Privacy Policy

1. About HireGPS and the Scope of This Policy

HireGPS is a pre-launch business-to-consumer (B2C) career intelligence platform. Our Services help users evaluate how their CV or résumé may be interpreted from a professional recruiter's screening perspective before submitting job applications. The Services are available on our website at hiregps.app. iOS and Android apps are planned and are not available yet; this Policy will be updated before they launch.

This Policy applies to all personal information we collect through our website and any related products or services. It governs your use of the Services regardless of how you access them.

This Policy has been prepared with reference to the following legal frameworks:

• EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679)
• UK GDPR and Data Protection Act 2018
• California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) amendments
• California Online Privacy Protection Act (CalOPPA)
• Children's Online Privacy Protection Act (COPPA), United States
• Turkish Personal Data Protection Law (KVKK, Law No. 6698)
• UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (PDPL)

Important: HireGPS does not represent any employer, staffing agency, or hiring organization. The Services are intended as informational career guidance only and do not make employment decisions, guarantee interviews, or determine candidate eligibility for any role.

2. Data Controller Identity

The data controller for personal information processed under this Policy is Sustera People and Purpose Consultancy - F.Z.C, registered in the Ajman Free Zone, United Arab Emirates, as a free zone company with limited liability, under license number 41519("HireGPS").

You can contact us about any privacy matter through the following channels:

• Email: [email protected]
• Mail: C1 Building, Ajman Free Zone, Ajman, United Arab Emirates
• Phone: +971 58 560 6229

We are appointing representatives in the European Union and in the United Kingdom under Article 27 of the GDPR and of the UK GDPR. Their details will be listed here once they are appointed. Until then, contact us at the email address above.

3. Information We Collect

We collect information you provide directly, information generated through your use of our Services, and limited information received from third parties. The categories below describe this in full.

3.1 Information You Provide Directly

A. Account Information

• Full name
• Email address
• Password (stored as a one-way cryptographic hash; never stored in plaintext or reversible form)
• OAuth authentication identifiers (if Apple Sign-In or Google Sign-In is used)

B. CV and Career Content

• Employment history (employer name, job title, dates of employment, location, responsibilities, achievements)
• Education history (institution name, qualification type and level, field of study, graduation year, country)
• Certifications and professional qualifications
• Language skills and assessed proficiency levels
• Technical tools, systems, and skills
• User-supplied explanations for employment gaps
• Whether you would relocate for a role, if you choose to answer
• Whether you can legally work in a role's country, if you choose to answer

C. Target Role Information

• Target position title and seniority level
• Target industry and job function
• Target location and country
• Company name and estimated company size (optional)
• Key requirements extracted from a job posting (optional free-text input)

D. User Preferences and Settings

• Analytics participation preference (opt-in; off by default)
• Notification preferences

3.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Device type, operating system version, and application version
• Application session duration and in-app feature engagement events
• Crash reports and error diagnostic logs
• Approximate geographic location derived from IP address (country level only)
• API response times and analysis processing metrics

Note on 'GPS' in Our Name: HireGPS does not collect precise GPS location data, real-time location signals, or device location coordinates. The term 'GPS' in our brand name is used metaphorically to describe career navigation guidance and does not refer to geolocation technology.

3.3 Information from Third Parties

• Subscription status and billing event notifications from Stripe, our payment processor for purchases made on the web
• Authentication session tokens from Apple Sign-In or Google Sign-In (where used)

Version 1.0 does not include LinkedIn import, job-board integration, or social media profile linking. We do not purchase or receive personal information from data brokers.

3.4 Information We Do Not Collect

• Keystroke-level monitoring data
• Precise GPS coordinates or real-time location
• Payment card numbers, bank account details, or full financial credentials
• Biometric identifiers
• Government-issued ID numbers

3.5 Sensitive Information in Your CV

A CV can contain information that data protection laws treat as sensitive, such as health, religion, ethnic origin, or a photo. HireGPS does not need it and does not use it for scoring (see Section 4.5). We recommend removing it before you upload. Before you add your first CV, we ask for your explicit consent to process any such information your CV contains (Article 9(2)(a) GDPR), and we record when you gave it and to which wording. We process it only as part of the CV you asked us to analyze. You can withdraw your consent at any time by deleting the CV, and the information is deleted with it.

