Jobanji Privacy Notice

Version: 2026-10-24.3
Date: 24 October 2026
Status: In force from Jobanji's launch.

This notice explains what personal data Jobanji uses, why, who receives it, where it goes, how long we keep it, and your rights. It is written for Customers in the UAE and Egypt, under the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Words such as Posting, Fact, Document and Outreach have the meanings in section 3 of our Terms of Service.

1. Who is responsible for your data

Controller: Jobanji's founder, an individual based in the United Arab Emirates. We send you the founder's full name and postal address on request.
Privacy contact: privacy@jobanji.app. Use it for any question or request about your data.
Data protection officer: the founder, at privacy@jobanji.app.
Payments: Paddle, which sells your subscription, decides for itself how it uses your payment data. Its privacy policy is at <https://www.paddle.com/legal/privacy>.

2. The data we use

2.1 Account and sign-in

your name and email address;
if you sign in with Google, your Google account's email and its verification status;
your sign-ins: the devices and browsers you are signed in on, their IP addresses and user agents, and failed sign-in attempts;
the country your IP address is in, which sets the prices you see: Egypt's in Egypt, the UAE's everywhere else. We look it up on our own servers in DB-IP's free country database, so your address isn't sent to anyone (IP Geolocation by DB-IP);
your language and time zone (Dubai or Cairo).

We never ask for or store your own passwords. Sign-in uses a code sent by email, or Google.

2.2 Profile and Application Details

your target markets, roles, level and working languages;
your nationality, needed for Postings open only to some nationalities;
your notice period, current and expected salary, and salary floor;
your Application Details: country and city, UAE visa or residency status, right to work in Egypt, driving licence, earliest start date, willingness to relocate, and languages;
your Preference Rules (for example, Employers to avoid, remote only) and the Skip reasons they came from;
your do-not-contact list.

Optional: date of birth, gender and marital status. You give these only if you choose. We use them only to fill forms that require them, never for matching or scoring.

2.3 Facts, CVs and Documents

CVs and files you upload, text you paste, and public links you give us;
if you choose, your public GitHub projects, and your LinkedIn profile read by our extension from your own signed-in page;
if you choose, your past sent emails or LinkedIn posts, to learn your writing style;
the Facts drawn from these, with where each came from and whether you confirmed it;
the Documents we write for you (CVs, cover letters, Answers, Outreach emails) and, for each sentence, the Facts it relies on.

2.4 Applications and activity

the Postings matched to you, their Match Scores, reasons and gaps;
every Application and Outreach email we sent for you, and what happened next;
your activity history: what Jobanji did on your behalf;
if you allow it, the applicant accounts we create for you on Employer sites, with their generated passwords.

2.5 Gmail

If you connect Gmail:

we read the headers only (sender, recipients, subject, thread) of new messages, to spot job mail;
we read the body only of job mail, to file it. We never store message bodies;
for each job email we keep: its Gmail IDs, its category, the Employer, the Application or Outreach thread it belongs to, any date or deadline, and a one-line summary;
if you allow it, we read one-time codes from Employer sites. We hold a code, encrypted, for 15 minutes at most, then delete it;
we send Outreach and email applications from your Gmail;
we never read your contacts. Mail that isn't job mail is never fully read, sent to an AI model or stored.

Google's consent screen asks for broad access, including your full mailbox and contacts, because the connection runs through Composio's Google app. We use only what this section describes.

Composio, which connects your Gmail, keeps a log of what passes through it for up to one year: the headers of new messages, the text of the job emails we read, and the emails we send. It then deletes the log, and it doesn't use it to train AI models. We store no message bodies ourselves.

2.6 Telegram

If you link Telegram: your Telegram chat ID, a record of each message we send you (what it was about, not its text), the buttons you press, and the messages you write to our bot.

2.7 Billing

From Paddle we receive your subscription's status, Plan, market (from your checkout country), dates and amounts. We never see your card number. Paddle and its payment processors hold your payment details.

2.8 Other data

records of each consent you gave or withdrew (see section 12);
usage records: the cost of the AI processing done for you, to run your usage budget;
your messages to us: complaints, requests and support.

3. Sensitive data

Some data is "sensitive" under the PDPL: for example a photo of your face, family details, ethnic origin, religious belief, health and criminal records. CVs in the region often contain some of these.

