Privacy Policy

Last updated: 6 November 2026

This policy explains what data Maseerak (maseerak.app) collects, why, who processes it, how long it is kept, and your rights over it. It applies to everyone who uses the platform, with an account or without one (as a guest).

1. Data we collect

• Account data: your email address, name and sign-in details. If you sign in with Google, we receive only your name and email from it. We never see your password; it is stored encrypted by our sign-in provider.
• Guest use: you can start without an account. We create a temporary workspace tied to your browser, deleted when the period shown in the product ends, unless you save it to an account.
• Your CV: the file you upload (PDF, Word or a photo), the text extracted from it, its structured version, your edits, your profile photo if you add one, and the design settings you choose.
• Job Match: the job advert you paste, your answers in the conversation, the facts you confirm about your experience (kept so you can choose to reuse them in later matches), the job-tailored CV versions and cover letters.
• Payments: when you pay through the BAS gateway (Yemeni e-wallets) we store the order number, amount, status and payment method name; we never receive your PIN or card details. When you pay by transfer we store the receipt image, reference and amount. To confirm transfers we read the notification messages that arrive on the wallet we receive payments on, and match them to your request.
• Gift codes and referrals: the codes you redeem, the referral links you create or open, and who completed sign-up through them.
• Surveys: your answers to the start survey and the after-use survey.
• Technical data: pages you open, your device and browser type, the country you connect from, and error and security logs. Your IP address is used briefly to prevent abuse (rate limits and bot checks) and is not stored in visit statistics.
• Messages: what you send us, and the emails we send you (such as payment confirmations and download-ready notices).

2. Why we use it

• To provide the service: reading your CV, suggesting improvements, matching to jobs, writing letters and exporting files.
• To process and verify payments, unlock downloads, and prevent fraud and abuse.
• To send you messages about your account and payments.
• To measure and improve the service, including surveys and aggregated usage statistics.
• To meet legal and accounting obligations.

We do not use your data for advertising, we do not sell it, and we do not train AI models of our own on it.

3. Artificial intelligence

To read, improve, match and write letters, we send the text each task needs — from your CV, the job advert or your answers — to AI models running at NVIDIA. Payment receipt images are read by a model running at Cloudflare. When you add a job, we may search public sources for information about the employer. These providers process the data to carry out the request, under their service terms.

Maseerak is built so the AI does not add facts you did not give: unknown numbers, dates and names appear as blanks ([__]) for you to fill, and a cover letter only says what your CV shows and what you confirmed in the conversation. You remain responsible for reviewing the final text.

4. Who processes your data for us

We share data only with providers that run the service for us, and only as needed:

• Google Cloud: hosting and running the service (Mumbai region, India).
• Cloudflare: network and protection, file storage, reading receipt images, and bot checks (Turnstile).
• Supabase: sign-in and the database.
• NVIDIA: AI models.
• Resend: sending emails.
• BAS: the e-wallet payment gateway.
• Google: Google sign-in, when you choose it.

We may also disclose data when required by a binding legal order, or to protect our rights and our users' safety against fraud.

5. Transfers outside your country

Our providers operate in different countries, so your data is processed and stored outside your country, including in India, the United States and other countries where these providers operate. By using the platform you agree to this transfer.

6. Cookies and browser storage

We use essential cookies only: for signing in, for the guest workspace, and for the interface language. Some preferences (such as your download choices) are kept in your browser. We do not use advertising cookies.

We count visits ourselves, without cookies: we record the page, where the visit came from, the type of device and the country, but never your IP address. The visitor identifier changes every day, so you cannot be followed from one day to the next, and no visit is counted when your browser asks not to be tracked (Do Not Track).

7. Retention and deletion

• We keep your data while your account exists.
• A guest workspace is deleted when its period ends, unless you save it to an account.
• Temporary processing results are kept for at most 24 hours.
• Personal details in payment notification messages are erased after 30 days; a one-way hashed identifier remains so the same notification cannot be used twice.
• When you delete your account, your database records are removed at once, and your stored files (the uploaded CV, receipt images and exported files) are removed by a job that retries until it completes.
• After deletion we keep only what the law requires or what protects someone else's right: financial transaction records, the record of your research consent or its withdrawal, a referral link that was actually used, and minimal usage records with no CV content (such as request counts and durations) to measure cost and reliability.

8. Your rights

You can ask for:

• Access: a copy of your data.
• Correction: correction of inaccurate data (you can also edit your CV yourself at any time).
• Deletion: deletion of your account and data, from your account page or by writing to us.
• Objection: to a specific use, such as taking part in surveys and research.
• Portability: a copy of your data in a machine-readable format.

Write to the address below and we will answer within 30 days. We may ask you to confirm your identity first.

9. Security

Data is encrypted in transit, stored with providers that encrypt it, and accessible only to those who need it to run the service. No system is perfectly secure, so use a strong password that you use only for Maseerak.

10. Children

The service is not intended for anyone under 16. If we learn a child has given us their data, we delete it.

11. Changes to this policy

We may update this policy. We change the "Last updated" date above and tell you about important changes by email or in the platform.