Jobanji Privacy Notice

Version: 2026-10-25.1 · Date: 25 October 2026 · Status: In force from Jobanji's launch.

This notice explains what personal data Jobanji uses, why, who receives it, where it goes, how long we keep it, and your rights. It is written for Customers in the UAE and Egypt, under the UAE's Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the PDPL). Section 19 is for people at Employers whose details we hold. Words such as Posting, Fact, Document and Outreach have the meanings in section 3 of our Terms of Service.

1. Who is responsible for your data

Controller: Nader Mouafaak Almahaini, an individual based in the United Arab Emirates, trading as Jobanji. We send you the postal address on request, by email.
Privacy contact: privacy@jobanji.app. Use it for any question or request about your data.
Data protection officer: the founder, at privacy@jobanji.app.
Payments: Paddle, which sells your subscription, decides for itself how it uses your payment data. Its privacy policy is at https://www.paddle.com/legal/privacy.

2. The data we use

2.1 Account and sign-in

your name and email address;
if you sign in with Google, your Google account's email and its verification status;
your sign-ins: the devices and browsers you are signed in on, their IP addresses and user agents, and failed sign-in attempts;
the country your IP address is in, which sets the prices you see: Egypt's in Egypt, the UAE's everywhere else. We look it up on our own servers in DB-IP's free country database, so your address isn't sent to anyone (IP Geolocation by DB-IP);
your language and time zone (Dubai or Cairo).

We never ask for or store your own passwords. Sign-in uses a code sent by email, or Google.

2.2 Profile and Application Details

your target markets, roles, level and working languages;
your nationality, needed for Postings open only to some nationalities;
your notice period, current and expected salary, and salary floor;
your Application Details: country and city, UAE visa or residency status, right to work in Egypt, driving licence, earliest start date, willingness to relocate, and languages;
your Preference Rules (for example, Employers to avoid, remote only) and the Skip reasons they came from;
your do-not-contact list.

Optional: date of birth, gender and marital status. You give these only if you choose. We use them only to fill forms that require them, never for matching or scoring.

2.3 Facts, CVs and Documents

CVs and files you upload, text you paste, and public links you give us;
if you choose, your public GitHub projects, and your LinkedIn profile read by our extension from your own signed-in page;
if you choose, your past sent emails or LinkedIn posts, to learn your writing style;
the Facts drawn from these, with where each came from and whether you confirmed it;
the Documents we write for you (CVs, cover letters, Answers, Outreach emails) and, for each sentence, the Facts it relies on.

2.4 Applications and activity

the Postings matched to you, their Match Scores, reasons and gaps;
every Application and Outreach email we sent for you, and what happened next;
your activity history: what Jobanji did on your behalf;
if you allow it, the applicant accounts we create for you on Employer sites, with their generated passwords.

2.5 Gmail

If you connect Gmail:

we read the headers only (sender, recipients, subject, thread) of new messages, to spot job mail;
we read the body only of job mail, to file it. We never store message bodies;
for each job email we keep: its Gmail IDs, its category, the Employer, the Application or Outreach thread it belongs to, any date or deadline, and a one-line summary;
if a job email about one of your Applications states pay, we keep that figure and use it only for the expected pay we show you, never for anyone else;
for a job offer that states its pay, we also keep our check of that pay (how it compares with the expected pay, and in the UAE its basic pay and end-of-service gratuity), and show it only to you, with that Application;
if you allow it, we read one-time codes from Employer sites. We hold a code, encrypted, for 15 minutes at most, then delete it;
we send Outreach and email applications from your Gmail;
we never read your contacts. Mail that isn't job mail is never fully read, sent to an AI model or stored.

Google's consent screen asks for broad access, including your full mailbox and contacts, because the connection runs through Composio's Google app. We use only what this section describes.

Composio, which connects your Gmail, keeps a log of what passes through it for up to one year: the headers of new messages, the text of the job emails we read, and the emails we send. It then deletes the log, and it doesn't use it to train AI models. We store no message bodies ourselves.

2.6 Telegram

If you link Telegram: your Telegram chat ID, a record of each message we send you (what it was about, not its text), the buttons you press, and the messages you write to our bot.

2.7 Billing

From Paddle we receive your subscription's status, Plan, market (from your checkout country), dates and amounts. We never see your card number. Paddle and its payment processors hold your payment details.

2.8 Other data

records of each consent you gave or withdrew (see section 12);
usage records: the cost of the AI processing done for you, to run your usage budget;
your messages to us: complaints, requests and support, and what you send on our contact form (your name, email address and message).