We collect sensitive data only if you choose to give it, for example in a CV you upload.
We don't need it. You can remove anything from a CV before uploading it, and you can reject any Fact we extract.
Our CV templates contain no photo.
Egypt government competitions (optional): if you opt in, we ask whether you have a criminal-record certificate, and your military service status, governorate and qualification, because these competitions check them.

We don't store passport, Emirates ID or national ID numbers, or copies of identity documents. When a form needs them, you finish it yourself.

4. Why we use your data, and on what grounds

| Purpose | Ground |

| --- | --- |

| Creating your account and signing you in | Performing our contract with you |

| Showing and selling the plans for the country you're in | Performing our contract with you |

| Building your Profile, matching Postings, writing Documents, and submitting Applications | Performing our contract with you |

| Sending Outreach, filing your job mail, and Telegram messages | Performing our contract with you, and the permissions you chose |

| Storing your data in the EU and using the providers in section 6 | Performing our contract with you |

| Optional items: sensitive data, Gmail, Employer accounts, verification codes, email applications, competitions | Your consent, which you can withdraw |

| Billing, refunds and tax records | Performing our contract, and our legal obligations |

| Keeping consent records, handling complaints and rights requests, and answering authorities | Our legal obligations |

| Security, preventing abuse, and checking the quality of matching and writing | Performing our contract with you |

| Marketing | Only your consent (section 13) |

5. Automated decisions and your right to a human review

Jobanji makes decisions about your job search automatically. This is how the service you subscribed to works.

Matching: every day, Postings are filtered by your nationality (where a Posting is limited to some nationalities), level, languages and Preference Rules. An AI model then scores each one against your Profile, from 0 to 100.
Automatic Applications: a Posting is applied to without asking you only if its Match Score is 80 or more, you meet every must-have requirement we can see, there is no doubt about your eligibility, and your daily limit isn't reached. Otherwise it comes to you to approve or skip.
The truthfulness checker: before anything is sent, every sentence in a Document is checked against the Facts you confirmed. Sentences that can't be supported are rewritten or dropped. If a Document still fails, nothing is sent.
Inbox filing: an AI model sorts job mail into categories. If it isn't sure, nothing is labelled and you decide.
Usage budget: if your usage budget runs out, automatic sending pauses until your next renewal, and we tell you.

Your choices:

Ask for a human review of any automated decision: write to privacy@jobanji.app or use the complaints form in your dashboard. A person at Jobanji will review it and reply within 5 working days.
Switch to always review, so nothing is sent without your approval.
Skip Postings and give a reason. See and edit the rules this creates.

6. Who receives your data

| --- | --- | --- | --- |

| Employers and their applicant-tracking systems | Your Applications: CV, cover letter, Answers and Application Details | To apply for jobs | The Employer's or its system's country, which may be anywhere |

| Job boards and government job portals (for example LinkedIn, Indeed, Bayt, Wuzzuf, GulfTalent, Nafis, TAMM) | What our extension fills in their forms in your browser, when you press Submit | To apply for jobs | The board's or portal's country |

| The AI model providers OpenRouter routes to, only those that keep no data and don't train on it, and none based in China | The same text, for that task only | Running AI models | Mostly the United States; some in the EU and other countries. The list changes as OpenRouter adds and removes providers: <https://openrouter.ai/docs/guides/features/zdr> |

Several of these providers are companies based in the United States, even when your data is stored in Frankfurt.
We don't sell your data. We don't share it for others' advertising.
Your data never goes to AI providers based in China, including the services of model makers such as DeepSeek, Qwen (Alibaba) and Moonshot AI. We use their openly published models only through the providers above.
Our admin reports show only totals and anonymous IDs, not your Profile or Documents.

7. Transfers outside your country, and how we protect them

Your data is stored in the European Union (Frankfurt, Germany) and processed by the providers in section 6 in other countries, including the United States. We rely on PDPL Article 23(1)(d): the transfer is necessary to perform our contract with you. We can't find, write and send your applications without these providers.

