Privacy Policy

When you create a Nasiya account or use our platform, we collect:

• Identity data: full name, email address, job designation
• Authentication data: hashed password or third-party authentication tokens
• Profile preferences: chosen theme, interview language preference, notification settings
• Organisation data: organisation name, domain, industry context descriptions, hiring location and jurisdiction settings, AI calibration preferences (scoring weights, prompt addenda)
• Usage logs: pages visited, roles created, candidates viewed, features used, timestamps of actions. We use this internally for product improvement and support.
• Feedback submissions: any in-app feedback messages you send us

Candidate data is personal data about third parties that your organisation submits to us. This includes:

• Identity: full name, email address, phone number, LinkedIn URL
• CV / resume content: work history, education, skills, achievements, qualifications — either uploaded as a file (PDF, DOCX) or entered as text
• ATS metadata: application IDs, job IDs, application status, and timestamps from connected ATS platforms
• Nasiya analysis outputs: suitability score, tier classification, AI-generated candidate brief, claim extraction results, risk assessments, JD coverage analysis, interview question sets, alignment assessment, and growth velocity scores
• Interview round data: stage progression, interviewer signal (strong / neutral / weak), notes added by your team
• Candidate notes: free-text notes written by Account Holders about specific candidates
• Pipeline stage: applied, shortlisted, interviewing, offer, hired, rejected

Your organisation is the data controller for candidate data. You are responsible for ensuring you have a lawful basis for submitting candidate personal data to Nasiya, and for informing candidates that their data may be processed by AI systems as part of the recruitment process where required by applicable law.

When you use the Nasiya Chrome extension:

• API token: your extension token is stored locally in your browser using Chrome's chrome.storage.local API. It is never transmitted to any party other than Nasiya's own servers for authentication.
• Profile text: when you navigate to a supported candidate profile page and explicitly click “Score”, the visible text content of that page is extracted and sent to Nasiya's servers for AI analysis. This happens only on user action — the extension does not collect data passively or in the background.
• Selected role: the Nasiya role ID you have selected for scoring is stored locally in chrome.storage.local.
• ATS candidate data: when used inside a connected ATS interface, the extension may read candidate details visible on screen and submit them for analysis, subject to the ATS integration permissions your organisation has configured.

The extension does not track your browsing history, does not collect data from pages other than supported candidate profile pages and ATS interfaces, and does not run in the background when you are not actively using it.

If your organisation uses Nasiya's public application form to collect candidate applications directly, we collect:

• Candidate full name, email address, and phone number
• Pre-screening question answers
• Uploaded CV file
• Email verification status

This data is collected on behalf of your organisation and processed under this policy.

If you connect a third-party ATS (Greenhouse, Lever, or Ashby), we store:

• Your encrypted ATS API key (stored in our database; never exposed in plain text after initial entry)
• Job/posting metadata fetched from the ATS (titles, departments, locations)
• Candidate records pulled from the ATS, including names, emails, and CV files
• Sync timestamps and processing status

We do not access your ATS account beyond what is required to retrieve job postings and candidate applications for the roles you have explicitly activated.

We automatically collect limited technical data when you use the platform:

• IP address (used for security and abuse prevention, not for tracking)
• Browser type and version
• Operating system
• Referring URL
• Session timing data

We do not use third-party advertising trackers or behavioural advertising networks.

• Authenticating Account Holders and managing access control
• Running AI analysis on candidate CVs and profiles to produce scores, verdicts, and structured insights
• Syncing candidate data from connected ATS platforms
• Generating and delivering email OTP codes for candidate application verification
• Sending invite emails to new team members
• Displaying candidate dossiers, interview kits, and pipeline views to authorised Account Holders within your organisation

• Analysing aggregate usage patterns to improve the platform (e.g. which features are used, where errors occur)
• Diagnosing bugs, performance issues, and errors
• Improving AI scoring accuracy over time using aggregated, anonymised outcome data where you have consented

We do not use individual candidate CVs or personal data to train AI models without explicit written consent from your organisation.

• Detecting and preventing fraudulent, abusive, or unauthorised use
• Verifying identity and preventing multiple accounts
• Complying with legal obligations

• Transactional emails (OTP codes, invitations, password resets)
• Service notifications (processing complete, analysis ready)
• Material updates to this Privacy Policy or our Terms of Service

We do not send marketing emails without your explicit consent.

Nasiya may use anonymised, aggregated data from your organisation's hiring patterns to improve AI recommendations specifically for your organisation's benefit. This is entirely optional.

• This consent is never assumed or pre-selected — you must actively opt in during onboarding or via your organisation settings.
• If you opt in: we may use aggregated, anonymised signals (e.g. which types of candidates your team tends to advance, which scoring dimensions correlate with your actual hire outcomes) to calibrate Nasiya's models for your organisation specifically.
• What we DO NOT do: We do not use individual candidate CVs, personal data, or identifiable information to train any AI model. We do not share your organisation's data with other organisations or use it to train general-purpose AI models.
• Withdrawal: You may withdraw this consent at any time from your Organisation Settings → Data & Privacy. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

If you have not opted in, your data is used solely to deliver the Service (Section 3.1) and for anonymised aggregate product improvement (Section 3.2).

