Privacy policy

1. Controller

Carovo GmbH, Am Juliusturm 31, 13599 Berlin, email: info@carovo.ai.

2. What data we collect

When you book the Readiness Check and fill in the questionnaire, we process the details you enter yourself:

If you sign up through the cohort dialog, we additionally process your name, your email address and the free-text note on where your procedure stands. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual steps at your request). We use these details solely to write to you when a place opens up, and delete them no later than twelve months after you signed up, or immediately on request.

• country of training, year of graduation, professional experience and areas worked in
• the status of your recognition procedure, the compensation measure concerned, the Bundesland and, where applicable, your exam date
• your self-assessment of your German and information about language certificates
• your answers in the professional self-test and your free-text entries
• your email address and, if provided, your WhatsApp number

3. Why this data is treated with particular care

Information about origin, training and professional status is sensitive. We treat it strictly for its purpose: it is used solely to write your personal analysis. It is not passed to third parties, not used for advertising, not sold and not used for profiling.

4. Legal basis

Processing takes place in order to perform the contract for the Readiness Check pursuant to Art. 6 (1) (b) GDPR. Providing your WhatsApp number voluntarily is based on your consent pursuant to Art. 6 (1) (a) GDPR; you can withdraw it at any time.

5. Deletion

We delete your questionnaire data no later than 30 days after your analysis has been delivered. Excluded is data we must keep longer under commercial or tax law — that concerns invoice data, not your professional answers.

6. Recipients and processors

We use the following service providers:

• Vercel Inc. — operating the website
• Stripe Payments Europe, Ltd. — payment processing. Your payment details are entered directly with Stripe; we never see full card data.
• Resend (Plus Five Five, Inc.) — sending the email with your questionnaire to us
• Plausible Insights OÜ (Västriku tn 2, 50403 Tartu, Estonia) — audience measurement without cookies, processed exclusively within the EU, servers in Germany
• Vercel Web Analytics (Vercel Inc.) — audience measurement without cookies, aggregated only
• Neon (Neon Inc.) — database for the audience counters and the cohort sign-ups, servers in Frankfurt am Main

7. Audience measurement

Part of the reach we count ourselves, without a third-party tool. When a page is opened, when the main button is clicked and when the cohort form is submitted, we increment a counter in our own database. All that is stored is: the type of event, the language chosen, the place on the page and the hour it happened in. We set no cookies, store nothing on your device, keep neither IP address nor browser fingerprint, and therefore cannot attribute a single view to a person or even to one visit. What is counted are page views, not visitors. The legal basis is our legitimate interest in audience measurement without personal reference, Art. 6 (1) (f) GDPR. The counters are deleted after twelve months.

We additionally use Plausible Analytics, operated by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible sets no cookies and stores nothing on your device. The script reads a single value called “plausible_ignore” from your browser’s local storage; it exists so that we can exclude our own visits from the count, and it is only present if it was set there by hand. Nothing is written. What is recorded is the page you opened without query parameters, the referring page, browser, operating system, device type and the location derived from your IP address at country, region and city level. Your IP address and your full browser identifier are not stored. To recognise repeat views within a single day, Plausible derives a checksum from them that changes daily and cannot be reversed; beyond that day no recognition is possible. Processing takes place exclusively within the European Union, with servers in Germany. We have a data processing agreement with Plausible under Art. 28 GDPR. The legal basis is our legitimate interest in audience measurement without personal reference, Art. 6(1)(f) GDPR.

We additionally run Vercel Web Analytics. This service also sets no cookies and builds no cross-device profiles. What is recorded are page views, country of origin, device type and referring page — in aggregate, without an identifier that would make you recognisable. We use it to see whether ads bring visitors at all, before anyone clicks.

8. Your rights

You have the right to information, rectification, erasure, restriction of processing, data portability and objection. Write to us at info@carovo.ai. You can also lodge a complaint with a data protection supervisory authority.