Introduction
At Tabhar ("we", "us", "our"), we are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use our career platform at tabhar.com, which takes you from CV to hired: building your CV, writing cover letters, checking your CV against applicant tracking systems (ATS), sharing it and practising for interviews.
Information We Collect
- Account information: email address, full name, and authentication data when you register.
- Signing in with Google or LinkedIn: if you choose one of them, that service shares your name, email address and profile photo with us, and they are kept with your sign-in record. We use your name and email address for your account. We show a Google profile photo as your account picture; we do not show a LinkedIn photo.
- CV content: personal details, work experience, education, skills, and other information you enter into your CV.
- Optional onboarding answers: if you choose to give them after signing up, your job title, your industry, and how you heard about Tabhar. We use how you heard about us only to understand how people find Tabhar.
- Free ATS checker: the file you check is read once, only to extract its text, and is never stored on our servers. If you then choose “Improve with AI” or “Deep AI check”, that text waits in your own browser — not on our servers — for up to 24 hours until you sign in, when it is added to your account; after 24 hours it is never imported. You can remove it at any time by clearing this site’s data in your browser.
- Usage data: pages visited, features used, browser type, and device information for analytics and service improvement.
- Error reports: if a page fails in your browser, it sends a short technical report to our own server so we can fix it — the error message with names, email addresses, numbers, quoted text and any Arabic text removed, the technical location in our code, the page’s path without anything after it, and your browser’s name and version. No CV text, no account details, and no IP address are stored. Reports are kept for up to 90 days after the error was last seen.
- Security signals: when someone starts creating an account or a sign-in fails, we record a one-way code made from the email address entered and a one-way code made from the network it came from (the first part of the IP address, never the full address), with the country and the browser’s name and version — so we can spot accounts created in bulk and repeated failed sign-ins. These codes cannot be turned back into an email or an address. They are kept for 90 days.
- Account suspension: if we suspend an account for misuse, we keep the reason and when it happened, and when someone next tries to sign in to that account we send the reason to the account’s own email address.
- Payment information: our payment gateway is the merchant of record and handles payment processing on our behalf. We share your email address, your name, and an internal account reference with the payment gateway so that it can identify your purchase. You enter your card and billing details directly into the gateway’s checkout, so they never reach our servers, and we do not store credit card numbers. The payment gateway collects your billing address and country in order to calculate and charge any tax that applies there, and returns to us only the transaction, customer, and subscription identifiers, the amount and currency, and the plan or Points pack you bought.
How We Use Your Information
- CV generation and management: to create, store, and export your CVs.
- Account management: to maintain your account, authenticate access, and manage subscriptions.
- Service improvement: to analyze usage patterns and improve our platform features.
- Communication: to send service-related notifications and respond to support requests.
- AI features: to provide AI-powered CV writing suggestions (paid plans only). Your data is not used to train AI models.
- Spelling and grammar check: in the CV and cover-letter editors, English text is checked inside your own browser and never leaves it. For Arabic spelling, the individual words are sent to our own server to be looked up in a dictionary; they are not stored and are not used for anything else. The words you add to "My dictionary" are saved to your account so they are not flagged again, and are deleted with your account. On paid plans, when you run the Arabic grammar check, the text you choose to check is sent to our AI provider to be checked.
Data Storage and Security
Your data is stored securely on Supabase (cloud infrastructure) and served through Vercel. Our servers are located in secure data centers. We implement industry-standard security measures including encryption in transit (TLS) and at rest, row-level security policies, and secure authentication protocols.
Saudi Personal Data Protection Law (PDPL)
We comply with the Kingdom of Saudi Arabia Personal Data Protection Law (PDPL). As a data controller, we process your personal data lawfully and transparently. We only collect data necessary for providing our services, and we implement appropriate technical and organizational measures to protect your data.
GDPR Compliance
For users in the European Economic Area, we align our data practices with the General Data Protection Regulation (GDPR). We process data based on your consent and our legitimate interest in providing the service.
Digital business cards
- What a card holds: the details you put on it yourself — your name, job title, company, phone, email, website and LinkedIn, and a photo, logo and cover image if you add them. We store them on our servers; every image is re-encoded and its embedded location and device data is removed.
- Who can see it: anyone who has your card’s private link or its QR code — and, if you choose a memorable address on a paid plan, anyone who guesses that address. Cards are not listed in search engines or anywhere on our site.
- Your card’s visitors: we keep only daily numbers — views, QR scans, link opens and contact saves. We never store a visitor’s IP address, device, cookies or identity, and the card page loads no analytics.
- Reports: any visitor can report a card. We store which card, the reason and an optional note — nothing about the person reporting. Our team reviews reports and may suspend a card that breaks the Terms of Service.
- Your control: at any time you can make a new private link (the old link and every printed QR code that carries it stop working), stop a memorable address, or delete the card. Deleting your account deletes your cards, their images and their numbers. A memorable address you used is kept as a bare word — with nothing that links it to you or your card — only so that it is never given to anyone else, and an address you once printed or shared can never lead to someone else’s card.
- Sharing your CV by link: if you turn on CV sharing (available on the free plan for one CV), anyone with the link can read that CV. You can stop sharing at any time, and the link then stops working for good.
Your Rights
- Access: request a copy of the personal data we hold about you.
- Correction: request correction of inaccurate or incomplete data.
- Deletion: request deletion of your personal data. You can delete your account and all associated data from the Account settings page.
- Event logs and support messages: our event logs, the emails you send to our support address, and messages sent through our contact form are kept for up to 90 days and then deleted automatically.
- Records of administrative actions: if your account is deleted, records of actions our team took on your account (what was done, when, and your account’s email address and user ID) are kept for 24 months after the deletion, for customer-support purposes, and then deleted.
- Data portability: export your CV data in PDF format at any time.
- Withdraw consent: you may withdraw your consent to data processing at any time by deleting your account.
Children's Privacy
Tabhar is intended for people aged 18 or older and is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe that someone under 18 has given us personal data, contact us at support@notify.tabhar.com and we will delete it.
Privacy Inquiries
For privacy-related questions or to exercise your rights, contact us at support@notify.tabhar.com.