PRIVACY POLICY
1. About this Policy and CVin
This Privacy Policy explains how CVin collects, uses, stores, shares, transfers and destroys personal data when an individual uses the CVin website, account and digital career services. CVin provides AI-supported tools for CV creation and improvement, professional-profile guidance, job matching and analysis, interview preparation and career support. The data controller responsible for CVin is Quwa alihtirafiyya Company For Information Technology, Unified National Number 7038348160. Its national address is Building No. 7812, Wadi Malha Street, Al Nada District, Riyadh, Kingdom of Saudi Arabia.
2. Scope and eligibility
This Policy applies to individual users of the CVin website, account and digital services. The Service is intended for persons aged 18 years or older and is not directed to children. This Policy does not govern an external website, employer or service reached through a third-party link; the privacy terms of that third party apply to its independent processing.
3. Personal data we may collect
Depending on the features used, CVin may collect: (a) account and contact data, such as name, email, mobile number where requested, preferred language and sign-in credentials; (b) career-profile data, such as education, major, experience level, target role, industry and job preferences; (c) CV and uploaded-content data, such as contact details, summaries, education, experience, certificates, skills, languages, photographs selected by the user and file metadata; (d) AI interaction data, such as prompts, selected CV sections, job descriptions, model inputs and outputs, compatibility results and limited safety or usage metadata; (e) subscription and transaction data, such as plan, amount, payment status, invoice data and payment-provider reference; (f) support and communication data; (g) consent, policy-version and privacy-request records; and (h) device, security, log, cookie and service-usage data, such as IP address, browser type, timestamps, features used and error events. CVin does not require national identification numbers, health or criminal data, complete payment-card details or banking credentials for its ordinary services, and users should not provide them.
4. How we collect personal data
CVin collects data directly when the user registers, completes onboarding, creates or uploads a CV, enters a prompt or job description, purchases a plan, contacts support, changes preferences or submits a privacy request. CVin also collects limited data automatically through necessary cookies, security logs and service telemetry. CVin may receive authentication data from a sign-in provider, transaction status from a payment provider, and job or public professional information where the source and collection method are lawful and the feature is presented to the user.
5. Why we process personal data
CVin processes personal data to create and secure accounts; provide, personalise and improve requested career features; create, store and export CVs; parse uploaded documents; generate and analyse AI-supported content; match a CV or profile with job information; provide interview and career guidance; administer subscriptions, payments, receipts, cancellations and refunds; send essential account, transaction and security notices; respond to support and privacy requests; prevent fraud, misuse and security incidents; maintain service reliability and backups; comply with binding legal, tax or regulatory requirements; establish or defend legal claims; and send marketing where the user has made the required choice. CVin uses aggregated or anonymised information for product improvement where reasonably possible.
6. Legal grounds for processing
The main legal ground for account, CV, AI, job-analysis and paid-service processing is performance of the digital-service agreement with the user or steps requested before entering it. CVin may rely on legitimate interests for proportionate account security, fraud prevention, network protection, service reliability and limited product measurement only after documenting that the purpose is lawful, the processing is necessary and the user's rights are not overridden; this ground is not used for sensitive data. Consent is used for optional direct marketing, non-essential cookies and another distinct purpose that requires it. Consent is specific, documented, separate from acceptance of the Terms and withdrawable. CVin may also process data to comply with a legal obligation or binding request and to establish, exercise or defend legal claims. A new incompatible purpose requires a new lawful assessment and, where required, a new notice and consent.
7. Mandatory and optional information
Registration fields identified as required are necessary to create and secure the account. Data marked optional is used only to enable or improve the related feature and may be omitted without preventing account creation. If the user does not provide information necessary for a requested feature, CVin may be unable to complete that feature—for example, an uploaded CV or selected CV text is needed for an AI CV analysis. Refusing marketing or non-essential cookies does not prevent use of core services.
8. Artificial intelligence and automated analysis
When the user chooses an AI feature, CVin sends the minimum selected content and instruction needed to an approved AI processor to generate the result. CVin does not use user CVs, prompts or outputs to train a CVin general-purpose model. Before an AI route is enabled, provider use for general model training must be disabled or contractually prohibited, and provider retention and processing locations must be documented. Limited temporary processing may occur to provide the result, maintain security, prevent misuse or comply with law. AI outputs and compatibility scores are guidance, may be inaccurate and must be reviewed by the user. CVin does not make solely automated decisions that produce legal or similarly significant effects on users.
9. Disclosure and service providers
CVin discloses personal data only where necessary to authorised service providers that operate relevant functions, including hosting, database and file storage; authentication; document processing; AI; payments and invoicing; email and customer support; security, logging and analytics; and professional advice. Providers receive only the data reasonably necessary for their role and are subject to applicable confidentiality, security and data-processing obligations. CVin does not sell personal data and does not share a CV with an employer or recruiter unless the user clearly requests or authorises that sharing. CVin may disclose data to a competent authority, court or regulator where lawfully required.
10. Storage and processing locations
CVin uses external cloud and technology providers. Personal data may be stored or processed outside Saudi Arabia, including in the United States and in the other countries identified in CVin's current approved provider and processing-location record. The applicable location varies by service, subprocessor or AI model. Before a provider route is enabled, CVin documents the purpose, country, data categories, legal basis, necessity and applicable safeguards under the Saudi Personal Data Protection Law and the Regulation on Personal Data Transfer Outside the Kingdom. The public privacy information must be updated if the geographical scope changes materially. Users may contact info@cvin.com.sa for information about relevant safeguards.
