Privacy Policy

Version: 0.9Effective date: [PUBLICATION DATE]

1. Who we are

HiringAI is operated by [LEGAL ENTITY NAME], [LEGAL FORM AND TRADE LICENCE NUMBER], with its registered address at [REGISTERED ADDRESS] (“HiringAI”, “we”, “us”, or “our”).

For questions or requests about personal data, contact:

• Email: [PRIVACY EMAIL]
• Postal address: [REGISTERED ADDRESS]
• Data Protection Officer, if appointed: [DPO NAME/CONTACT OR “Not currently appointed”]

[IF APPLICABLE: Our primary data-protection regulator is [UAE DATA OFFICE / DIFC COMMISSIONER / ADGM OFFICE OF DATA PROTECTION].]

2. Scope

This Policy explains how we handle personal data when you visit hiringai.app, submit a CV or job description, ask us to find a job or candidates, communicate with us, or otherwise use our services.

HiringAI is a matching service. Employers independently control their recruitment and employment decisions. When an employer receives your information with your permission, that employer will normally process it under its own privacy policy.

3. Information we collect

Information you provide

• contact information, such as email address and optional phone number;
• account or enquiry type, such as job seeker or employer;
• CVs, resumes, portfolios, cover letters, job descriptions, and other uploaded files;
• experience, education, skills, role preferences, location, seniority, availability, compensation expectations, and work-authorisation information you choose to provide;
• employer, role, hiring criteria, and company information;
• free-text notes, messages, feedback, corrections, consent choices, and support correspondence;
• records of your acceptance of our Terms and privacy choices.

Please do not provide Emirates ID or passport copies, bank information, account passwords, medical or genetic information, criminal-record information, or other information that is not necessary for matching. CVs sometimes contain photos, dates of birth, nationality, marital status, disability or health information, religion, or other sensitive information. Remove those details unless they are genuinely required and lawful to provide.

Information collected automatically

Depending on your choices, we may collect:

• IP address, browser and device type, operating system, language, approximate location, referring page, visited pages, timestamps, and diagnostic/security logs;
• cookie and similar-technology identifiers;
• campaign parameters and whether you use the job-seeker or employer version of the site;
• aggregated interaction information, such as form starts and submissions.

We do not intentionally send CV contents, email addresses, or phone numbers to analytics or advertising platforms.

Information from other sources

We may receive information from an employer, candidate, authorised representative, referral source, or service provider. A person who gives us information about someone else must have authority to do so and must provide any required notice.

4. How we use information

We use personal data to:

1. receive and respond to your request;
2. create and maintain your candidate or employer profile;
3. analyse skills, experience, preferences, role requirements, and potential fit;
4. identify, rank, and explain potential matches;
5. contact you about a requested role, candidate, or service update;
6. with a candidate's specific permission, share an agreed profile with the named employer for the named role;
7. verify employers and roles and prevent fraud, abuse, duplicate submissions, or security threats;
8. operate, secure, troubleshoot, and improve the service;
9. measure site use where you have allowed analytics;
10. send marketing only where you have separately opted in or where otherwise lawfully permitted;
11. comply with law, enforce agreements, and establish or defend legal claims.

We do not sell personal data. We do not share an identifiable candidate profile with an employer merely because the candidate uploaded a CV. We first ask the candidate to approve the specific disclosure, unless disclosure is required by law.

Job seekers are never charged for submitting information, being matched, or being introduced through HiringAI. Our commercial fee is paid by an employer or other authorised business client under separate terms.

5. Permission and lawful processing

We process information based on the permission you give, steps taken at your request to provide matching services, our documented legitimate operational interests where permitted and not overridden by your rights, and legal obligations. The applicable basis depends on the activity and legal regime.

Where we rely on consent, you may withdraw it at any time by contacting [PRIVACY EMAIL] or using the available preference control. Withdrawal does not affect processing that was lawful before withdrawal. If a requested service cannot operate without the relevant information, withdrawal may mean we must stop that service.

Marketing consent is separate from permission to provide matching services.

When you submit your information and give the required service consent, you permit HiringAI to contact you by email or phone about the matching service you requested. This may include clarifying your experience or preferences, discussing a relevant role, asking whether we may share your profile with a named employer, arranging an introduction or interview, and providing a status update. This permission does not cover unrelated advertising. You may withdraw it at any time; withdrawal may mean we can no longer provide matching services.

6. AI-assisted matching and human review

HiringAI may use automated tools, including artificial intelligence, to extract job-related information, compare candidate and role requirements, generate a potential-fit score or ranking, and draft a plain-language explanation.

AI output can be incomplete, inaccurate, or biased. It is decision support, not a final employment decision. We require meaningful human review before an identifiable candidate shortlist is shared. Employers remain responsible for their own lawful assessment and decisions.

