Last updated · June 2026
Private by default.
What we collect
NextRound collects the information you provide when creating an account (name, email, password) and the job search data you enter directly — applications, notes, stories, interview records. If you connect Gmail, we scan your mailbox for job-related emails using only their sender, subject, date and Gmail’s own short preview. For a thread you choose to import, we read and store its full message text — up to 20,000 characters per message, encrypted at rest — because that is where interview dates and recruiter replies live. We do not read the full text of messages you have not imported, and we never download attachments.
How we use it
Your data is used exclusively to provide the NextRound product — tracking your pipeline, generating interview prep, and personalizing coaching. We do not sell your data, share it with third-party advertisers, or use it to train external AI models.
AI features
When you use AI-powered features, your inputs are sent to Anthropic's API to generate responses. Anthropic processes this data under their own privacy and commercial terms, and does not use API inputs to train their models. We do not retain AI conversation data beyond what's needed to display your session.
Data storage
Your data is stored with reputable cloud infrastructure providers. We use industry-standard encryption in transit (HTTPS), and sensitive data — including connected-account tokens and personal details — is additionally encrypted at rest. Passwords are hashed and never stored in plain text.
Service providers
To run NextRound, we rely on a small set of trusted providers that process data on our behalf: application hosting (Fly.io, United States), website hosting (Vercel, United States), our database and CDN (MongoDB Atlas, Cloudflare), our AI provider (Anthropic, United States), payment processing (Stripe, United States), transactional email (Resend), error monitoring (Sentry, United States), and privacy-friendly product analytics (PostHog, EU). Each processes only the data needed for its function, under its own security and privacy commitments. We do not sell your data or share it with advertisers.
Legal basis
Under the GDPR, we process your personal data on these grounds. We process the data needed to perform our contract with you — providing the NextRound service you signed up for, including your account, resumes, applications, stories, and AI features. We rely on our legitimate interests for product analytics (PostHog) and for security and abuse prevention. We rely on your consent when you choose to connect Gmail or Google Calendar (optional OAuth), which you can withdraw at any time by disconnecting from Settings.
Where your data lives
NextRound is operated from Germany, but most of the infrastructure runs in the United States: our API is hosted on Fly.io and our website on Vercel, so your personal data is stored and processed there. Our database (MongoDB Atlas), AI provider (Anthropic), payment processor (Stripe), transactional email (Resend), error monitoring (Sentry) and storage/bot protection (Cloudflare) also involve processing in the United States. Product analytics (PostHog) is hosted in the EU (Frankfurt). Transfers to the United States are covered as follows. Fly.io, Vercel, MongoDB, Sentry, PostHog and Google are active participants in the EU–US Data Privacy Framework, an adequacy decision of the European Commission. Anthropic is not a Data Privacy Framework participant; transfers to Anthropic rely on the European Commission’s Standard Contractual Clauses under its data processing agreement. Payments are contracted with Stripe’s Irish entity, with any onward transfer to the United States covered by both the Data Privacy Framework and Standard Contractual Clauses. Transactional email (Resend, legally Plus Five Five, Inc.) relies on Standard Contractual Clauses. Where a processor is not covered by an adequacy decision, Standard Contractual Clauses apply.
Data retention
We keep your personal data for as long as your account is active. When you delete your account (or otherwise request erasure), we permanently delete your resumes, applications, stories, AI outputs, and Google tokens. Records we are legally required to keep — in particular billing and credit-transaction records needed to meet German commercial and tax retention obligations (HGB §257 / AO §147) — are retained for the statutory period even after account deletion, and deleted once it expires. Beyond that, the following are deleted automatically on a fixed schedule, whether or not you delete your account: background job records after 7 days; mock-interview sessions after 30 days; security audit logs, AI-usage records and notifications after 90 days; and the cached classification we store for each scanned email thread after 180 days. Security audit logs contain only a user identifier and IP address, never your content.
Retention of Google data
Email content we import from Gmail — the sender, subject, date and message text of threads matched to your applications — is retained for as long as your account is active, because it is the content of the application timelines the product exists to show you. It is encrypted at rest. We do not sell it, and we do not use it to train any AI model. You stay in control of it, in two ways, and they do different things. Disconnecting Gmail in Settings revokes our access at Google immediately and stops any further import. It does not delete email that has already been imported: that stays in your pipeline, where you can still read and use it. If you want it gone as well, delete your account, or email us and we will remove it for you. Deleting your account permanently erases all imported email content, the cached thread classifications, and the stored Google tokens, and also revokes our access at Google. Neither action is reversible. Deletion removes your data from our live systems straight away. Encrypted database backups are kept for 14 days and then deleted automatically, so a copy can remain in a backup for up to that long; if we restore from one, we re-apply outstanding deletions.
Analytics & cookies
We use privacy-friendly product analytics (PostHog) to understand how the product is used and improve it. Our analytics are configured to be minimal: we do not record your screen or session, do not use advertising or cross-site tracking cookies, and do not store analytics identifiers on your device. The only cookies we set are the ones strictly necessary to keep you securely signed in. Because we don't use non-essential cookies or device storage for tracking, NextRound does not show a cookie-consent banner.
Google user data
NextRound's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data we access from Gmail (via the gmail.readonly scope) and Google Calendar (via the calendar.readonly scope) is used solely to provide and improve user-facing features within NextRound. To power these features — for example, detecting which of your emails are from recruiters — email metadata (sender, subject) and short body excerpts are processed by our AI provider (Anthropic) acting as a sub-processor under our terms; Anthropic does not use this data to train its models. This data is never sold, never shared with third parties for their own purposes, never used for advertising, and never used to train generalized AI or machine learning models. We do not allow humans to read this data except with your affirmative agreement, for security, to comply with law, or in aggregated and anonymized form for internal operations.
Your rights
You can delete your account yourself at any time in Settings, which permanently erases your data. For other rights — including access, portability, correction, and objection — email us at and we'll respond within a reasonable timeframe. You can disconnect Gmail at any time from Settings; that stops further import and revokes our access at Google, and leaves the email already imported in your pipeline until you delete your account or ask us to remove it. The data controller is the operator identified in our Impressum.
Contact
Questions about privacy?