Privacy Policy

You control whether your CV appears in employer searches. Verified employers receive limited access only for genuine recruitment. We do not sell personal data, and Candidate Premium does not improve ranking or visibility. You can manage consent and submit data-rights requests from Privacy Controls.

Istiqtab is the platform's trading name. Omar Alhamdan, operating Istiqtab under Freelance Work Permit No. FL-116836033 for Talent Acquisition, is the controller under the Saudi Personal Data Protection Law (PDPL). Questions, complaints and privacy-rights requests may be sent to istiqtab.co@gmail.com or 0508108432. If Istiqtab moves to a new legal operating entity, we will update this policy before the change takes effect where required.

Depending on your use, we collect:

• account and verification data, including name, email, password hash, role, consent records and security/session data;
• candidate CV and profile data, such as contact details, work history, education, skills, languages, certifications, salary expectations, work authorization, location and uploaded documents;
• employer data, including representative and company details, verification evidence, job openings, saved candidates and hiring-pipeline activity;
• transaction data from our payment provider, such as invoice status, amount and transaction reference. We do not intentionally store full card details;
• technical, fraud-prevention and usage data, including IP address, device/browser information, timestamps, audit events and profile-view events.

Please do not include national ID copies, passport or Iqama numbers, bank or payment-card details, health data, religion, ethnicity or other sensitive information in a CV unless it is strictly required and lawfully requested. We block high-confidence identity and financial identifiers in profile text and supported extractable CV files, but automated checks cannot identify every sensitive item; the candidate remains responsible for not submitting unnecessary sensitive information.

We collect data directly when you register, complete a CV, upload a document, use a feature, communicate with us, or submit a payment. Required fields are needed to create or secure an account, verify an employer, provide a requested feature, or meet a legal duty. Other profile details, marketing consent, and CV auto-fill are optional unless clearly marked otherwise.

• Contract: create and secure accounts, build CVs, provide restricted employer search, favorites, comparisons, hiring pipelines, paid tools, support and payments.
• Consent: optional marketing and CV auto-fill. You may withdraw consent without affecting earlier lawful processing.
• Legal obligation: accounting, tax, fraud prevention, valid authority requests and regulatory compliance.
• Legitimate interests, after assessment: service security, abuse prevention and aggregated service improvement where these interests do not override individual rights.

A saved CV is eligible for restricted search by verified employers until the candidate deletes it or the account, or a valid processing-restriction request is applied through Privacy Controls. Verified employers must apply at least one hard filter and one educational filter; professional and skills filters are optional. A profile view, CV download, favorite, pipeline action or workspace record requires a short-lived access authorization created by that employer's valid matching search. That authorization expires automatically and is revoked immediately if access is restricted or the employer is blocked. Candidate Premium does not improve search rank, visibility or employer scoring, and employers are not shown a Candidate Premium badge. Istiqtab does not make final hiring decisions. Employers remain responsible for lawful, relevant and non-discriminatory decisions and for independently checking candidate information.

Optional CV auto-fill extracts text from PDF or DOCX files on Istiqtab's server using rule-based software. The file is not sent to an AI model or external parsing provider. We ask for separate consent before processing. Results remain an editable draft, and manual entry is always available. Scanned documents that require OCR are not supported.

We disclose only what is necessary to:

• verified employers whose required filters match a saved CV, unless access has been restricted;
• our current infrastructure providers: Alibaba Cloud for the Riyadh application server, privately hosted PostgreSQL database, and private Riyadh object storage (OSS);
• Google/Gmail for service-email delivery, such as verification, password-reset, security and account messages;
• file-storage, security/CAPTCHA, payment, analytics, support or accounting providers only when we activate them under an approved processing arrangement;
• professional advisers and competent authorities where legally required; and
• a successor in a genuine corporate transaction, subject to confidentiality and applicable law.

Vercel and Neon are not used for current production processing. Any historic records left in those services are restricted to a documented closure, retention or destruction process. We do not sell personal data. Employers may use candidate data only for genuine recruitment and must not scrape, resell or build unrelated databases.

Our current application database and private file storage are hosted in Riyadh, Saudi Arabia. Google/Gmail may process the minimum service-email data needed to deliver messages outside Saudi Arabia. We do not send CVs to an external parser. Before we introduce or continue an overseas transfer that is subject to Saudi PDPL transfer rules, we document the recipient, destination, legal basis, necessity and minimisation; assess the transfer; and use the required adequate-protection decision, exception, or safeguard such as SDAIA Standard Contractual Clauses. A privacy-policy statement alone is not a transfer safeguard.

We keep account and profile data while the account is active and afterwards only as long as needed for the stated purposes, disputes, security and legal duties. When we accept a deletion request, profile visibility stops and the data is deleted or permanently anonymized unless the law requires retention. Transaction and accounting records are kept for the legally required period. Before recurring backups are enabled, they must be encrypted, private, stored in Riyadh, subject to a documented rotation period, and tested for restoration. We do not make candidate uploads or database backups public.

Subject to lawful limits, you may request information about processing, access and a copy, correction, completion or updating, and destruction when no lawful reason to retain the data remains. You may withdraw consent and object or complain where applicable. We verify identity and normally respond within the period required by the PDPL Implementing Regulations. You may complain to the Saudi Data & AI Authority through the National Data Governance Platform if you are not satisfied.

Send requests to istiqtab.co@gmail.com. There is no fee unless the law permits one.

We use proportionate organizational and technical controls such as access restriction, private file delivery, authentication controls, encryption in transit, database-backed access logging and abuse thresholds, secure development and processor oversight. No system is risk-free. We maintain an incident-response procedure, assess incidents and notify SDAIA within the legally required timeframe where the notification threshold is met, and notify affected individuals without undue delay where required.

The platform is for users aged 18 or older. Material policy changes will be presented through the service or by email before they take effect where required. Questions, complaints and rights requests: istiqtab.co@gmail.com. General support: istiqtab.co@gmail.com.