Privacy Policy

1. Data Controller

The data controller within the meaning of data protection laws is:

LyftOff

Luckenbachweg 2, 79115 Freiburg, Germany

Email: privacy@lyftoff.tech

Who controls what.For your LYFTOFF account — your profile, reflection data, roadmap and progress — LYFTOFF is the controller and this policy governs.

The recruitment product works differently. Where a recruitment agency holds you in its candidate records, that agency decides why and how your data is used, so the agency is the controller and LYFTOFF acts as its processor under a data processing agreement. The same applies to an institution in respect of its own student records.

This matters when you want to exercise a right. For your LYFTOFF account, write to us. For records an agency or institution holds about you, that organisation is your first point of contact — we will act on their instructions and will help you reach them if you write to privacy@lyftoff.tech.

2. Collection of General Information

When you access our website, information of a general nature is automatically collected. This information (server log files) includes the type of web browser, the operating system used, the domain name of your Internet Service Provider, and similar data. This is exclusively information that does not allow any conclusions to be drawn about your person.

This information is technically necessary to correctly deliver the content of web pages you have requested and is an unavoidable consequence of using the Internet. Anonymous information of this kind is statistically evaluated by us to optimise our website and the underlying technology.

3. Data We Collect

Account details

When you register, we collect your name, email address, password (hashed), and date of birth. Date of birth is required: we use it to apply the minimum age and the parental consent rule described in section 12, and we cannot apply those rules without it. Optionally, you may provide your country, education level, and career interests.

If you are under 18, we also collect a parent or guardian's email address in order to seek and record their consent.

Reflection data

During onboarding, you provide information about your strengths, values, interests, constraints, and goals. This data is encrypted at rest (AES-256) and is never shared with parents, institutions, or third parties.

Usage data

We collect anonymised analytics data such as page views, feature usage, and engagement metrics to improve the platform.

4. Cookies

Like many other websites, we use so-called “cookies”. Cookies are small text files that are transferred from a web server to your hard drive. This automatically provides us with certain data such as your IP address, the browser you use, your operating system, and your connection to the Internet.

Cookies cannot be used to launch programs or transfer viruses to a computer. Using the information contained in cookies, we can make navigation easier for you and enable the correct display of our web pages.

Under no circumstances will the data we collect be passed on to third parties or linked to personal data without your consent.

Of course, you can view our website without cookies. Internet browsers are normally set to accept cookies. You can deactivate the use of cookies at any time via your browser settings. Please note that some features of our website may not work if you have deactivated the use of cookies.

5. Purpose and Legal Basis

We process your data for the following purposes:

• Providing and operating the LYFTOFF platform (Art. 6(1)(b) GDPR — contractual performance)
• Personalising career roadmaps, skill analyses, and recommendations (Art. 6(1)(b) GDPR)
• Sending notifications and updates you have opted into (Art. 6(1)(a) GDPR — consent)
• Improving the platform through anonymised analytics (Art. 6(1)(f) GDPR — legitimate interest)
• Fulfilling legal obligations (Art. 6(1)(c) GDPR)
• Sharing your profile with a recruitment agency or employer (Art. 6(1)(a) GDPR — consent). This is always a separate, specific consent you give per agency or introduction, and you can decline or withdraw it
• Verifying a parent or guardian's approval where you are under 18 (Art. 6(1)(c) GDPR — legal obligation, and Art. 8 GDPR)
• Keeping invoices and audit records we are legally required to retain (Art. 6(1)(c) GDPR)

Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of what we did before you withdrew.

6. SSL Encryption

To protect the security of your data during transmission, we use state-of-the-art encryption methods (e.g. SSL) via HTTPS.

7. Data Storage and Security

Your data is stored on Supabase infrastructure in the EU region (Frankfurt, Germany) to ensure GDPR compliance. All data is encrypted at rest with AES-256 and in transit with TLS 1.3.

Your data is retained for as long as your account is active. When you delete your account, your personal data is removed within 72 hours— with the narrow exceptions below, which we are required by law to keep.

