes. Interview session data and evaluation reports are retained for 24 months. Newsletter consent records are retained until withdrawal. You may request early deletion at any time via the preference centre. Profile views are deleted after 12 months. Connection data on our servers (IP address, time, requested page) is kept only as long as we need it for security and stable operation.

9. Your Rights

Under the GDPR you have the right to access, rectify, or erase your personal data; restrict or object to processing; data portability; and to withdraw consent at any time without affecting the lawfulness of prior processing. To exercise any right, contact privacy@miragescouting.de. You also have the right to lodge a complaint with a supervisory authority, for example the one responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information (datenschutz-berlin.de), or the authority where you live.

10. Cookies and Tracking

We use strictly necessary cookies for authentication and session management. With your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG) we also use two optional categories, both off by default: analytics (PostHog, servers in the EU) to understand platform usage, including session recording; and diagnostics (Sentry) for error reports and session recording in a small share of sessions and whenever an error occurs. You can change or withdraw your choice in the preference centre at any time. On some sign-up pages Cloudflare Turnstile checks that a person, not a script, is signing up: your browser loads a script from Cloudflare, and Cloudflare receives your IP address and browser data for that check. The legal basis is our legitimate interest in protecting the platform from abuse (Art. 6(1)(f) GDPR).

11. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, disclosure, alteration, or destruction. These include encryption in transit and at rest, access controls, and regular security assessments. To protect our assessment content, we log each time an account retrieves skill-level descriptions (account ID, role, time) and limit how many it can retrieve per day; the legal basis is our legitimate interest in protecting our trade secrets and preventing misuse (Art. 6(1)(f) GDPR).

12. Changes to This Policy

We may update this policy periodically. Material changes will be communicated via email or in-platform notification at least 30 days before they take effect. Where a change needs your consent, we ask for it again; your rights, including objection and withdrawal of consent, are not affected.

13. Contact

For any privacy-related questions, contact: Lehel Kakonyi (sole proprietorship trading as “Miragescouting.de”), Data Protection Officer, privacy@miragescouting.de.