Last updated: 13 October 2026 (draft)
[Company legal name], a [entity type] registered in [jurisdiction] under [licence/CR number], with its registered address at [address] (“HireYalla”, “we”, “us”) is the controller of your personal data. Contact: [privacy@domain]. [Data protection officer / representative, if required: name and contact].
Nationality and visa status are used only to filter roles you are or aren't eligible for. If your CV contains sensitive data (e.g. religion, health, photo), we don't use it for matching; consider removing it.
Matching is automated: we use a machine-learning text model to compare your CV with job descriptions and produce a score and reasons. It doesn't make legal or similarly significant decisions about you. Employers make hiring decisions. You can ask us about the logic involved and contest results.
We do not sell your data and do not share your CV with employers. We use processors under contract: hosting [provider, location], email delivery [provider], payments [Tap Payments / Razorpay] (they receive payment data directly), and error monitoring [provider]. We may disclose data if required by law.
Your data may be processed in [hosting country]. Where UAE PDPL, Saudi PDPL or GDPR restrict cross-border transfers, we rely on [adequacy decisions / standard contractual clauses / your consent / other permitted mechanisms]. [Saudi users: confirm whether data must be stored in-Kingdom or whether a transfer exemption applies.]
Account data: while your account is active. CV files: until you delete them, or 12 months after your last login. Anonymous CV checks: 1 hour. Security logs: [90 days]. Backups are overwritten within [30] days.
Depending on where you live (e.g. GDPR in the EU/UK, UAE Federal Decree-Law No. 45 of 2021 (PDPL), Saudi Personal Data Protection Law and its Implementing Regulations), you may have rights to: access, correct, delete, restrict or object to processing, data portability, withdraw consent, and complain to a supervisory authority (e.g. the UAE Data Office, SDAIA in Saudi Arabia). Delete your CV or account instantly in Settings, or email [privacy@domain]. We respond within [30] days.
Passwords are hashed (PBKDF2), connections use HTTPS, sessions use secure HTTP-only cookies, and access to data is restricted. No system is perfectly secure; we'll notify you and regulators of breaches as required by law.
The Service is not intended for anyone under [18].
We'll post updates here and notify you of material changes.