Privacy Policy

1. Who to contact

For privacy questions, access/correction requests or deletion, contact support@carenavigatortech.com, +251 99 215 6739, or Ethio Digital Platforms PLC, AMG Adama Mall, Suite 5-07, Adama, Ethiopia. Include your registered email and the nature of the request. Never send your password, reset code or verification code.

An employer receiving your application is separately responsible for how it uses its recruitment records. Third-party job boards, payment providers and linked websites have their own privacy practices. Contact those organizations about information they hold independently.

2. Information we process

Account data: name, email, optional phone number, role, organization membership, preferred language, account status, email-verification state and signup acceptance timestamp/version. Passwords are stored as hashes, not as readable passwords. Email sign-in challenges store hashed codes, expiry, attempt count and password-change binding; verification/reset tokens are stored as hashes. Staff authenticator credentials are protected separately.

Profile and recruitment data: headline, biography, skills, selected city, uploaded resumes, CV-builder inputs and outputs, screening answers, cover letters, application details, submission/draft state and employer status updates. You choose much of this information.

Activity and preference data: saved jobs, job-alert settings, generated notification events, CV-builder allowances and usage, relevant organization/team administration and audit records.

Payment data: plan/credit purchases, amounts, currency, payment references, provider confirmation and billing status. Complete card or mobile-wallet credentials should be entered only in the payment provider's authorized checkout, not in support messages or resumes.

Technical and support data: IP address and request/security metadata used by the service, timestamps, request identifiers, errors, and correspondence or attachments you send when seeking help. Avoid including unnecessary personal data in screenshots.

3. Where information comes from

We receive information directly from you, from an organization administrator creating a team account, from employers updating applications, and from service providers confirming a transaction or handling a feature you request. Public listings may contain publicly available organization/contact information from their source.

If someone submits information about you without permission, contact support with the relevant account or listing reference. We may need to verify the request before disclosing, changing or deleting data.

4. Why we use information

We use data to create and secure accounts, verify mailbox ownership, recover access, display jobs and profiles, save preferences, deliver chosen applications and documents to employers, show status updates, generate requested CV content and administer purchased features.

We also use appropriate records to answer support requests, prevent fraud and abuse, enforce access permissions and service terms, diagnose errors, resolve payment disputes and meet applicable obligations. We do not sell your personal data.

Depending on the activity and applicable law, processing is connected to providing the service you request, taking steps at your request, complying with legal duties, protecting the service and users, or consent where required. Optional features can be avoided or disabled as described below. Acceptance of Terms is not a blanket waiver of privacy rights.

5. Applications, documents and employer access

Submitting an application makes its content and resume available to authorized users of the receiving employer. Your resume may include contact details and sensitive information you chose to include. Review the document before sending it. Do not assume a draft has been submitted or that saving a job sends any information to the employer.

Changing your profile or current resume does not change application snapshots already submitted. Removing the profile selection is not physical erasure of all copies. Employers may download documents and retain separate recruitment records; Sira cannot remotely erase copies outside its control.

Uploaded documents have retrieval links used by platform workflows. Do not treat a resume link as a private secret-sharing channel or distribute it unnecessarily. Do not upload highly sensitive documents that are not needed for recruitment.

6. AI-assisted CV processing

When you actively request a CV generation or revision, the CV text, relevant job details and instructions needed for that request may be sent to Sira's configured AI provider. The current integration supports OpenAI or Azure-hosted OpenAI services; which provider is active depends on deployment. Ask support if you need the current provider before using the feature.

We store requested drafts/results and usage information to deliver editing, export, revision allowances and support. Provider handling and retention are governed by the service configuration and applicable provider terms. We do not promise zero retention or that a provider never uses submitted data beyond processing unless that has been separately confirmed.

You can choose not to use AI features and upload your own resume instead. Remove unnecessary personal identifiers and confidential third-party information before requesting AI processing. Review outputs for errors and unsupported claims.

7. Service providers and other disclosures

Providers may process information needed for hosting, databases, document storage, SMTP account emails, AI requests and payment processing. Production document storage supports Azure Blob Storage. Payment options and providers are those actually offered at checkout, including Chapa when enabled.

Authorized platform staff may access appropriate account, job, billing and support information for administration, safety and support. Access is role-dependent; a staff role is not permission for unrelated use of personal information.

We may disclose necessary information when required by law, to respond to a lawful request, protect users or the platform, investigate fraud, or resolve a dispute. If the service is reorganized or transferred, applicable privacy obligations and required notices still apply.

8. Cookies, device storage and permissions

The employer/admin web portal uses an HTTP-only authentication cookie and stores a language preference in browser local storage. The seeker app uses secure-storage APIs for its access token and preferences for language; behavior and protection depend on the device/browser platform. These are used for sign-in and preferences, not advertising identifiers.

Signing out removes the app's active session state; an issued token may remain valid until its expiry or another applicable server-side restriction. Shared devices should be locked and protected. Clearing app/browser storage may sign you out or reset preferences but does not delete your server account.

Resume selection uses the device's document picker. The current seeker app does not request camera, microphone, contacts or location access to provide its core features. Selecting a city is a profile choice, not a request for precise device location. We do not use advertising identifiers for advertising in the current app.

9. Retention, removal and deletion

We retain information for as long as reasonably needed to operate the relevant service, support an active account, maintain recruitment/payment records, investigate abuse, resolve disputes and meet applicable legal obligations. Different records can have different retention needs; not every record is deleted at the same time.

Removing or replacing the current resume only changes the current profile reference. Previously submitted copies, generated drafts and stored documents may still exist. Signing out, disabling alerts or uninstalling the app is not account deletion.

To request account deletion, follow the linked account-deletion instructions: email support from your registered address with the subject 'Sira account deletion request'. The published process is to verify ownership and delete or de-identify associated account data within 30 days, subject to stated security, dispute and legal exceptions. Contact support if you cannot use your registered email.

Backups and records needed for security, disputes or legal compliance may not disappear immediately with a live-account change. Employers and third-party sites may hold copies under their own responsibilities. Ask support to explain any retention exception applicable to your request.

10. Your choices and requests

You can edit supported profile fields, replace/remove your current resume, manage saved jobs and job-alert preferences, or avoid optional AI processing. Your verified email is read-only in the current profile form; contact support about changing it so ownership can be checked.

Subject to applicable law, you may request access to personal information, correction, deletion, information about recipients/retention, or restriction/objection to particular processing. Where processing relies on consent, you may ask to withdraw it for future processing. Some requests may require identity checks, legal review or limits needed to protect other people.

Explain what you want and identify your account without sending secrets. We will consider your request and explain relevant limitations. You may also raise a concern with a competent authority or seek an available legal remedy; contacting support does not remove those rights.

11. Security and international processing

Controls include password hashing, expiring verification/reset codes, authentication, role-based access and production HTTPS configuration. No storage or transmission method is completely secure. Protect your device and email account and report suspected exposure promptly.

Hosting, storage, AI and other providers may process data outside Ethiopia. Locations depend on the deployed services and their regions. Where applicable, cross-border processing must follow required legal safeguards; contact support for information relevant to a particular service. This Policy does not promise that all data stays in one country.

12. Children, external services and policy changes

Sira is not designed to collect information from children who cannot lawfully use the service. If you believe a child has provided data inappropriately, contact support so we can review it.

External application sites and payment destinations are not controlled by this Policy. Read their notices before sharing information. We update this Policy as features or practices change and identify the version date. The app bundles an offline copy; its displayed version may be older than the latest public web copy until the app is updated.