Privacy Policy

1. Two kinds of people

This policy covers two groups, and their rights differ. Users are the recruiters who hold an account with us. Candidates are the professionals whose information appears in search results. If you are a candidate and want your information removed, see section 7 — you do not need an account and you do not need to contact the employer.

2. What we collect about users

• Account details you give us: name, work email, mobile number, company, country, city and industry.
• What you do in the product: searches you run, candidates you open, approvals you give. This is how we bill you and how we can show you who did what.
• Technical records needed to keep the account secure: sign-in times and a hashed form of your network address.

3. What we hold about candidates, and where it comes from

Candidate profiles are built from professional information that is already published — principally profiles licensed from our data provider Coresignal, together with CVs that an employer uploads. We hold names, professional contact details, work history, education and skills. We do not collect or store special-category data: no religion, no health, no ethnicity, no political or trade-union affiliation, no biometric data, no national ID numbers.

4. What we do not infer

We do not infer or record emotion, sentiment, tone, confidence, personality, honesty, cultural fit or likelihood of leaving a job, and we never process candidate video. Where we estimate something — a salary band, how likely someone is to accept an approach — the estimate carries the evidence it was drawn from, and that evidence never includes age or anything derived from age.

5. Where your data is kept

The database sits in Oracle Cloud in Riyadh (me-riyadh-1), inside the Kingdom. Live interviews run from Frankfurt for latency reasons and handle only transient, tokenised data — no directly identifying information is stored there. Contact details are encrypted in a separate vault, not alongside the profile they belong to.

6. Who else sees it

We use AI models to read and summarise professional information. Before anything leaves our systems for a model or any other vendor, identifying details are replaced with tokens — the model sees the work history, not the person's name, email or phone number. Our processors are our cloud host (Oracle), our data provider (Coresignal), our model provider (Anthropic), our email provider, and the vendors that carry live interview audio. We do not sell personal data, and we do not use candidate data to train models.

7. Your rights, and how to use them

Under the Saudi Personal Data Protection Law you may ask to see the personal data we hold about you, have it corrected, have it deleted, object to how it is used, and receive a copy. Candidates may also opt out entirely: we record the request and stop surfacing that person in any search, for every customer, permanently. Write to privacy@theeb.ai. We reply within thirty days and there is no charge.

8. How long we keep it

Account and billing records are kept for as long as you are a customer and afterwards only for the period the law requires. Candidate profiles are refreshed from source and removed when the source removes them or when the person opts out. If you close your account, your organisation's data is deleted within ninety days, except records we must retain by law.

9. Contact

For any privacy question, or to exercise a right above, write to privacy@theeb.ai. You may also complain to the Saudi Data & AI Authority (SDAIA).