11. Payments and financial data
Payment is processed by the gateway and payment methods shown at checkout. CVin receives transaction information needed to activate the plan, reconcile payment, issue a receipt or invoice, handle cancellation or refund and address fraud or disputes. CVin does not intentionally receive or store the complete card number, card security code or online-banking credentials when these are handled by the payment provider. Payment-provider privacy terms may also apply to the provider’s independent processing.
12. Cookies, analytics and marketing
Necessary cookies and similar technologies operate to maintain sessions, security, language and core functions. Preference, analytics and advertising technologies are explained in the CVin Cookie Policy and controlled through the available consent settings. Non-essential advertising or measurement technologies are not activated before the applicable user choice. Marketing consent is optional, separate from account or service acceptance, off by default and may be withdrawn through the unsubscribe method or account settings without affecting essential service communications or prior lawful processing.
13. Security of personal data
CVin maintains organisational, administrative and technical measures proportionate to the nature, volume and risk of the data. Depending on the system, these measures may include role-based access, secure transmission and storage, private-by-default user content, monitoring, backups, incident response and provider review. Access is limited according to work need and is reviewed periodically. No online service can guarantee absolute security. CVin assesses and notifies qualifying personal-data breaches as required by Saudi law.
14. Retention and destruction
CVin applies the following principal retention periods, subject to a documented legal hold or a mandatory longer period: (a) account, profile, CV and saved AI content is kept while the account is active and is deleted or irreversibly anonymised from active systems after a valid deletion request or account closure, normally within 30 days or within a permitted notified extension; (b) residual protected backup copies expire through the documented backup cycle, targeted not to exceed 90 days; (c) support, security-log and privacy-request records are generally kept for up to 24 months after the relevant interaction or closure; (d) marketing records are kept until consent is withdrawn or up to 24 months after the last interaction; and (e) transaction, invoice and tax records are kept for at least six years, or longer where required. Data is securely destroyed or irreversibly anonymised when the purpose and lawful retention period end.
15. Your personal-data rights
Subject to the Personal Data Protection Law and applicable limitations, the user has the right to know the legal ground and purpose of processing; access personal data held by CVin; obtain it in a readable and clear format; request correction, completion or updating; and request destruction of data no longer needed. Where consent is the basis, the user may withdraw it at any time through a method as easy as, or easier than, the method used to give it. Withdrawal does not invalidate prior lawful processing and does not stop processing supported by another lawful ground. The user may also submit a complaint about CVin’s handling of personal data.
16. How to exercise your rights
The user may use the privacy controls available through User Profile > Privacy & Data, or contact info@cvin.com.sa from the account email with a clear description of the request. CVin may request proportionate information to verify identity and protect the account. CVin acts on a valid rights request without delay and within 30 days. This may be extended once for up to an additional 30 days where implementation requires unexpected or unusual effort or the user submits multiple requests, provided the user is notified in advance of the extension and reasons. CVin documents requests and responses.
17. Account deletion
The user may request account deletion through User Profile > Privacy & Data > Delete Account, or by emailing info@cvin.com.sa. Before deletion, the user should download content to be retained. Where an active recurring subscription exists, CVin stops future renewal as part of the deletion process. CVin deletes or irreversibly anonymises account and user content from active systems and instructs applicable processors to act. Protected backup copies expire under Section 14. Limited records may remain only where required by law, security, dispute resolution or another valid legal basis. CVin confirms completion or explains any lawful residual retention.
18. Sensitive and third-party information
CVin is not designed to request sensitive personal data. Users should not enter national ID numbers, medical information, criminal or security information, religious or political beliefs, biometric data, banking credentials or other unnecessary sensitive data in CVs, prompts, chats or support messages. A user who includes another person’s data—such as a referee or contact—must have a lawful basis and provide only what is necessary. CVin may remove, restrict or request correction of content that creates an unnecessary privacy or security risk.
19. Complaints and regulatory escalation
Privacy concerns or complaints should first be sent to info@cvin.com.sa. CVin acknowledges, investigates and responds through the recorded channel. If the user is not satisfied with CVin's response, or believes a personal-data violation occurred, the user may complain to the Saudi Data and Artificial Intelligence Authority through the National Data Governance Platform. Under Article 37 of the Implementing Regulations, a complaint may be submitted within 90 days from the incident or the date the user became aware of it; the authority may accept a later complaint where reasonable grounds exist.
20. Changes to this Policy
CVin reviews this Policy periodically and when a material change affects its processing. The current version and effective date appear at https://cvin.com.sa/privacy. CVin provides reasonable notice of material changes and obtains new consent before any new processing that legally requires it.
21. Contact details
Data controller: Quwa alihtirafiyya Company For Information Technology. Privacy contact: the privacy function designated by company management; general and privacy requests: info@cvin.com.sa. Customer support: support@cvin.com.sa. Website: https://cvin.com.sa. National Address: Building No. 7812, Wadi Malha Street, Al Nada District, Riyadh, Kingdom of Saudi Arabia. If appointment of a Personal Data Protection Officer becomes mandatory, the required contact route will be published.
22. Language and effective version
This Policy is provided in Arabic and English and the texts are intended to have the same meaning. If an inconsistency remains, Arabic prevails to the extent permitted by applicable law. Version 1.3 is effective from 1 September 2026, was last updated on 4 September 2026 and is available at https://cvin.com.sa/privacy.