3. Sensitive data

Some data is "sensitive" under the PDPL: for example a photo of your face, family details, ethnic origin, religious belief, health and criminal records. CVs in the region often contain some of these.

We collect sensitive data only if you choose to give it, for example in a CV you upload.
We don't need it. You can remove anything from a CV before uploading it, and you can reject any Fact we extract.
Our CV templates contain no photo.
Egypt government competitions (optional): if you opt in, we ask whether you have a criminal-record certificate, and your military service status, governorate and qualification, because these competitions check them.

We don't store passport, Emirates ID or national ID numbers, or copies of identity documents. When a form needs them, you finish it yourself.

4. Why we use your data, and on what grounds

| Purpose | Ground |

| --- | --- |

| Creating your account and signing you in | Performing our contract with you |

| Showing and selling the plans for the country you're in | Performing our contract with you |

| Building your Profile, matching Postings, writing Documents, and submitting Applications | Performing our contract with you |

| Sending Outreach, filing your job mail, and Telegram messages | Performing our contract with you, and the permissions you chose |

| Storing your data in the EU and using the providers in section 6 | Performing our contract with you |

| Optional items: sensitive data, Gmail, Employer accounts, verification codes, email applications, competitions | Your consent, which you can withdraw |

| Billing, refunds and tax records | Performing our contract, and our legal obligations |

| Keeping consent records, handling complaints and rights requests, and answering authorities | Our legal obligations |

| Security, preventing abuse, and checking the quality of matching and writing | Performing our contract with you |

| Marketing | Only your consent (section 13) |

5. Automated decisions and your right to a human review

Jobanji makes decisions about your job search automatically. This is how the service you subscribed to works.

Matching: every day, Postings are filtered by your nationality (where a Posting is limited to some nationalities), level, languages and Preference Rules. An AI model then scores each one against your Profile, from 0 to 100.
Automatic Applications: a Posting is applied to without asking you only if its Match Score is 80 or more, you meet every must-have requirement we can see, there is no doubt about your eligibility, and your daily limit isn't reached. Otherwise it comes to you to approve or skip.
The truthfulness checker: before anything is sent, every sentence in a Document is checked against the Facts you confirmed. Sentences that can't be supported are rewritten or dropped. If a Document still fails, nothing is sent.
Inbox filing: an AI model sorts job mail into categories. If it isn't sure, nothing is labelled and you decide.
Usage budget: if your usage budget runs out, automatic sending pauses until your next renewal, and we tell you.

Your choices:

Ask for a human review of any automated decision: write to privacy@jobanji.app or use the complaints form in your dashboard. A person at Jobanji will review it and reply within 5 working days.
Switch to always review, so nothing is sent without your approval.
Skip Postings and give a reason. See and edit the rules this creates.

6. Who receives your data

| --- | --- | --- | --- |

| Employers and their applicant-tracking systems | Your Applications: CV, cover letter, Answers and Application Details | To apply for jobs | The Employer's or its system's country, which may be anywhere |

| Job boards and government job portals (for example LinkedIn, Indeed, Bayt, Wuzzuf, GulfTalent, Nafis, TAMM) | What our extension fills in their forms in your browser, when you press Submit | To apply for jobs | The board's or portal's country |

| The AI model providers OpenRouter routes to, only those that keep no data and don't train on it, and none based in China | The same text, for that task only | Running AI models | Mostly the United States; some in the EU and other countries. The list changes as OpenRouter adds and removes providers: https://openrouter.ai/docs/guides/features/zdr |

| Telegram (Telegram Messenger Inc. and its group companies) | The messages we send you, with any CV or cover letter you ask our bot for, and the messages you send our bot | Notifications | British Virgin Islands and Dubai, UAE |

| Resend | Your email address and our emails to you (sign-in codes, account emails); and the name, email address and message you send on our contact form | Sending account email, and bringing your contact form messages to us | United States |

Several of these providers are companies based in the United States, even when your data is stored in Frankfurt.
We don't sell your data. We don't share it for others' advertising.
Your data never goes to AI providers based in China, including the services of model makers such as DeepSeek, Qwen (Alibaba) and Moonshot AI. We use their openly published models only through the providers above.
Our admin reports show only totals and anonymous IDs, not your Profile or Documents.