4. How We Use Your Information

4.1 Providing and Operating the Services

• Parsing, structuring, and storing your CV content to enable analysis
• Constructing recruiter persona models across 10 regions, 21 industries, 20 job functions, and 7 seniority levels
• Running deterministic scoring across eight assessment categories to generate a 0–100 shortlist score
• Producing a Shortlist, Hold, or Reject classification and risk inventory
• Generating recruiter-oriented explanations and ranked improvement recommendations
• Delivering CV rewrite suggestions and interview preparation content to Premium subscribers
• Managing your account, subscription entitlements, and billing status

4.2 Improving the Services

• Diagnosing and resolving technical issues through crash reports and error logs
• Monitoring platform performance, availability, and latency
• Measuring how the website is used, with Google Analytics, where you have turned analytics on (see Section 13)

4.3 Communications

• Sending transactional messages (account verification, subscription confirmations, security alerts)
• Providing customer support responses
• Sending service-related notices and Policy updates

4.4 Legal Compliance and Security

• Detecting, investigating, and preventing fraudulent accounts and abuse
• Complying with applicable legal obligations and responding to lawful requests
• Enforcing our Terms of Service and protecting our rights

4.5 Purposes for Which We Will Never Use Your Information

The following restrictions are absolute and may not be overridden by internal policy change or commercial arrangement.

• Selling, licensing, or renting your personal information to any third party
• Using your CV content to train, fine-tune, or improve any AI or machine-learning model
• Sharing your profile with employers, recruiters, staffing agencies, or hiring platforms without your explicit consent
• Commercial behavioral advertising or third-party ad targeting
• Using any protected characteristic, including race, ethnicity, national origin, gender, age, religion, disability, pregnancy, family status, or sexual orientation, as a scoring signal, input variable, or output factor

5. Legal Bases for Processing (GDPR / UK GDPR)

For users in the European Economic Area and the United Kingdom, we process personal information on the following legal bases:

Performance of a Contract (Article 6(1)(b) GDPR)

We process information necessary to provide the Services you have requested, including:

• Account creation and authentication
• CV parsing, storage, and analysis processing
• Score generation, risk identification, and explanation delivery
• CV rewrite and interview preparation services (Premium)
• Subscription management and premium access enforcement

Legitimate Interests (Article 6(1)(f) GDPR)

We process information for our legitimate interests, where those interests are not overridden by your rights:

• Fraud detection and abuse prevention
• Platform security monitoring and incident response
• Ensuring consistency and accuracy of analysis outputs
• Application stability and performance monitoring

Consent (Article 6(1)(a) GDPR)

We rely on your consent for:

• Usage analytics (where you have opted in, via the cookie banner or the analytics toggle in Account settings)
• Marketing communications (obtained separately at the point of collection)
• Sensitive information you choose to keep in your CV: explicit consent under Article 9(2)(a) GDPR, asked for before you add your first CV (see Section 3.5)

You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

Legal Obligation (Article 6(1)(c) GDPR)

We process information to comply with legal obligations, including:

• Tax and financial record retention requirements
• Responding to binding requests from competent authorities

5.1 Automated Decision-Making Disclosure

HireGPS applies deterministic, rules-based logic to produce your shortlist score and classification. While AI language models are used for limited parsing and explanation-generation tasks, the core scoring arithmetic, risk-trigger evaluation, and classification decision are produced by deterministic rule functions, not by opaque AI inference.

Under GDPR Article 22, you have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The HireGPS score and classification are provided for informational and self-improvement purposes only. They do not constitute employment decisions, are not shared with employers, and have no binding legal or contractual effect. No employment eligibility determination is made by our platform.

You may request a review of any analysis output, correct input data via the Parsing Review screen, and delete your analysis records at any time.

6. AI and Automated Processing Disclosures

6.1 How AI Is Used

HireGPS uses third-party AI model providers for specific, bounded language-processing functions. AI is used only for:

• CV parsing and extraction of structured fields from uploaded documents
• Quality classification of achievement language (e.g., strong, adequate, weak, or unanchored)
• Grammar and vague-language detection
• Natural language rendering of recruiter-risk explanations from structured templates
• CV rewrite suggestions within the faithfulness constraints described below

6.2 How AI Is Not Used

• AI does not determine the scoring weights, scoring thresholds, or classification thresholds
• AI does not trigger or suppress recruiter-risk flags
• AI does not make or influence employment eligibility decisions
• AI does not generate facts, credentials, or employment claims that are not present in your source content

6.3 Rewrite Faithfulness Commitment

Our CV rewrite functionality operates under a strict faithfulness principle. The system is designed and instructed not to introduce:

• Metrics, figures, or quantitative claims not present in your source CV or confirmed by you
• Responsibilities, outcomes, or achievements not stated or user-confirmed
• Certifications, qualifications, or credentials not stated
• Dates, durations, or timeframes not stated or inferrable with certainty
• Projects, promotions, title changes, or scope claims not present in source content

You remain solely responsible for reviewing and approving all rewritten content before any external use, including job applications.