• Invoices and accounting records— where you or your organisation has been invoiced, tax and commercial law require the invoice to be kept for up to 10 years. We cannot delete these on request. We do remove personal detail from them: names are stripped from invoice lines and replaced with an opaque reference, so the record that survives is financial rather than personal.
• Audit logs — records of who accessed what are kept for up to 2 years. They are what lets us show a counsellor or recruiter looked at your record, so they cannot be deleted on request without defeating their purpose.
• Anonymised analytics— retained up to 2 years. This no longer identifies you and is not restored to you on deletion.

Outside these exceptions, deletion is complete: your profile, reflection data, roadmap, documents and messages are removed.

8. AI-Powered Features

LYFTOFF uses artificial intelligence to generate career roadmaps, skill gap analyses, and guidance recommendations. AI-generated content is clearly labelled and is for informational purposes only.

To do this we send content to third-party AI providers — Anthropic, OpenAI and Google— who act as our processors. They are based in the United States, so this involves an international transfer; see section 15. Matching additionally sends vacancy and candidate text to OpenAI to compute similarity scores.

Two limits apply, and we hold ourselves to both. Your content is never used to train these providers' models. And your reflection data is never sent to them at all— it stays encrypted in our database and is excluded from every AI feature, including the assistants available to recruiters, employers, institutions and parents.

If no AI provider is configured, AI features degrade rather than fail: guidance is simply unavailable, and matching falls back to structured scoring that does not involve any third party.

9. Newsletter

When you subscribe to our newsletter, the data you provide is used exclusively for this purpose. Subscribers may also be informed by email about circumstances relevant to the service or registration (such as changes to the newsletter offering or technical conditions).

For effective registration, we require a valid email address. To verify that a subscription is actually made by the owner of an email address, we use the “double opt-in” procedure. No additional data is collected. The data is used exclusively for newsletter distribution and is not passed on to third parties.

You can revoke your consent to the storage of your personal data and its use for newsletter distribution at any time. You can also unsubscribe directly on this website or contact us using the contact details provided at the end of this privacy policy.

10. Contact Form

If you contact us by email or contact form, the information you provide will be stored for the purpose of processing the enquiry and for any follow-up questions.

11. Data Sharing

We do not sell your personal data. Data may be shared with:

• Supabase(database hosting, EU Frankfurt) — as a data processor
• Vercel(frontend hosting) — as a data processor
• Resend(email delivery) — for transactional emails only
• AI providers(Anthropic, OpenAI, Google) — as data processors, to generate guidance and to compute the similarity scores used in matching. Content you provide may be sent to them for processing. It is never used to train their models, and your reflection data is never sent. See section 8.
• Parents/guardians— aggregated progress data only, never reflection data
• Institutions— how much an institution sees depends on its plan. All institutions receive aggregated cohort statistics. Institutions on our white-label tier may additionally allow verified counsellors to view a named individual studentwho belongs to that institution — their enrolment, pathway and progress — because supporting a specific student by name is the counsellor's job. That access is limited to their own institution, is logged, and is read-only: counsellors can never see your reflection data and can never change your roadmap.
• Recruitment agencies— if you are referred to an agency, connect yourself to one, or accept an agency's request from the opt-in talent pool, that agency receives your profile and any documents you provide. Nothing is shared until you consent, and you can decline or withdraw.
• Employers— an employer working with your agency first sees an anonymised shortlist with no name or contact details. Your identity is released to them only after you have consented to that specific introduction.

We do not sell personal data, and we do not share it for advertising.

12. Children and Young People

You must be at least 16 to create a LYFTOFF account. We ask for your date of birth when you register in order to apply this rule.

If you are under 18, a parent or guardian must approve your account before you can use it. We apply this globally rather than by country. Several regimes bear on this and they set different ages — Art. 8 GDPR sets 16 in Germany, while South Africa's POPIA treats anyone under 18 as a child, and a minor's capacity to enter a contract is limited until 18 under German law. Rather than apply the weakest rule to some users, we apply the strictest to everyone.

To obtain that approval we ask for a parent or guardian's email address and contact them directly. We collect and store their email for the purpose of recording consent. Until consent is given, the account remains limited. A parent or guardian may withdraw consent at any time, which closes the account.

We do not knowingly collect data from anyone under 16. If you believe a child under 16 has given us personal data, contact privacy@lyftoff.tech and we will delete it.

13. Where Recruitment Data Comes From

Most data we hold about you comes from you. In the recruitment part of the platform there is one exception you should know about: a recruitment agency may add you to its own candidate records after sourcing your details elsewhere — for example from a CV you sent them, a referral, or a professional listing — before you have a LYFTOFF account.