7. Transfers outside your country, and how we protect them

Your data is stored in the European Union (Frankfurt, Germany) and processed by the providers in section 6 in other countries, including the United States. We rely on PDPL Article 23(1)(d): the transfer is necessary to perform our contract with you. We can't find, write and send your applications without these providers.

We protect your data in these ways:

Contracts: each provider signs a data-processing agreement that holds it to protections at least equal to the PDPL (Article 23(1)(a)).
Your own encryption key: a key that belongs to your account only encrypts your Documents; the files and text you give us; your optional date of birth, gender and marital status; what we enter on each application form; what we keep from your job mail (summaries, interview details, pay it states, our checks of job offers and one-time codes); your Outreach threads; your notes on your interviews; and the messages you write to our bot. Deleting your account destroys that key. Your email address, Profile, Facts and the rest of your Application Details are not encrypted with it. Like all your data, they are kept apart from other Customers' data.
Separation: our database refuses to show one Customer's data to another.
Encrypted tasks: background tasks are encrypted before they leave our servers.
No retention by AI providers: every AI request asks for providers that keep no data and don't use it for training.

If the UAE publishes approved countries or new transfer rules, we will review these grounds.

8. How long we keep data

| Data | How long |

| --- | --- |

| Your account, Profile, Facts and history: each Application's job, date and status, and the Outreach emails we sent | While your account exists |

| The Documents of an Application we sent (its CV, cover letter and Answers) | Deleted 12 months after it was sent, unless an interview for that job is still to come |

| Documents we never sent: for jobs we didn't apply to, versions replaced by newer ones, and drafts of Outreach emails | Deleted 30 days after they were written or replaced, or 30 days after the Application that would have sent them stopped. A Document waiting to be sent is kept. |

| After you ask us to delete your account | Locked at once; deleted within 30 days, and gone from backups within 30 days |

| An account whose Plan has ended and that is unused for 12 months | Deleted, after a warning 30 days before |

| One-time codes from Employer sites | 15 minutes at most |

| Bodies of emails in your Gmail | Never stored by us; Composio's log of the mail we read and send, up to one year |

| Our system logs (which hold IDs, not your personal data) | 30 days |

| Our security log of sign-in and account events (IDs, and the IP address each request came from) | 30 days |

| Messages you send on our contact form (your name, email address and message) | Only as long as we need to answer you |

| To stop spam on the contact form: each message's IP address and a hash of its email address | 1 day |

| Consent records and our billing records (subscription status, dates and amounts) | 5 years after your account is deleted, to prove what you agreed to and to meet record-keeping duties |

| Data Paddle holds | Under Paddle's own policy |

What we can't delete: Applications and emails already sent can't be recalled. Employers and Contacts keep what they received under their own rules.

9. How we protect your data

encryption of the data listed in section 7 with a key for your account only, and separation of each Customer's data in the database;
sign-in by emailed code or Google, with no passwords, sessions you can see and end in your dashboard, and a Telegram message, if you linked it, when a new device is paired;
logs that carry IDs, not your personal data, and a security log of sign-in and account events, with IP addresses, so that we notice attacks;
passwords for Employer accounts kept encrypted, and used only by our submission system.

10. Your rights

You can, free of charge:

access your data, and learn how we use it;
take a copy in a structured, machine-readable form: use Export in your dashboard (JSON plus files);
correct your data: edit your Profile, Facts and Application Details in the dashboard;
erase your data: delete your account in Settings, or write to us;
restrict our use of your data while a correction or objection is checked;
object to processing, including direct marketing;
ask for a human review of an automated decision (section 5);
withdraw any consent (section 12).

How: use your dashboard, or write to privacy@jobanji.app from your account's email. We may ask you to confirm it is you. We answer within 30 days.

11. Data breaches

If a breach affects your data, we act at once to stop it and to limit the harm. We notify the regulator and you, as the law requires. We tell you what happened, what data was affected, what we did, and what you can do.

12. Withdrawing consent

Optional permissions (Gmail, Employer accounts, verification codes, email applications, competitions, sensitive data): you can turn each off in Settings. You can also remove Jobanji's access in your Google account. The features that need them stop.
Marketing: see section 13.

We keep a record of each consent you give or withdraw: the exact text you saw, its language and version, the time, your IP address and browser, and where you gave it (website or extension). This lets us prove what you agreed to.

13. Marketing

We send news and offers only if you opt in. The box is unticked at sign-up.
Every marketing message lets you unsubscribe. You can also change this in Settings.
Messages about your account, Applications, payments and these documents are not marketing. You receive them while you have an account.