We protect your data in these ways:

Contracts: each provider signs a data-processing agreement that holds it to protections at least equal to the PDPL (Article 23(1)(a)).
Your own encryption key: a key that belongs to your account only encrypts your Documents; the files and text you give us; your optional date of birth, gender and marital status; what we enter on each application form; what we keep from your job mail (summaries, interview details and one-time codes); your Outreach threads; your notes on your interviews; and the messages you write to our bot. Deleting your account destroys that key. Your email address, Profile, Facts and the rest of your Application Details are not encrypted with it. Like all your data, they are kept apart from other Customers' data.
Separation: our database refuses to show one Customer's data to another.
Encrypted tasks: background tasks are encrypted before they leave our servers.
No retention by AI providers: every AI request asks for providers that keep no data and don't use it for training.

If the UAE publishes approved countries or new transfer rules, we will review these grounds.

8. How long we keep data

| Data | How long |

| --- | --- |

| Your account, Profile, Facts, Documents and history | While your account exists |

| After you ask us to delete your account | Locked at once; deleted within 30 days, and gone from backups within 30 days |

| An account whose Plan has ended and that is unused for 12 months | Deleted, after a warning 30 days before |

| One-time codes from Employer sites | 15 minutes at most |

| Bodies of emails in your Gmail | Never stored by us; Composio's log of the mail we read and send, up to one year |

| Our system logs (which hold IDs, not your personal data) | 30 days |

| Our security log of sign-in and account events (IDs, and the IP address each request came from) | 30 days |

| Consent records and our billing records (subscription status, dates and amounts) | 5 years after your account is deleted, to prove what you agreed to and to meet record-keeping duties |

| Data Paddle holds | Under Paddle's own policy |

What we can't delete: Applications and emails already sent can't be recalled. Employers and Contacts keep what they received under their own rules.

9. How we protect your data

encryption of the data listed in section 7 with a key for your account only, and separation of each Customer's data in the database;
sign-in by emailed code or Google, with no passwords, sessions you can see and end in your dashboard, and a Telegram message, if you linked it, when a new device is paired;
logs that carry IDs, not your personal data, and a security log of sign-in and account events, with IP addresses, so that we notice attacks;
passwords for Employer accounts kept encrypted, and used only by our submission system.

10. Your rights

You can, free of charge:

access your data, and learn how we use it;
take a copy in a structured, machine-readable form: use Export in your dashboard (JSON plus files);
correct your data: edit your Profile, Facts and Application Details in the dashboard;
erase your data: delete your account in Settings, or write to us;
restrict our use of your data while a correction or objection is checked;
object to processing, including direct marketing;
ask for a human review of an automated decision (section 5);
withdraw any consent (section 12).

How: use your dashboard, or write to privacy@jobanji.app from your account's email. We may ask you to confirm it is you. We answer within 30 days.

11. Data breaches

If a breach affects your data, we act at once to stop it and to limit the harm. We notify the regulator and you, as the law requires. We tell you what happened, what data was affected, what we did, and what you can do.

12. Withdrawing consent

Optional permissions (Gmail, Employer accounts, verification codes, email applications, competitions, sensitive data): you can turn each off in Settings. You can also remove Jobanji's access in your Google account. The features that need them stop.
Marketing: see section 13.

We keep a record of each consent you give or withdraw: the exact text you saw, its language and version, the time, your IP address and browser, and where you gave it (website or extension). This lets us prove what you agreed to.

13. Marketing

We send news and offers only if you opt in. The box is unticked at sign-up.
Every marketing message lets you unsubscribe. You can also change this in Settings.
Messages about your account, Applications, payments and these documents are not marketing. You receive them while you have an account.

14. Complaints

First, contact us: privacy@jobanji.app, complaints@jobanji.app, or the complaints form in your dashboard. We answer within 5 working days.
Then the regulator: in the UAE, the Federal Authority for Artificial Intelligence and Data, which absorbed the UAE Data Office in June 2026.
You can also go to any other authority or court the law of your country allows.

15. Cookies

We use a sign-in cookie that the service needs to keep you signed in. We use no analytics, advertising or tracking cookies or tools.

16. Age

Jobanji is for adults. You must be at least 18 years old to sign up.

17. Changes to this notice

Each version of this notice has a version number and a date. Earlier versions are available on request.
We tell you by email and on Telegram before a material change takes effect.
If we start sending data to a new country, or to a new kind of recipient, we tell you before it starts.

18. Language

This notice is published in Arabic and English. Both versions are binding; where they differ, the one more favourable to the Customer applies.