Privacy and Personal Data

howk helps you organise professional information, maintain separate profiles and multilingual portfolios, prepare CVs and cover letters, and manage contacts and private Persona notes. This notice covers account holders, visitors and people whose details appear in invitations or contact records.

The controller’s name or registered business name, address and contact details for privacy requests have not yet been confirmed. They will be completed together with the Imprint page.

Registration collects your email address and password; the password is stored in hashed form for authentication. Account preferences, verification and security records, login times and invitations are also processed. If a member invites you, that member may have supplied your email address and an invitation message.

Information you add may include profile details, employment and education, projects, skills, contact links, translations, images, descriptions and file metadata. Metadata read from an image may include location information. Depending on the features you use, howk also stores CVs, cover letters and their saved versions, Persona notes, and details about other people in your contact book.

Infrastructure and security services may process IP addresses, request times and browser or error information when you access the site. The live environment’s logging scope, recipients and retention periods must be verified before publication. Information stored on your device is described on the Cookies page.

Information is processed to create and secure your account, store your chosen content, publish your portfolio, generate documents, preserve versions, prepare exports and send invitation or account security emails.

The current application can calculate aggregate account, published-profile, profile-completeness and feature-use counts from stored records. These calculations do not analyse the content of your personal notes. howk does not currently provide automated hiring decisions, candidate scoring or an AI career-advice decision system.

The grounds to assess include entering into or performing a contract for the account and requested services, an applicable legitimate interest for security and abuse prevention, and legal obligations for required records. The applicable GDPR and/or Turkish data-protection grounds must be confirmed for each purpose once the operator and service markets are settled.

Processing that requires consent, particularly special-category data and non-essential device storage, needs separate consideration. Reading this notice, creating an account or enabling an AI-export setting is not treated as blanket consent to every processing activity.

When you publish a profile, content you mark as visible appears on the public portfolio. Visitors may copy it and search engines may index it. Unpublishing a profile does not automatically remove copies already held by others or search-engine caches.

Persona notes, contact-book records and the private document workspace are not part of the public portfolio. The image library, however, is designed for public portfolio images: direct file links may remain accessible even when a profile is unpublished. Profile visibility is not access control for image links. Do not upload confidential documents or sensitive images to this library.

Persona lets you record life circumstances and professional priorities in free text. This may include health or other special-category personal information. Avoid adding unnecessary sensitive details or private information about other people. The processing grounds and safeguards for this data must be settled before publication.

An AI export includes the selected profile’s private fields, hidden portfolio entries and language versions, together with Persona notes whose inclusion setting is on. That setting is currently on by default for new Persona notes. Contact history, CV documents and cover-letter documents are excluded from this export.

howk does not automatically send the export to an AI service. You decide whether to share it after copying or downloading it. Review the output and the chosen service’s terms first; deleting information from howk does not delete a copy you have sent to an external service.

Hosting, database, file storage, backup and email services may process the information needed to deliver their services. The current production configuration is prepared to use Resend for transactional emails. Sentry error and performance monitoring can be configured; whether it is active depends on the live settings.

The contracted providers, processing and support-access countries, subprocessors, retention periods and international-transfer safeguards have not been verified for this draft. They must be added to the final notice. This document does not promise that all information is stored exclusively in Türkiye or the European Union.

You can edit account content, delete records where supported and request an account-data export in Settings. This archive is separate from the AI export. In the current application, new archive download access closes 24 hours after the request is created; previously issued short-lived download links may work until their own expiry. Expired archives are removed by scheduled cleanup.

An account-deletion request disables the account. The current workflow provides a seven-day cancellation window, followed by deletion of the account and related records by the daily cleanup job. This does not mean backup copies disappear at the same time. Some accepted-invitation relationship records may remain; the link to the inviter’s account and the message written by that inviter are removed.

A deletion request alone does not immediately unpublish existing public profiles. If you want them removed from public view immediately, unpublish them before requesting deletion. Whether this behaviour should change before launch remains to be decided.

Retention periods and deletion exceptions for backups, security and support logs, invitation records and any legally required documents have not been finalised. See the Cookies page for drafts and preferences remaining on your device.

Subject to the applicable legal conditions, you may request information about and access to your data, correction and deletion. Where the GDPR applies, restriction, portability and objections to relevant processing may also be available. You may withdraw consent to consent-based processing and complain to the competent data-protection authority.

Where Türkiye’s personal-data law applies, relevant rights also include learning who received your data, requesting that corrections or deletion be communicated to recipients, objecting to adverse outcomes resulting solely from automated analysis, and seeking compensation for unlawful processing.

Email and postal addresses for requests, applicable response periods and authority details must be added before publication. A request channel must also be available to invitation recipients and people in contact records who do not have an account.

Changes to the operator, providers, features or processing purposes require this notice to be reviewed. The final version will state its effective date and how significant changes are communicated. The date above is only the draft’s revision date.