Privacy policy

Most people who use Stifti are young. That is why we collect as little data as possible, do not sell data and show no advertising. This page explains which data we process, why and for how long. The Swiss Federal Act on Data Protection (FADP) applies.

Controller

Krauss Software, owner Samuel Krauss, Im Ländli 18, 6315 Oberägeri, Switzerland. Questions about data protection: legal@stifti.ch.

The essentials

• Without an account you can search and read apprenticeships. We store no data about you while you do so. Your saved list then stays in your browser only.
• We use no advertising cookies, no analytics tools and no trackers.
• School reports, dossiers and other documents in the document storage are encrypted in your browser. We cannot read them.
• You can ask at any time what data we hold, have it corrected or have it deleted.

Visiting the website

When you visit stifti.ch, our server processes technically necessary information such as your IP address, the time and the page requested, so that the page can be delivered. We do not analyse this information and build no profiles. We keep the IP address briefly in memory only, to slow down too many requests in a short time. We do not write it to our logs.

All Stifti pages (stifti.ch, portal.stifti.ch, legal.stifti.ch and cdn.stifti.ch) go directly to our own server in Frankfurt. Nobody in between reads along.

If you choose a language, we remember it for one year in a cookie called "sprache". It contains only the language code.

Account and sign-in

You sign in to your account through the sign-in service EAuth. EAuth sends us a fixed identifier, your name and your email address. We receive nothing else, in particular no password.

We store:

• the identifier, name and email address from EAuth
• the roles you choose (for example searching or company)
• your language setting
• when you created your account and when you last signed in

For sign-in we set two technically necessary cookies: "__Host-stifti" keeps you signed in, "__Host-stifti-anmeldung" protects the sign-in process and is valid for at most 10 minutes. Our database contains only a fingerprint (hash) of the cookie, not its value. A session ends after 30 days without use, and after 90 days at the latest.

If you delete your EAuth account or disconnect it from Stifti, EAuth informs us, and we end your sessions or delete your account.

Document storage and dossier

Files, your CV and your cover letter in the document storage are encrypted in your browser before they reach us (end-to-end encryption). File names are encrypted too. Only you and the companies you send documents to have the key. We cannot read the contents, not even under an order from the authorities.

Not encrypted is the information we need to run the service: how many files you have, how large they are, when you uploaded them and who you shared them with.

So that you do not have to unlock the storage every time on your device, your browser keeps the key locally (IndexedDB). It is removed when you sign out, unless you have no recovery code, because you would otherwise lose your files.

If you set up a recovery code, we store your key encrypted with this code. We do not know the code itself.

Applications and taster placements

When you apply, the company sees your name, your email address, the apprenticeship and the date. Your dossier, your letter and the files you choose are encrypted for the company, and only its team can open them. When the company answers, we send you its message by email. The company's team can make internal notes on your application. You do not see them. They are deleted together with the documents.

Requests for taster placements are short messages without documents. They are not end-to-end encrypted, so that the company can read them directly.

Companies

For companies we store the company details (name, address, UID, contact), the team members and their roles, apprenticeships, photos and our team's internal notes from the check. We remove all metadata from photos, such as location and camera, before storing them.

Emails

We send emails only when necessary, for example when a company answers your application, a company has been activated, someone is invited to a team or applications to a company are still unanswered. We use the service EMX to send them. After sending, we delete the content of the email from our queue.

Reports

If you report an apprenticeship, we store the reason, the text and, if you provide it, your email address so that we can reply. To prevent abuse, we store a hash instead of your IP address, with a key that changes every day. The IP address cannot be recovered from it.

Log

We record changes made by our team or by companies (for example an activation or a blocked apprenticeship) in a log, so that we can trace who did what. Entries are deleted after two years.

Where the data is stored

Our servers are in a data centre in Frankfurt am Main, Germany. According to the Swiss Federal Council, Germany provides adequate data protection.

We work with these service providers:

• EAuth: sign-in
• EMX: sending emails
• Tavuru (tavuru.com), Germany: servers in the data centre in Frankfurt am Main
• Cloudflare, Inc., USA: only manages the records of our domain (DNS). Your visits to our pages do not go through Cloudflare.

How long we keep data

• Account: until you delete it or it is deleted at EAuth
• Sessions: at most 90 days
• Sign-ins that were started: at most 10 minutes
• Document storage and dossier: until you delete the files or your account
• Application documents at the company: six months after a rejection or your withdrawal, twelve months after an offer. After that, we delete the package, your name, your email address and the company's notes, and the company no longer has access. The fact that the application existed counts towards the reply rate for up to 365 days. After two years, we delete this entry too.
• Requests for taster placements: twelve months
• Content of emails: until they are sent
• Reports: two years after we have dealt with them
• Log: two years

Young people

Stifti is meant for young people from about 13 years of age. Anyone with capacity of judgement can consent to the processing of their own data. Parents can contact us at any time.

Your rights

At any time, you can:

• ask what data we hold about you
• have incorrect data corrected
• have your data deleted
• receive your data in a common format

You can download your data and delete your account yourself, in your account under "Settings". For anything else, write to legal@stifti.ch. If you are not satisfied with our answer, you can contact the Federal Data Protection and Information Commissioner (FDPIC).

Changes

If anything in this policy changes, we update it here. The date at the top shows the current version.