6.4 AI Vendors and Training Restrictions

We use one AI provider. It processes your content only to provide the Services to you and may not use it to train its models:

• Anthropic, PBC(Claude API): reading your CV and any job posting you paste into structured fields, analysis explanations, CV rewrites, interview preparation and career guidance. Anthropic's Commercial Terms prohibit training on our content, and its Data Processing Addendum, which includes the EU Standard Contractual Clauses and the UK Addendum, applies: https://www.anthropic.com/legal/data-processing-addendum

Our subprocessors are listed at www.hiregps.app/subprocessors. Material changes to AI processing arrangements will be communicated in accordance with Section 14 of this Policy.

7. How We Share Your Information

7.1 Service Providers (Data Processors)

We share personal information with trusted third-party service providers who process it on our behalf, solely for the purposes described in this Policy and under binding data processing agreements:

• Amazon Web Services (servers and CV file storage), MongoDB Atlas (analysis data) and Supabase (sign-in and account data)
• Anthropic (AI processing as described in Section 6.4, with no training use)
• Stripe, Inc. (payment processing, subscription billing, and the customer billing portal for purchases made on the web)
• Google LLC (Google Analytics via Google Tag Manager; website usage measurement, loaded only after you turn analytics on and stopped when you turn it off)
• Pydantic (Logfire: logging and error monitoring)
• Purelymail (the [email protected] mailbox)
• Resend (email sent through our contact form)
• Cloudflare (content delivery, DNS and security)

The full list, with where each provider keeps data, is at www.hiregps.app/subprocessors.

7.2 Legal Disclosure

We may disclose your information where required by law, including in response to:

• Court orders, subpoenas, or other binding legal process
• Requests from competent regulatory or law enforcement authorities
• Situations involving an imminent risk to the safety of any person
• Protection or enforcement of our legal rights

7.3 Business Transfers

If HireGPS is involved in a merger, acquisition, asset sale, or similar corporate transaction, your personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

7.4 What We Do Not Share

We do not share your personal information with:

• Employers, recruitment firms, staffing agencies, or corporate hiring teams
• Advertising networks, data brokers, or third-party marketers
• Job boards, applicant tracking system providers, or employment databases
• Any party that would use your data to evaluate you as a job candidate without your explicit consent

8. International Data Transfers

HireGPS is based in the United Arab Emirates. When you use the Services, you give your information to us directly, and we apply the GDPR and the UK GDPR to it wherever they apply to you.

Your CV files are stored, and our servers run, in the European Union (Frankfurt, Germany) with Amazon Web Services. Your analysis data is stored with MongoDB Atlas in Frankfurt, Germany, and your sign-in and account data with Supabase in Frankfurt, Germany. The location of every provider is listed at www.hiregps.app/subprocessors.

Some providers process data in the United States: Anthropic (AI processing), Pydantic (Logfire: error and performance logs), Stripe (payments), Google (analytics, only if you turn it on), Cloudflare (content delivery) and Purelymail (support email). Our team accesses data from the United Arab Emirates. Where a recipient is not covered by an adequacy decision (for the United States, the EU-U.S. Data Privacy Framework and its UK Extension cover only certified companies; the United Arab Emirates has none), transfers from the EU/EEA and the UK rely on the European Commission's Standard Contractual Clauses and the UK Addendum in the provider's data processing terms. You can ask for a copy of these safeguards at [email protected].

For users in Turkey, data transfers are conducted in accordance with Article 9 of the KVKK and relevant guidance from the Personal Data Protection Authority (KVKK Authority). A list of countries to which data is transferred will be made available upon request.

9. Data Retention

We retain your personal information only for as long as necessary for the purposes described in this Policy, or as required by applicable law. Our current retention standards are as follows:

Account and Profile Data

Kept while your account exists. When you delete your account, it is deleted at once, together with your CVs and analyses, except the records described under Subscription and Transaction Records.

CV Files and CV Text

Kept until you delete the CV, all your CV files, or your account. Deletion takes effect at once and removes the file and the CV text stored with your analyses. Deleted CV files are not kept in any backup. Copies of CV text can remain in the automatic daily backups kept by our database provider for up to 8 days, after which those backups are overwritten.

Analysis Records

Kept while your account exists. If you delete a CV, its analyses keep their scores and results but no longer hold the CV text. Analyses that did not complete are deleted automatically after 90 days.

Session and Activity Logs

Kept for up to 90 days, then deleted.

Google Analytics Data

Collected only if you turn analytics on, and kept for the period set in our Google Analytics account, which is no longer than 14 months.

Subscription and Transaction Records

Retained for up to seven years as required by applicable tax and financial record-keeping obligations.

Anonymized and Aggregated Analytics

Retained indefinitely in non-personally-identifiable aggregated form.

10. Data Security

We implement reasonable technical and organizational measures designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction.

