Privacy Policy

Istiqtab is the platform's trading name. The legal operator identified in the website and checkout is the controller under the Saudi Personal Data Protection Law (PDPL). Privacy requests may be sent to privacy@istiqtab.com. The operator's legal identity and contact details must be completed in the notice above before personal data or payments are collected.

Depending on your use, we collect:

• account and verification data, including name, email, password hash, role, consent records and security/session data;
• candidate CV and profile data, such as contact details, work history, education, skills, languages, certifications, salary expectations, work authorization, location and uploaded documents;
• employer data, including representative and company details, verification evidence, job openings, saved candidates and hiring-pipeline activity;
• transaction data from our payment provider, such as invoice status, amount and transaction reference. We do not intentionally store full card details;
• technical, fraud-prevention and usage data, including IP address, device/browser information, timestamps, audit events and profile-view events.

Please do not include national ID copies, health data, religion, ethnicity or other sensitive information in a CV unless it is strictly required and lawfully requested.

• Contract: create and secure accounts, build CVs, provide search, favorites, comparisons, pipelines, paid tools, support and payments.
• Consent: make a candidate profile discoverable to verified employers, optional marketing, and optional local CV auto-fill. Consent can be withdrawn without affecting earlier lawful processing.
• Legal obligation: accounting, tax, fraud prevention, valid authority requests and regulatory compliance.
• Legitimate interests, after assessment: service security, abuse prevention and aggregated service improvement where these interests do not override individual rights.

A candidate is searchable only while they have chosen to be looking for work. Verified employers must apply at least one hard filter and one educational filter; professional and skills filters are optional. Candidate Premium does not improve search rank, visibility or employer scoring, and employers are not shown a Candidate Premium badge. Istiqtab does not make final hiring decisions. Employers remain responsible for lawful, relevant and non-discriminatory decisions and for independently checking candidate information.

Optional CV auto-fill extracts text from PDF or DOCX files inside Istiqtab's backend using deterministic software. The CV is not sent to an AI model or external parsing provider. Separate consent is requested before parsing, results are only an editable draft, and manual entry remains available. Scanned documents that require OCR are not processed by this feature.

We disclose only what is necessary to:

• verified employers where a candidate has enabled profile discovery;
• hosting, database, file-storage, email, security/CAPTCHA, analytics, support and payment processors under written instructions;
• professional advisers and competent authorities where legally required;
• a successor in a genuine corporate transaction, subject to confidentiality and applicable law.

We do not sell personal data. Employers may use candidate data only for genuine recruitment and must not scrape, resell or build unrelated databases.

CV auto-fill does not transfer a CV to an external parser. Other infrastructure or support suppliers may still process limited data outside Saudi Arabia. Before each such transfer, the operator documents its legal basis, destination, necessity and minimization; verifies any adequacy decision or exception; executes an approved safeguard such as SDAIA Standard Contractual Clauses where required; and completes a transfer risk assessment where required. A privacy-policy statement alone is not a transfer safeguard.

We keep account and profile data while the account is active and only as long afterwards as needed for stated purposes, disputes, security and legal retention duties. On a valid deletion request, profile discovery stops and data is deleted or irreversibly anonymized unless retention is required by law. Transaction and accounting records are kept for the legally required period. Backups are access-restricted and removed through their documented rotation cycle. The operator must maintain a retention schedule for every data category.

Subject to lawful limits, you may request information about processing, access and a copy, correction, completion or updating, and destruction when no lawful reason to retain the data remains. You may withdraw consent and object or complain where applicable. We verify identity and normally respond within the period required by the PDPL Implementing Regulations. You may complain to the Saudi Data & AI Authority through the National Data Governance Platform if you are not satisfied.

Send requests to privacy@istiqtab.com. There is no fee unless the law permits one.

We use proportionate organizational and technical controls such as access restriction, authentication controls, encryption in transit, logging, rate limits, secure development and processor oversight. No system is risk-free. We assess incidents and notify SDAIA within the legally required timeframe where the notification threshold is met, and notify affected individuals without undue delay where required.

The platform is for users aged 18 or older. Material policy changes will be presented through the service or by email before they take effect where required. Questions, complaints and rights requests: privacy@istiqtab.com. General support: support@istiqtab.com.