Privacy Policy

This bilingual policy is intended for users in the Kingdom of Saudi Arabia. In case of inconsistency, the Arabic version shall prevail to the extent required by applicable Saudi laws and regulations.

1. Who We Are

Cirah is a CV and ATS-compatibility review service provided by Amad Technology for Development and Investment (“AmadTech”, “we”, “us”, or “our”), Commercial Registration No. 7054532465, Jeddah, Kingdom of Saudi Arabia.

For privacy requests: privacy@cirah.amadtech.sa

2. Scope

This policy explains how we collect, use, store, disclose, transfer, and delete personal data when you use Cirah’s website, application, payment flow, CV review services, subscription services, customer support, or related communications.

3. Personal Data We Collect

We may collect the following categories of personal data:

1. Account and contact data: name, email address, phone number where provided, account identifiers, and communication preferences.
2. CV and career data: CV file, extracted CV text, job title, experience, education, skills, certifications, portfolio links, and job descriptions submitted for analysis.
3. Service usage data: selected package, add-ons, subscription status, timestamps, error logs, device/browser metadata, IP address, and usage analytics.
4. Payment-related data: payment status, transaction reference, amount, payment method type, invoice/receipt details, refund status, and, where you choose bank transfer, transfer confirmation, bank name, transfer reference, account holder name, and IBAN or bank account details required to verify payment or process a refund. We do not store full card numbers, CVV codes, sensitive card authentication data, or online banking passwords.
5. Support data: messages, attachments, and information you provide when contacting us.

4. Purposes and Legal Basis

We process personal data only for specific, clear, and lawful purposes, including:

1. Providing CV analysis, ATS compatibility review, rewriting suggestions, and related outputs.
2. Creating and managing your account, subscription, order approval, payment validation, invoices/receipts, refunds, and customer support requests.
3. Improving service quality, security, error handling, and user experience.
4. Complying with legal, tax, accounting, regulatory, and dispute-resolution obligations.
5. Sending service notices, renewal reminders, important account alerts, and, where permitted, marketing communications that you can opt out of.

Our lawful bases may include your consent, performance of a contract with you, compliance with legal obligations, and legitimate interests that do not override your rights under applicable law.

5. AI Processing

To generate the CV review, we may send the minimum necessary CV text, job description, and analysis instructions to our AI service provider. We require such providers to process the data only for providing the requested service and not to use your submitted CV content to train their public models, unless you have expressly consented.

You should avoid submitting unnecessary sensitive personal data in your CV, such as national ID number, bank details, exact home address, medical information, or other information not required for a job application.

6. Storage, Retention, and Deletion

We store service data primarily in the Kingdom of Saudi Arabia where technically available. CV uploads and extracted CV text are automatically deleted within 48 hours after processing, unless a longer period is required to provide customer support, investigate abuse, resolve a dispute, comply with law, or where you request retention as part of a saved account feature.

Payment, bank-transfer verification, invoice/receipt, subscription, complaint, and transaction records may be retained for the period required by applicable laws and accounting requirements.

You may request deletion of your personal data at any time by contacting privacy@cirah.amadtech.sa. Deletion may be limited where retention is required by law, fraud prevention, dispute resolution, or legitimate business records.

7. Disclosure and Service Providers

We do not sell your personal data. We may disclose limited personal data to trusted service providers only as needed to operate the service, including hosting, cloud infrastructure, AI processing, payment processing through Moyasar or other approved payment processors, banks or financial institutions for bank-transfer verification and refunds, analytics, email delivery, customer support, security, and legal/accounting advisors.

All service providers must process personal data only under our instructions and must apply appropriate confidentiality, security, and data protection safeguards.

8. Transfers Outside Saudi Arabia

Where a service provider or AI provider processes personal data outside the Kingdom of Saudi Arabia, we will take the measures required under the Saudi Personal Data Protection Law and its Implementing Regulations, including limiting the transferred data to the minimum necessary, ensuring appropriate safeguards, and using contractual protections or other approved mechanisms where required.

9. Security

We apply reasonable administrative, technical, and organizational safeguards to protect personal data from unauthorized access, disclosure, alteration, loss, misuse, or unlawful processing. These safeguards may include access controls, encryption in transit where appropriate, secure storage, logging, monitoring, least-privilege access, and periodic review of vendors and internal processes.

No online service can guarantee absolute security. If you believe your account or data has been compromised, contact us immediately at support@cirah.amadtech.sa.

10. Your Rights

Subject to applicable law, you may have the right to:

1. Be informed about how your personal data is processed.
2. Access your personal data.
3. Request correction, completion, or updating of inaccurate personal data.
4. Request deletion or destruction of personal data where legally permitted.
5. Withdraw consent where processing is based on consent, without affecting prior lawful processing.
6. Request a copy of your personal data in a clear and readable format, where applicable.
7. Object to processing or request restriction where applicable under law.

To exercise your rights, contact privacy@cirah.amadtech.sa. We may need to verify your identity before completing your request.

11. Complaints

If you have a privacy concern, please contact us first at privacy@cirah.amadtech.sa and we will review your request. You may also lodge a complaint with the competent authority in the Kingdom of Saudi Arabia, including the Saudi Data & AI Authority (SDAIA), where applicable.

12. Changes to This Policy

We may update this policy from time to time. The updated version will be posted on our website or application with the updated date. If the changes are material, we may notify you by email, in-app notice, or another appropriate method.