Privacy Policy
Last updated: October 2026
Who we are and the scope of this notice
MyWazifa is operated by Sukoon Commercial Photographs Production L.L.C, Dubai, United Arab Emirates ("MyWazifa," "we," "us," or "our").
This notice explains how we process personal data when you use the MyWazifa job-search application and related services. This notice does not govern an employer’s independent use of information they receive from you.
What we collect and why
Information required to create an account
- Email address: Used to create and verify your account and send essential messages. We send a one-time code (OTP) by email, which is stored in our system in a securely hashed format.
- Account and authentication records: Technical records necessary to secure and administer your account.
- Sign in with Google or Apple (optional): If you choose to sign in with Google or Apple, that provider confirms your email address to us. We keep your account identifier at that provider, that email address, and records of when the sign-in was linked and used. We never receive your Google or Apple password, and we do not take your name or photo from Google. If you hide your email with Apple, we receive Apple's relay address instead. If you share your name with Apple, we use it only to fill your profile name when it is empty. For Apple, we also keep an encrypted token so we can withdraw MyWazifa's access when you delete your account, and Apple may tell us if you stop using Sign in with Apple with MyWazifa or change your email forwarding.
- Name and professional details: Used to build your professional profile.
Profile and CV information you choose to provide
You may provide information such as work history, education, skills, certifications, languages, a profile photo, and text for your profile or CV. Please do not include unnecessary sensitive information (such as government IDs, financial data, health details, religious beliefs, or biometric data) unless expressly requested and necessary.
The current operational model allows you to generate and download a CV. MyWazifa does not automatically transmit your CV to employers.
Information generated when you use MyWazifa
- Sharing activity: You may choose to share your profile or a job listing. We process the data necessary to facilitate this share.
- CV generation: You may generate a CV for immediate download.
- Deletion and security activity: We process authentication data to verify account deletion requests.
- Push notifications: If you opt in to push notifications, we process a device token to deliver alerts.
- System logs and diagnostics: Standard server logs and technical diagnostics necessary to maintain service security and integrity.
Data we do not intentionally request
We do not request precise location, telephone number, residential address, government identification numbers, payment information, or advertising-tracking data. There are no advertisements or payment processing in the current service. Standard technical systems may process IP addresses and security logs for operational security.
How and why we use personal data
We process personal data to:
- Create, verify, secure, and administer your account.
- Enable you to build a profile and generate or download a CV.
- Facilitate profile and job-sharing functions.
- Send OTPs, security alerts, and essential service emails (including account closure confirmations).
- Respond to support and privacy requests.
- Prevent abuse, investigate security events, and maintain service integrity.
- Comply with applicable legal obligations.
We do not perform automated candidate-to-employer matching, algorithmic profiling, or smart ranking.
Who receives personal data
- You: You can access and edit your profile.
- Recipients selected by you: When you use the profile-sharing function, the recipient you select receives the shared profile data.
- Employers: If you independently download and send your CV to an employer, that employer's use of your data is outside our direct control.
- Authorized personnel: Strictly limited personnel may access data for support, security, or maintenance under confidentiality obligations.
- Processors: Service providers who process data on our instructions (e.g., email delivery).
- Legal recipients: Where required by applicable law or valid legal process. Any disclosure to a court, regulator, or law-enforcement body is handled under approved legal procedures and, where appropriate, by licensed external counsel.
Third-party service providers and data transfers
| Recipient/System | Location | Purpose | Data Involved |
|---|---|---|---|
| Owner-operated production server (CT119) | Dubai, UAE | Core account, profile, CV, and security processing | Account and profile data, system logs |
| Resend | United States | OTP and account-related email delivery | Email address, email content, delivery metadata |
| OpenAI | United States | AI writing help in the CV builder (summary, bullet wording, translation, CV tips) and reading a CV you upload, only when you press an AI button or upload your CV | The CV text the AI is asked to work on (e.g. job titles, employers, duties, skills, years of experience); never your phone number or email address, except when you upload a photo or scan of your CV: the picture is sent as it is, including any contact details shown in it |
| United States | Optional Sign in with Google | Google account identifier, email address | |
| Apple | United States | Optional Sign in with Apple | Apple account identifier, email address (or Apple relay address), name if you share it |
| Expo, with Google Firebase Cloud Messaging (Android) and Apple Push Notification service (iOS) | United States | Push notifications | Device push token, a short notification sentence and in-app reference numbers (no job, company or CV details) |
| Sentry | European Union (Germany) | Error and crash reports from the app, website and server | What went wrong and where, app or browser version and device type; email addresses, phone numbers, names, CV text and sign-in tokens are removed before sending |
We do not sell or rent personal data. We do not use advertising networks. Some services involve international data transfers (e.g., to the United States for email delivery and AI writing help), which are managed in accordance with applicable data protection laws.
Where data is processed and how it is protected
The production API and database are hosted on an owner-operated server physically located in Dubai, United Arab Emirates.
Email addresses and metadata for OTP and account messages are transmitted to Resend in the United States.
When you use an AI button in the CV builder, the CV text needed for that request is sent to OpenAI in the United States to produce the suggestion. OpenAI's API terms state that this data is not used to train its models by default; OpenAI may keep it for up to 30 days to monitor abuse.
When you upload your CV, we read a PDF or Word file's text on our own server and remove phone numbers, email addresses and links before the remaining text is sent to OpenAI. A photo or scan is sent to OpenAI as an image, so any contact details visible in it are included. We never keep the uploaded file: it is read and discarded within the same request. The details we read from it are kept for up to 24 hours so you can review them, then deleted unless you save them to your CV.
OTP values are stored in a hashed format. In-app account deletion requires a recently authenticated session. We apply reasonable technical and organizational measures to protect data, though no system is absolutely secure.
How long we keep personal data
We retain personal data only as long as needed for the stated purposes, legal obligations, and security requirements. When you complete the in-app deletion flow, our system performs a server-side account wipe. Data already downloaded or lawfully received by another party cannot be deleted by us. Backup retention and expiration are managed according to our internal security and resilience schedules.
If you delete your Apple Account at Apple, and your MyWazifa account uses Apple's private relay address with no other way to sign in, neither you nor we can reach that account any more. In that case we delete your MyWazifa account 30 days after Apple tells us, in the same way as an in-app deletion.
Your privacy choices and rights
Delete your account in the app
You can initiate account deletion via Settings → Delete Account. For security, this requires a session authenticated within the preceding five minutes. The process performs a server-side account wipe and triggers a farewell email.
Requests by email
You may contact [email protected] for privacy requests. Depending on applicable law, you may have rights regarding access, correction, deletion, or portability of your data.
Information that may remain after account deletion
Following account deletion, certain technical records may be retained strictly as required for security, legal compliance, abuse prevention, or system resilience (such as server backups or email delivery logs). We do not retain personal data for marketing or analytics after deletion.
Children and age eligibility
MyWazifa is intended for professional job seekers. We do not knowingly collect personal data from children under the applicable legal age of employment eligibility. If we learn of such collection, we will delete the data.
Changes to this notice
We will update this policy as needed and reflect the "Last updated" date. Material changes will be communicated through the app or via email where appropriate.
Contact
Sukoon Commercial Photographs Production L.L.C
Dubai, United Arab Emirates
Email: [email protected]