Sira — Privacy Policy

Effective date: 5 November 2026

This policy explains what personal data Sira collects, why, who it is shared with, and what rights you have. We handle your data under Egypt's Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (together, "the PDPL"). It is written to be read — no legalese where plain language works.

1. Who is responsible for your data

Data controller: Ahmad Abdelaal, 6th of October City, Giza, Egypt.

Contact for anything in this policy (questions, requests, complaints): [email protected].

2. What we collect

Account data — when you sign up (through our authentication provider, Neon Auth): your name, email address, and sign-in method. If you choose to sign in with Google or Microsoft, we receive your name, email address, and that provider's account identifier. We also store your plan (Free/Pro), account status, and when you last used the Service.

CV and career content — the content you create or upload is the core of the Service and is, by nature, personal data: work history, education, skills, contact details, and anything else you put in a CV or cover letter. This also includes job descriptions you paste for ATS matching or cover-letter generation, and the text extracted from CV files you upload.

• Uploaded files are not stored. When you upload a PDF/DOCX, we extract its text in memory and keep only the extracted text; the original file is discarded after processing.
• We do not ask for sensitive personal data — health, religion, political opinions, biometric or financial data, or anything about children. Please do not type it into free-text fields. If you choose to include it in your own CV, you do so on your own initiative and it is processed only to show and export that CV.

Usage data — feature-usage counters needed to enforce plan limits (AI credits used, PDF exports, ATS scans, cover-letter generations) and product events (for example "created a CV" or "exported a PDF") recorded against your account. Product events are stored in our own database. They record which feature was used and when — never the content of your CV, cover letters, or job descriptions.

Technical data — your IP address, browser and device type, and error and security logs. We use these to keep the Service working, to stop abuse, and to limit how often a feature can be used.

Messages to us — anything you send to our contact email.

Payment data — we do not take payments yet. Before we do, we will name our payment provider here. We will never see or store your card number. For now we store only your plan and its status, and your Pro period.

3. Why we use your data, and on what legal basis

We use your data only for the purposes above. We do not sell your data, show ads, or share your CV content with employers or recruiters. No automated decision about you is made beyond the scores and suggestions you explicitly request.

To be precise about where your CV text does and does not travel — three different things, often confused:

• AI features — your text leaves our servers. When you trigger an AI action, the relevant CV or cover-letter text (and the job description, if you supplied one) is sent to OpenRouter and on to a third-party model provider. This is unavoidable for the feature to work, happens only when you ask for it, and is described in full in section 4.
• ATS scoring — your text stays here. Compatibility and job-match scoring run on our own servers. That text is not sent to any third party.
• Analytics — your text is never involved. Analytics records that an action happened, never the content it happened to.

4. AI processing — read this part

When you use an AI feature (bullet improvement, cover-letter generation), the relevant text — the bullets or CV content involved, your instruction, and the job description if you provided one — is sent to OpenRouter, an AI routing service, which forwards it to a third-party large-language-model provider to generate the response. This happens only when you trigger an AI action, and only the text needed for that action is sent.

We send these requests only through routes configured for zero data retention, meaning the model provider is not allowed to keep your text after it replies. If no such route is available, the AI feature is switched off for that request instead of falling back to a provider that keeps data.

ATS compatibility scoring and job-description similarity are computed locally on our own servers using an on-device language model — that text is not sent to any third party.

You can turn AI features on or off at any time on your Account page. They are off until you turn them on, and they never run on their own.

5. Who we share data with (service providers)

Each provider receives only what it needs for its purpose and is bound by its own terms. We may also disclose data when the law, a court order, or a competent investigating authority requires it.

6. Cookies and local storage

We use only what the Service needs to function:

• Authentication cookies (set by our sign-in provider) to keep you signed in.
• Local storage for interface preferences (for example language and light/dark theme).

We do not use advertising cookies, and no analytics or advertising company receives your data. We do not currently use an analytics cookie. If that ever changes, this policy will be updated first.

7. International transfers

Your data leaves Egypt. Our database is in Germany (European Union) and our application server is hosted with a cloud provider; AI requests go to OpenRouter and its model providers, which are mainly in the United States; our email provider and our delivery network also operate outside Egypt.

We do this only so the Service can work for you, and we rely on your explicit consent, which you give when you accept this policy and when you turn on AI features, and on what is necessary to perform our contract with you. We reduce the risk by encrypting data in transit, using zero-retention routes for AI, and sending each provider only the minimum it needs.

8. How long we keep data, and how to delete it

• Account data and content stay in your account until you delete them or delete your account.
• A CV you delete in the app disappears from your account straight away and is permanently erased within 30 days.
• If you ask us to delete your account, we permanently erase your CVs, cover letters, scan history, and account data within 30 days. Product events linked to you are de-identified so that nothing remains tied to you.
• Billing records are kept for five years, as Egyptian tax law requires, and then erased.
• Security logs are kept for a short time (days to weeks) and then overwritten.
• Database recovery history kept by our database provider means deleted data can survive in backups for a few hours, and is then overwritten.

9. Your rights

Under the PDPL you can:

• Be informed of, access, and obtain the personal data we hold about you.
• Withdraw your consent to the retention or processing of your data.
• Correct, modify, delete, add to, or update your data (most of it you can edit directly in the app).
• Restrict processing to a specific scope.
• Be notified of any breach of your personal data.
• Object to processing, or to its results, that conflicts with your fundamental rights and freedoms.

To use any of these rights, email us at the address in section 1 from the email address on your account, and tell us what you want. We may ask you to confirm your identity first. We answer within 6 working days of receiving your written request; if we refuse, we give our reasons. We do not charge for handling these requests.

You also have the right to complain to the Personal Data Protection Center, the Egyptian data-protection authority.

10. Security and data breaches

Data is encrypted in transit (HTTPS everywhere). Access to production data is restricted to the operator. Passwords and sign-in security are handled by our sign-in provider — we never see your password. No system is perfectly secure.

If a breach affects your data, we notify the Personal Data Protection Center within 72 hours of becoming aware of it, and we notify you within 3 working days after that, telling you what happened and what we are doing about it.

11. Children

The Service is not for anyone under 18. The PDPL treats children's data as sensitive and requires a parent's or guardian's consent, so we do not accept children as users. We do not knowingly collect data from children, and we delete it if we learn we have.

12. Marketing emails

We send only emails you need to use the Service. We will not send you marketing emails unless you have agreed to them first, and every such email will say who we are and let you opt out easily.

13. Changes to this policy

We may update this policy. For material changes we will notify you by email or in-app notice before they take effect.

14. Contact and complaints

Privacy questions, requests, or complaints: write to the email address in section 1. If you are not satisfied with our answer, you may complain to the Personal Data Protection Center.