Privacy Policy

The one-paragraph version

We collect only what the product needs: your email, your CV, your job preferences, and how you use the features. Your CV text is sent to AI providers to generate your scores and feedback — nothing more. We never sell your data, and no employer ever sees you unless you explicitly opt in (a feature that is not even live yet). You can delete your CV in the app and your account by email, anytime.

What we collect

• Account: email address, name if you provide it, country (detected once at signup, editable).
• Career data you give us: your CV file and its parsed text, target roles and countries, job descriptions you paste, interview answers you type, applications you track.
• Usage: which features you use and AI token counts (to enforce fair-use limits), plus standard technical logs.
• Payments: your subscription status from our merchant of record (Paddle or Lemon Squeezy). Card details never touch our servers.
• Cookies: essential sign-in cookies only. No advertising trackers.

How your data is used

• To run the features you ask for: scoring, tailoring, documents, interviews, matching, the tracker, and your daily digest if you opt in.
• AI processing: your CV text and inputs are sent to our AI providers (Google Gemini, Groq, OpenRouter, Z.AI, NVIDIA) solely to generate your results. We do not use your CV to train models.
• To keep the service safe: scam-filtering job listings, enforcing fair use, preventing abuse.

Where it lives and who can see it

• Data is stored with Supabase (hosted on AWS, Mumbai region) behind per-user access rules — your rows are readable by you alone. CV files live in a private bucket with the same per-user isolation.
• By creating an account you consent to your data being processed outside Bahrain (PDPL art. 12 transfer consent) by the providers named on this page.
• Employers see nothing. If we ever launch employer features, your profile is visible only after your explicit opt-in — discovery will always be your choice, never a default.
• We never sell or rent personal data. Full stop.

Retention and deletion

• Your data is kept while your account exists. Delete your CV in-app at any time; deleting it removes the file and its parsed text.
• Email hello@gethirezulfi.com from your account address to delete your entire account — completed within 7 days.
• Usage logs are aggregated after 12 months.

Your PDPL rights

Under Bahrain’s PDPL you can: access the data we hold about you, correct it, delete it, object to processing, and withdraw consent. Email hello@gethirezulfi.com and we will action it within 7 days. You may also complain to the Bahrain Personal Data Protection Authority.