14. Complaints

First, contact us: privacy@jobanji.app, complaints@jobanji.app, or the complaints form in your dashboard. We answer within 5 working days.
Then the regulator: in the UAE, the Federal Authority for Artificial Intelligence and Data, which absorbed the UAE Data Office in June 2026.
You can also go to any other authority or court the law of your country allows.

15. Cookies

We use a sign-in cookie that the service needs to keep you signed in. We use no analytics, advertising or tracking cookies or tools.

16. Age

Jobanji is for adults. You must be at least 18 years old to sign up.

17. Changes to this notice

Each version of this notice has a version number and a date. Earlier versions are available on request.
We tell you by email and on Telegram before a material change takes effect.
If we start sending data to a new country, or to a new kind of recipient, we tell you before it starts.

18. Language

This notice is published in Arabic and English. Both versions are binding; where they differ, the one more favourable to the Customer applies.

19. People at Employers

This section is for you if you work at an Employer and we hold your details so that Customers can contact you about jobs: as a recruiter or the likely manager of a team that is hiring (19.1), or as an address Customers write to (19.2).

19.1 Recruiters and hiring managers

This part is for you if you work at an Employer whose jobs we show to Customers, and we hold your details as a recruiter or as the likely manager of a team that is hiring.

What we hold: your name, job title, department, seniority and country; your employer; the link to your public LinkedIn profile; your work email address, only when it was published on a public web page; the public pages where these details were found; and the dates we found them. When a Customer's email about their application needs your work address and it wasn't published, we may ask Hunter for it, and keep it as in 19.2.
Where it comes from: Hunter (Hunter Web Services, Inc., United States), which collects professional details from publicly accessible web pages. We never read LinkedIn ourselves.
Why: so that a Customer applying for a job at your employer knows who recruits for it and who likely leads the team, and can introduce themselves. A few days after a Customer applies for a job at your employer, Jobanji may also email you about their application, from the Customer's own Gmail and in their name: one email, and at most one more. It stops if you reply, and each email ends with a line to stop it.
Ground: these are professional details made public, such as your public profile (PDPL Article 4(2)).
Who sees it: Customers in the UAE and Egypt with a job at your employer among their matches. It is stored in Frankfurt, Germany (EU), with Fly.io and Neon (section 6).
How long: your details are hidden from Customers after 180 days if we don't find you there again, and deleted after 12 months.
Your rights: write to privacy@jobanji.app from your work email, or with your profile link. We tell you what we hold and where it came from. If it's wrong, if you object, or if you ask us to delete it, we delete it at once, at every employer, and keep only a one-way code (a hash) of your email address and profile link, so we never add you again. An opt-out reply to an email a Customer sent you through Jobanji does the same. When Hunter tells us you asked it to stop, we delete your details too.
Complaints: as in section 14.

19.2 Addresses Customers write to (Outreach)

This part is for you if a Customer may email you through Jobanji's Outreach: an introduction to your employer when none of its open jobs fits them, and its follow-ups; or, a few days after applying for a job at your employer, an email about their application, and at most one more.

What we hold: a work email address at your employer, yours or a shared one such as careers@; your name and job title, when we know them; your employer; whether the address was checked and works; when Customers wrote to it; and how many replies, opt-outs and bounces it had. We don't keep the emails themselves: each Customer keeps their own.
Where it comes from: your employer's own job postings and careers pages; a Customer who gives it to us; or Hunter (as in 19.1), which may give an address it worked out from your employer's address pattern, for example when a Customer who applied needs your address.
Why: so that Customers can email your employer from their own Gmail about working there. Every email ends with a line to stop it.
Ground: professional contact details made public by you or your employer (PDPL Article 4(2)). An address Hunter worked out is used only for a Customer's own emails to you, each with a line to stop it.
Who sees it: the Customers whose emails go to it, in their own mailboxes. It is stored in Frankfurt, Germany (EU), with Fly.io and Neon (section 6).
How long: no new Customer starts writing to it after 180 days if we haven't found it again, written to it or had a reply from it, and it is deleted after 12 months.
Your rights: write to privacy@jobanji.app from that address. We tell you what we hold and where it came from. If you object, or ask us to delete it, we delete it at once and keep only a one-way code (a hash) of it, so we never add it again, and no Customer writes to it through Jobanji after. Replying "stop" to a Customer's email stops that Customer's emails to you.
Complaints: as in section 14.