Privacy Policy

Last updated 4 October 2026

1. Who is responsible

Quinta5 is an AI workspace for executive search, operated by Max Kugland, trading as Quinta5, Nordstraße 26, 50733 Köln, Germany ("Quinta5", "we", "us"). You can reach us at max@quinta5.com or through the contact form. We are not required to appoint a data protection officer.

This policy covers visitors to our website, people who use Quinta5 for a customer or in a demo campaign, and the people named in material that customers work with in Quinta5.

2. Our two roles

For our website, user accounts, demo campaigns, enquiries and usage data we are the controller (Sections 3 to 6).

For the material a customer works with in Quinta5, such as briefs, CVs, interview notes, references, chats and reports ("Customer Data"), the customer is the controller and we are its processor under a data processing agreement (Section 7). If you are a candidate, referee or other person named in that material, please direct questions and requests to the search firm you dealt with; we help them answer.

3. Using our website and application

3.1 Usage data

For every request to our servers we record the page or endpoint, the parameters in the address (which can include search terms), the HTTP method, status and response time, your IP address and browser user agent, and for a campaign link the campaign (Section 5). If you are signed in, we also record:

• your account, organization and selected project;
• which pages you view and which buttons, links and form controls you use, identified by a fixed name for each control. We never record what you type, the values you choose or the text on the page;
• an identifier of your sign-in, derived on our server, which links these records. Nothing is stored in your browser for this.

We use this data to operate and secure Quinta5, to find and fix errors, and to understand how Quinta5 and our demo campaigns are used so we can improve them. It is stored on our own servers, is never visible to other customers and is not passed to third-party analytics services. Legal basis: our legitimate interest in a secure, working and improving service (Art. 6(1)(f) GDPR).

3.2 Session cookie

We set one first-party cookie, and only when it is needed: when you sign in, open a page with a form (sign-in, contact, campaign entrance) or enter a demo campaign. It keeps you signed in, protects forms against cross-site request forgery and holds your campaign access. It contains no analytics or advertising identifiers. It is signed, cannot be read by page scripts (HttpOnly), is only sent over HTTPS and expires 30 days after it was last renewed. Because it is strictly necessary for the service you request, it needs no consent (§ 25(2) No. 2 TDDDG). We set no other cookies.

3.3 No third-party content

Our pages load all fonts, scripts, styles, images and videos from our own servers. Visiting Quinta5 sends no data to third parties.

4. Accounts and sign-in

When a customer creates an account for you, we process your email address, display name, role and organization. Sign-in is passwordless: we email you a link that works once and expires after 15 minutes. A sign-in lasts up to 30 days. If you are issued a personal API key or connect an AI assistant to Quinta5 (Section 7.2), we store only a cryptographic hash of the key or credential. Legal basis: performance of the contract with your organization and our legitimate interest in providing and securing access (Art. 6(1)(b) and (f) GDPR).

5. Demo campaigns

We invite prospective customers to try Quinta5 in a demo workspace through a campaign link. Opening the link gives you a temporary participant account for the campaign's access period. We record your use of the demo like any other usage (Section 3.1), together with the campaign. A campaign link can carry an opaque referral code that tells us which invitation or outreach it came from; when you enter the campaign, we store it with your participant account.

At the end of a campaign you can leave your email address to receive the final report. We use it to send you that report. If you also tick the box to hear more about Quinta5, we use it to contact you about Quinta5; you can withdraw this consent at any time by writing to us. Legal basis: our legitimate interest in demonstrating Quinta5 and measuring our campaigns, your request for the report, and your consent for follow-up (Art. 6(1)(f), (b) and (a) GDPR).

6. Enquiries and feedback

When you use the contact form, we receive your name, work email, organization, the details you enter and your message by email and use them to answer you. In-app feedback also records the page from which it was sent. Legal basis: our legitimate interest in answering enquiries and improving Quinta5, or steps towards a contract (Art. 6(1)(f) and (b) GDPR).

7. Customer Data and AI processing

7.1 How we process Customer Data

Customer Data can contain personal data about candidates, referees, interviewees and others, occasionally including special categories of data (Art. 9 GDPR), for example health information mentioned in an interview note. We process it only to provide Quinta5 to the customer and on its instructions: storing it, making it searchable, and drafting answers, summaries and reports at a user's request. We do not use it for our own purposes such as marketing or training AI models.

Quinta5 assists users in assessing candidates. At a user's request, it combines facts from the material the user selects into answers, comparisons and reports, including recommendations based on the client's requirements, each linked to its sources. Quinta5 takes no decisions and does not act on its own; users review the drafts and decide.

To draft text and make material searchable, the relevant content is sent to OpenAI (Section 8). OpenAI does not use data sent through its API to train its models, and keeps it for abuse monitoring for up to 30 days.

7.2 Connected AI assistants

Users can connect third-party AI assistants to Quinta5, for example through our MCP connector or an API key. The assistant then reads Customer Data on that user's behalf, and the data is processed by the assistant's provider under the customer's own agreement with that provider. We are not responsible for that processing.

8. Recipients

We do not sell personal data. We use these service providers, each bound by a data processing agreement:

Hetzner Online GmbH, Gunzenhausen, Germany

Hosting of the application and database, in Germany.

Amazon Web Services EMEA SARL, Luxembourg

Storage of daily database backups (Amazon S3), in Frankfurt, Germany.

OpenAI Ireland Ltd, Dublin, Ireland

AI processing: embeddings for search, and drafting of answers, summaries and reports. OpenAI processes data in the United States.

united-domains GmbH, Starnberg, Germany

Email delivery: sign-in links and contact-form messages.

We also disclose data where the law requires it, or to establish, exercise or defend legal claims.

9. Transfers outside the EU/EEA

OpenAI transfers data to the United States on the basis of the EU Standard Contractual Clauses. All other providers process data in Germany.

10. How long we keep data

We keep personal data only as long as necessary for the purpose it was collected for, or as long as the law requires:

• account data for as long as the account exists;
• Customer Data for as long as the customer keeps it, and then as set out in the data processing agreement;
• usage data no longer than necessary for the purposes in Section 3.1;
• demo content (chats and reports) until the campaign's retention period after its end has passed;
• an email address left for a campaign report until the report has been sent, or, with your consent to follow-up, until you withdraw it;
• enquiries for as long as needed to handle them and any resulting business relationship.

Deleted data can remain in backups until those backups are deleted automatically, 365 days after they were made.

11. Security

Connections are encrypted (TLS), and database backups are stored encrypted. Each customer's data is separated at the database level, so it cannot be reached through another customer's account. Sign-in links are single-use and short-lived, and API keys are stored only as hashes.

12. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), erased (Art. 17) or its processing restricted (Art. 18), to receive it in a portable format (Art. 20), and to withdraw consent at any time with effect for the future (Art. 7(3)). You can object at any time to processing based on our legitimate interest (Art. 21 GDPR). To exercise these rights, write to max@quinta5.com.

You can also complain to a data protection supervisory authority. Ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf.

13. Changes

We update this policy when our service or legal obligations change, and change the date at the top when we do. We tell customer administrators about material changes.