10.1 Technical Safeguards

• Encryption in transit (TLS 1.2 or higher) for every connection to the Services
• Encryption at rest by our storage and database providers
• Passwords handled by our sign-in provider and stored only as one-way cryptographic hashes
• CV files kept in private storage and shared only through short-lived signed links
• Access to production systems limited to the people who run the Services

10.2 Organizational Safeguards

• Access to personal data limited to personnel who require it to perform their role
• Data processing agreements in place with all subprocessors
• Internal authorization controls and access review procedures
• Defined incident response and breach notification procedures

No method of transmission over the internet, and no method of electronic storage, is completely secure. While we use commercially reasonable means to protect your information, we cannot guarantee absolute security.

11. Your Privacy Rights

11.1 Rights Available to All Users

• Right to Access: Request a copy of the personal information we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Deletion:Delete a CV, all your CV files, or your account and all associated data, in Settings > Privacy & Data
• Right to Data Portability:Export your data in a structured, machine-readable format with Export my data, in Settings > Privacy & Data
• Right to Withdraw Consent: Withdraw consent for consent-based processing at any time, for example with the Google Analytics switch in Settings

11.2 EU / EEA and UK Users (GDPR / UK GDPR)

• Right to Object: Object to processing based on legitimate interests
• Right to Restriction: Request restriction of processing in certain circumstances
• Right to Object to Direct Marketing: Object at any time to the use of your information for direct marketing
• Right Not to be Subject to Automated Decision-Making: As described in Section 5.1, our Services do not make legally significant automated decisions
• Right to Lodge a Complaint: Contact your local supervisory authority (e.g., ICO in the UK, your national DPA in the EU)

11.3 California Residents (CCPA / CPRA)

• Right to Know: Know what personal information we collect, use, disclose, and share
• Right to Delete: Request deletion of your personal information
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: Request that we limit use of sensitive personal information to disclosed purposes
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights

HireGPS does not sell personal information. We do not share personal information for cross-context behavioral advertising as defined under CPRA. Accordingly, no 'Do Not Sell or Share' opt-out mechanism is required under current operations; however, all CCPA/CPRA deletion and access rights are fully supported.

11.4 Turkish Users (KVKK)

• All rights under Article 11 of KVKK No. 6698 apply in full
• Right to apply to the Personal Data Protection Authority (KVKK Kurumu) to lodge a complaint

11.5 UAE Users (PDPL)

Where the UAE Personal Data Protection Law applies to you, you have the rights it gives, including to access, correct and erase your personal data, to restrict or stop its processing, to receive it in a portable form, and to object to decisions based solely on automated processing. You can complain to the UAE Data Office.

11.6 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at [email protected]or use the tools in Settings > Privacy & Data. We will respond to verified requests within 30 days (or the shorter period required by applicable law). We may need to verify your identity before processing your request.

12. Children and Minors

HireGPS is an individual career development platform. You must be 16 or older to use the Services. We do not verify age at sign-up; if we learn that someone under 16 is using the Services, we delete their account and information promptly.

12.1 COPPA Compliance (United States)

We do not knowingly collect personal information from children under the age of 13 in the United States without verifiable parental consent as required by the Children's Online Privacy Protection Act (COPPA). If we become aware that we have collected personal information from a child under 13 without verifiable parental consent, we will take reasonable steps to delete that information promptly.

12.2 Parental Contact

Parents or legal guardians who believe their child under 13 has provided personal information to us without consent may contact us at [email protected] to request review, correction, or deletion.

13. Cookies and Tracking Technologies

Our website uses strictly necessary cookies, for session management and security token handling, without which the Services cannot function correctly. If you turn analytics on, Google Analytics also sets its own cookies (_ga and_ga_<container>) to recognize your browser between visits. They are not set until you turn analytics on, and turning it off again deletes them.

Google Analytics records activity per browser rather than only in aggregate: it assigns a client identifier, and while you are signed in we also send your account's internal identifier so that visits from your devices line up. We never send your name, your email address, your CV, or anything from your analyses.

We do not deploy social media tracking pixels, third-party retargeting cookies, or behavioral advertising trackers on our website or application. Google Signals and advertising personalization are switched off in our Google Analytics configuration, so your activity is not added to Google's advertising audiences.

Do Not Track. Our website does not respond to Do Not Track signals. Analytics stays off unless you turn it on, so no signal is needed to keep it off.

14. Changes to This Policy

We may update this Policy periodically. When we make changes, we will notify you through:

• A notice in the Services
• An email to your registered address
• An updated version date at the top of this Policy

For material changes, we will provide at least 30 days' prior notice. Your continued use of the Services after the effective date of a revised Policy constitutes your acceptance of that revision, to the extent permitted by applicable law.

15. Contact Information

For any questions, requests, or concerns relating to this Policy or the processing of your personal information:

• Email: [email protected]
• Mail: Sustera People and Purpose Consultancy - F.Z.C, C1 Building, Ajman Free Zone, Ajman, United Arab Emirates
• Phone: +971 58 560 6229