Privacy Policy

Who We Are

Toud Al-Itqan for Artificial Intelligence, Commercial Registration 7043284046, Saudi Arabia.

Contact us: support page

What We Collect

• CV content – the full text extracted from your uploaded CV, including your name, contact details, work history, education, and skills.
• Account information – your name and email address, collected through Google sign-in or email registration.
• Target job details – optional job title and description you provide to tailor the improvement.
• Usage data – pages visited, device type, browser, and interaction patterns collected through analytics.
• Payment information – processed entirely by our payment provider. We receive transaction references and payment status only. We never see or store your card details.

How We Process Your CV

When you upload your CV, we send the full text to a third-party processing provider. The entire content is processed, including your contact details and work history, because accurate results require the complete document.

Processing happens on servers in the United States (processing provider) and Germany (our hosting). The processing provider handles your data solely to fulfill your request and does not use it for model training.

Third-Party Services

We work with the following service providers:

• CV processing provider (United States) – processes your CV text to generate the improved output.
• Payment processor (United Kingdom) – handles all payment transactions as Merchant of Record.
• Authentication provider (United States) – manages Google sign-in.
• Analytics providers (United States) – collect anonymized usage data and session recordings to help us improve the experience.
• CDN and security provider (United States) – delivers content and protects against attacks.
• Email delivery provider (United States) – sends transactional emails like receipts.
• Error monitoring service (European Union) – tracks technical issues to keep the service running smoothly.
• Hosting provider (Germany) – stores your data on secure servers.

International Transfers

Your data is processed in the United States (CV processing, analytics, email delivery) and the European Union (hosting in Germany, error monitoring). We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers. For GDPR users, these transfers are necessary to provide the service. For PDPL users, we disclose this in accordance with Article 29.

How Long We Keep Your Data

• CV data and profile – retained until you delete your account, so you can return to download your results, view your profile, or reprocess later.
• Account data – kept until you delete your account from Dashboard → Account.
• Payment records – transaction references and amounts are retained as required by Saudi financial regulations. These records contain no CV content.

You can request deletion of your data at any time from your Dashboard, or through our support page. Once you delete your account, your CV content and profile are removed from our active systems.

Your Rights

Saudi Arabia (PDPL)

You can access, correct, and delete your personal data. You can request a copy of your data in a structured format. You can restrict or object to processing in certain circumstances.

Europe and UK (GDPR)

We process your CV because it is necessary to provide the service you purchased. Analytics cookies require your consent.

You can access, correct, delete, restrict, or export your data. You can also lodge a complaint with your local data protection authority.

California (CCPA)

You can know what personal information we collect, request its deletion, and opt out of any sale. We do not sell personal information.

To exercise any of these rights, visit our support page. We respond within 30 days.

Cookies

We use essential cookies for authentication and session management. Analytics cookies are used with your consent (required for EEA/UK users). Disabling analytics cookies does not affect the core service.

Security

All data is transmitted over HTTPS. Server-side storage is password-protected and encrypted. A web application firewall protects against common attacks. Payment data is handled entirely by our payment provider and never touches our servers.

Children

Sira is designed for users aged 16 and older. If you believe a child has provided us with personal data, visit our support page and we will delete it promptly.

Changes

We may update this policy from time to time. Changes are posted on this page with an updated date. Continued use of the service means you accept the revised policy.

Contact

For privacy questions or data requests, visit our support page

Toud Al-Itqan for Artificial Intelligence, Saudi Arabia