All Account Holders belonging to your organisation can see candidate data, role data, and notes associated with their organisation. Access is scoped strictly by organisation — no other organisation can access your data.

We share data with trusted infrastructure providers under data processing agreements:

• Supabase — database storage, file storage (resumes), and authentication
• Vercel — application hosting and serverless function execution
• Resend — transactional email delivery (OTP codes, invitations)
• Cloudflare — bot protection on public application forms (Turnstile)

When you configure result webhooks or note-writing back to your ATS, Nasiya will send analysis results (score, tier, summary) to that ATS on your behalf. This is always explicitly configured by your organisation.

We may disclose data if required by law, court order, or regulatory authority, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Nasiya, our users, or the public.

If Nasiya is acquired, merged, or its assets are transferred, candidate and account data may be transferred as part of that transaction. We will notify affected Account Holders via email before any such transfer occurs and give them the opportunity to request deletion.

We process personal data of UAE data subjects on the following bases:

• Contract performance: processing account and service data necessary to deliver the subscription you have entered into
• Legitimate interests: product improvement, security monitoring, and fraud prevention, where such interests do not override data subjects' rights
• Explicit consent: where required under UAE PDPL (e.g. optional AI training, sensitive data processing)

UAE data subjects have the following rights:

• Right of access: request confirmation of whether we process your personal data and obtain a copy
• Right to rectification: request correction of inaccurate or incomplete personal data
• Right to erasure: request deletion of personal data where retention is no longer necessary or lawful
• Right to restrict processing: request limitation of processing in specified circumstances
• Right to object to automated decisions: object to decisions made solely on the basis of automated processing, including AI-generated candidate assessments, where such decisions significantly affect you

Where personal data of UAE data subjects is transferred outside the UAE, Nasiya ensures that such transfers are protected by appropriate contractual safeguards (such as standard data transfer clauses), adequacy mechanisms recognised under UAE law, or other legally permissible transfer mechanisms.

Consistent with UAE PDPL requirements, we collect only personal data that is adequate, relevant, and limited to what is necessary for our recruitment intelligence purposes. We do not process sensitive personal data as defined under the UAE PDPL — including biometric data, health data, religious beliefs, or financial data — without obtaining explicit prior consent from the data subject.

We only collect personal information that is reasonably necessary for our hiring intelligence functions. We collect personal information directly from Account Holders and from candidates via your organisation's recruitment workflows, or from connected ATS platforms on your instruction.

At or before the time we collect personal information (or as soon as practicable afterwards), we notify individuals of our identity and contact details, the purposes for which we are collecting the information, any third parties to whom we would typically disclose the information, and the individual's right to access and correct their information.

Personal information collected for recruitment purposes is not used or disclosed for purposes unrelated to recruitment without the individual's consent, unless an exception under the Privacy Act applies.

We take reasonable steps to protect personal information from misuse, interference, and loss, and from unauthorised access, modification, or disclosure. This includes encryption in transit and at rest, access controls, and row-level database security (see Section 8).

Individuals may request access to their personal information held by Nasiya by emailing support@nasiya.co. We will respond within 10 days. We may charge a reasonable fee for providing access where permitted by law.

Individuals may request correction of inaccurate personal information by emailing support@nasiya.co. We will take reasonable steps to correct the information or, if we do not agree the information requires correction, to note the individual's request alongside the information.

In the event of an eligible data breach that is likely to result in serious harm to one or more individuals, Nasiya will notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals as soon as practicable after becoming aware of the breach, in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.

Each client workspace is a logically isolated organisation within Nasiya. A client workspace's candidates, roles, analyses, and interview records are not shared with or visible to any other client workspace. Agency administrators can access all workspaces linked to their agency account; clients cannot see each other's data.

By creating or accepting access to an Agency account, you acknowledge that the agency account holder (your recruiter) can view candidate data, pipeline status, analysis results, and interview records for all workspaces linked to their agency. If you are an employer client granting access to an agency, you consent to this access as part of the service arrangement.

For each client workspace:

• Nasiya Inc. acts as the data processor — we process candidate data on documented instructions from the data controller.
• The employer client (the organisation whose candidates are being screened) is the data controller — they determine the purposes and means of processing.
• The agency acts as a sub-processor on behalf of the employer client and is responsible for ensuring their use of Nasiya complies with applicable data protection laws in their jurisdiction.

Agencies must have a valid Data Processing Agreement (DPA) in place with their employer clients before submitting candidate personal data to Nasiya on their behalf.

Candidates applying to roles in a client workspace are informed — via the mandatory AI screening consent disclosure on the public apply form — that:

• Their CV and application data will be processed by AI;
• The processing is conducted on behalf of the employer;
• A human makes the final hiring decision.

Agencies are responsible for ensuring that any candidates submitted outside of the Nasiya apply form (e.g. uploaded directly) have given equivalent informed consent.

If an agency removes a client workspace from their agency view, the workspace is unlinked — not deleted. The employer client's data (roles, candidates, analyses) remains intact and accessible to any remaining members of that workspace. To permanently delete workspace data, the employer client must submit a deletion request to support@nasiya.co.

Agency account data — including the workspace list, scheduling history, and interview records — is retained for 2 years after account closure or the removal of the agency subscription, unless a shorter retention period is required by applicable law or requested by the data controller.