DRAFT — pending review by legal counsel (UAE PDPL, Saudi PDPL, GDPR/UK GDPR). Not yet in force.

Privacy Policy

Version 2026-09-05. HazirCV ("we") is an AI CV maker for job seekers in the Gulf and remote roles. This policy explains what personal data we process, why, where it is kept, who helps us process it, and how you exercise your rights.

1. Who is responsible

[Company legal name], [registered address]. Data protection contact: support@hazircv.app.

2. What we collect and why

Data	Purpose	Lawful basis
Your CV: uploaded file, photo, pasted or typed text; the parsed fields (name, contact details, work history, education, skills)	Parsing, ATS scoring, rewriting (paid), exporting	Performance of our contract with you
Optional Gulf-profile details you enter deliberately: nationality, date of birth, marital status, visa/residency status, notice period, expected salary, driving licence	Included only in the Gulf export profile, only when you choose to add them	Consent (withdraw by clearing the fields)
Optional profile photo (Gulf export profile only, off by default)	Printed on the Gulf-profile CV when you switch it on; stored in Cloud Storage; never sent to any AI or text-recognition provider	Consent (withdraw by removing the photo)
Job descriptions you paste	Keyword matching, tailored scoring, cover letters (paid)	Performance of contract
Account identifiers (Firebase user id, sign-in email if you sign in), device installation id, App Check attestation	Your account, fair-use limits, abuse prevention	Contract; legitimate interest (security)
Purchase state from the app store via RevenueCat (product, tier, expiry — never card details)	Unlocking what you bought	Contract
Product analytics events (screen steps, scores, feature use — never CV text or contact details)	Improving the product	Legitimate interest; you can disable analytics in Settings
Referral code and redemptions	Granting bonus packs	Contract

We never sell personal data and we never use your CV to train AI models.

3. Where your data lives

Your parsed CV, scores and account state are stored in Google Cloud Firestore in Dammam, Saudi Arabia (me-central2). Uploaded originals and rendered exports are stored in Google Cloud Storage in Doha, Qatar (me-central1), and our servers run in Doha. Under the Saudi Personal Data Protection Law a transfer out of the Kingdom is regulated; the processing in Doha and the sub-processors below are such transfers, made with your consent and the safeguards described here.

4. Who helps us process it (sub-processors)

Provider	Purpose	Location
Google Cloud / Firebase (Firestore, Cloud Storage, Cloud Run, Authentication, App Check, Analytics)	Hosting, storage, sign-in, abuse prevention, analytics	Dammam and Doha; analytics processed globally
Google Cloud Vision	Text recognition for photographed CVs (OCR)	May process outside the Middle East
OpenRouter	Routes AI requests for paid features to OpenAI under our own OpenAI key. Prompt logging is off and training opt-outs are set.	United States
OpenAI (the model provider behind OpenRouter, or directly in a fallback)	Generates rewritten text for paid features. Before any request your name, phone, email, address and links are replaced by placeholders such as [NAME]; the provider never receives them. OpenAI does not use API data for training and retains it for up to 30 days for abuse monitoring.	United States
RevenueCat	Purchase and subscription state	United States
Apple App Store / Google Play	Payments and distribution	Per store

The free tier never sends anything to an AI provider.

5. How long we keep it

Uploaded originals	90 days, or until you delete the CV
Extracted text and parsed fields	For the life of the CV record
AI generation records (metadata and output)	180 days
Free-tier CVs	Deleted after 60 days of inactivity
CVs on a paid plan	Kept while you use them; deleted after 365 days of inactivity
Application packs	180 days
Profile photo	Until you replace or remove it, or delete your account
Account deletion	Everything is purged immediately when you delete your account, and in all cases within 30 days; each deletion is logged

6. Your rights

Access: Settings → Download my data gives you a complete export as a file.
Correction: every parsed field can be edited in the app.
Deletion: Settings → Delete account removes everything immediately; individual CVs can be deleted at any time.
Objection / withdrawal: clear optional fields, disable analytics, or delete your account. The free tier involves no AI processing.
Complaints: you may contact your local data protection authority (for example the UAE Data Office, SDAIA in Saudi Arabia, or the ICO in the UK).

7. Children

HazirCV is for people aged 16 and over. We do not knowingly process data of anyone younger.

8. Changes

When this policy changes materially, the app asks you to accept the new version (the version date at the top changes).