We do not intentionally use a candidate's photograph, age, sex, religion, marital status, disability, or similar sensitive/protected characteristic to rank general role fit. Where a lawful UAE nationalisation requirement applies, we handle it as an explicit verified requirement and not by inference.

You may ask us to explain a match, correct the information used, object to relevant automated processing, or request human review by emailing [PRIVACY EMAIL].

We do not permit an AI provider to train general models on your CV or job description unless we clearly tell you and obtain any required separate permission.

7. When we disclose information

We may disclose personal data to:

• employers, only after the candidate approves the specific employer, role, and information to be shared, or where law requires disclosure;
• candidates, when necessary to communicate a genuine role without disclosing employer-confidential information prematurely;
• service providers, such as cloud hosting, security, document processing, communications, analytics, customer support, and AI vendors, under written instructions and confidentiality/data-protection terms;
• professional advisers and authorities, where reasonably necessary for legal advice, compliance, safety, fraud prevention, claims, or a lawful request;
• a successor organisation, in a merger, financing, restructuring, or sale, subject to appropriate confidentiality and notice.

Current categories of key providers include:

8. International transfers

Some providers or support personnel may process personal data outside the UAE. Before such transfers, we assess the destination and use an approved legal mechanism or contractual and organisational safeguards required by the applicable UAE, DIFC, or ADGM regime. Contact [PRIVACY EMAIL] for information about the relevant safeguard.

9. Retention

We keep personal data only as long as needed for the stated purpose, legal obligations, security, dispute handling, and enforcement.

Our default launch periods are:

• unmatched candidate profiles and CVs: up to 12 months after last meaningful activity, unless renewed;
• employer enquiries and uncontracted job descriptions: up to 6 months;
• information shared for a specific hiring process: until the role closes plus up to 90 days, unless another documented basis applies;
• analytics identifiers: the shortest practical setting, targeted at 2 months;
• security logs: generally up to 12 months;
• consent and contract evidence: for the relationship and applicable legal-claims period.

We may retain a minimal suppression record to respect a marketing opt-out. A legal hold may temporarily override deletion. Deleted information may remain in restricted backups until the normal backup cycle expires.

10. Security

We use technical and organisational measures designed for the sensitivity of recruitment data, including encryption in transit, restricted access, access logging, role-based permissions, secure cloud storage, malware controls, monitoring, backups, and staff confidentiality requirements.

No system is completely secure. If a personal-data breach creates a risk requiring notice, we will notify the competent regulator and affected individuals as required by applicable law.

11. Your rights

Subject to applicable law and exceptions, you may request:

• information about processing and a copy of your personal data;
• correction or completion of inaccurate data;
• deletion;
• restriction or stopping of certain processing;
• withdrawal of consent;
• transfer/portability where applicable and technically feasible;
• objection to direct marketing;
• objection to relevant automated decisions and human review;
• information about relevant safeguards for international transfers.

Email [PRIVACY EMAIL] with the subject “Privacy request”. We may verify your identity and clarify the request. We will not ask for more identity information than reasonably necessary. An authorised representative must show authority to act.

You may also complain to [APPLICABLE REGULATOR AND CONTACT/LINK]. We encourage you to contact us first so we can try to resolve the issue.

12. Cookies and analytics

Essential technologies are used for security and site operation. Non-essential analytics or advertising technologies are used only according to your choices and applicable law. See our Cookie Notice for categories, providers, durations, and controls.

You can change non-essential choices at any time through Cookie Settings. Browser controls may also remove stored cookies, but they do not replace our consent controls.

13. Marketing and communications

Service communications concern a request you made, such as clarifying your details, discussing a potential match, requesting permission to share a profile, arranging an introduction, providing a status update, or addressing a security issue. Depending on the contact information and permission you provide, we may make these communications by email or phone. Marketing promotes HiringAI or third-party services more generally. We keep them separate.

You can unsubscribe from marketing using the message link or by contacting [PRIVACY EMAIL]. We will honour the request across relevant channels and may retain a minimal suppression entry.

14. Children

The service is intended for people aged 18 or older. We do not knowingly collect children's personal data. Contact [PRIVACY EMAIL] if you believe a child has submitted information.

15. Third-party sites

Links to third-party sites are provided for convenience. Their processing is governed by their own privacy notices, not this Policy.

16. Changes

We may update this Policy. We will post the new version and effective date and, where a change materially affects your rights or processing, provide an additional notice or obtain renewed permission where required.

17. Contact

[LEGAL ENTITY NAME]<br> [REGISTERED ADDRESS]<br> [PRIVACY EMAIL]<br> [PHONE, IF USED]