In that situation the agency is the controller of those records and is responsible for telling you it holds them; LYFTOFF acts as its processor. Such a record is not connected to a LYFTOFF account, and no LYFTOFF profile or progress data is attached to it, unless youchoose to connect it. If you later register with the same email address, we will show you which agencies hold your details and let you connect or refuse. Refusing does not delete the agency's own record — that is theirs, under their lawful basis — but it stops the account link and stops us asking again.

To ask an agency what it holds about you, or to object, contact that agency directly. We will help you reach them — write to privacy@lyftoff.tech.

14. Automated Decision-Making and Profiling

Parts of the platform score and rank automatically. Roadmaps, skill gap analyses and readiness scores are generated from what you tell us. In the recruitment product, a matching engine ranks candidates against a vacancy.

That ranking is deliberately explainable rather than a black box. A score is built from structured, inspectable components — language level, experience, credential recognition and readiness — and any recruiter looking at it sees that breakdown. A semantic similarity signal may adjust a score, but it is capped as a small adjustment and can never override the structured requirements.

No decision that produces a legal or similarly significant effect on you is made by software alone.A ranking is a suggestion to a human recruiter; the decision to shortlist, introduce or place you is taken by a person. You have the right to obtain human intervention, to express your point of view, and to contest an outcome — contact privacy@lyftoff.tech.

15. International Data Transfers

Your account data is stored in the EU (Supabase, Frankfurt). Some processors we rely on are based outside the EU/EEA, principally the AI providers named in section 11 (Anthropic, OpenAI and Google, in the United States), and we operate across Germany, Zambia, South Africa and Nigeria, so data may be transferred to a recruitment agency or employer in another country when you consent to that introduction.

Where a transfer leaves the EU/EEA to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses together with additional technical measures (encryption in transit and at rest, and minimising what is sent). You may request a copy of the safeguards for a specific transfer by writing to privacy@lyftoff.tech.

16. Deletion and Blocking of Data

We adhere to the principles of data avoidance and data minimisation. We therefore only store your personal data for as long as is necessary to achieve the purposes mentioned here or as provided for by the various storage periods stipulated by law. After the respective purpose ceases to apply or these periods expire, the corresponding data is routinely blocked or deleted in accordance with statutory provisions.

17. Web Analytics

This website uses Vercel Analytics, a privacy-friendly web analytics service. Vercel Analytics collects anonymised usage data without the use of cookies and without storing personal data. No data is transmitted to third parties.

18. Your Rights

You have the right to obtain information about your personal data stored by us at any time. Under the GDPR, you have the following rights:

• Right of access(Art. 15) — request a copy of your data
• Right to rectification(Art. 16) — correct inaccurate data
• Right to erasure(Art. 17) — account deletion within 72 hours
• Right to data portability(Art. 20) — export your data
• Right to restriction(Art. 18) — restrict processing
• Right to object(Art. 21) — object to processing
• Right to withdraw consent (Art. 7(3))

To ensure that data can be blocked at any time, such data must be kept in a blocking file for control purposes. You may also request deletion of data insofar as there is no statutory archiving obligation. You can make changes or revoke consent by notifying us with effect for the future.

19. Supervisory Authority

You have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence.

Outside the EU. We operate in markets with their own data protection laws, and where one gives you stronger rights than the GDPR, that stronger protection applies to you. This includes South Africa (Protection of Personal Information Act), Nigeria (Nigeria Data Protection Regulation) and Zambia (Data Protection Act 2021). You may complain to your own national regulator: the Information Regulator in South Africa, the Nigeria Data Protection Commission, or the Data Protection Commissioner in Zambia.

Where these regimes differ we apply the strictest rule to everyone rather than the weakest to some — the parental consent age in section 12 is an example: POPIA's under-18 threshold is applied globally, not only in South Africa.

20. Changes to This Privacy Policy

We reserve the right to amend this privacy policy from time to time to ensure it always complies with current legal requirements or to implement changes to our services in the privacy policy, e.g. when introducing new services. Your next visit will be subject to the new privacy policy.

21. Questions About Data Protection

If you have questions about data protection, please send us an email at: privacy@lyftoff.tech