Privacy Policy

Tafseel is operated from Cairo, Egypt. The product is an AI career copilot for job seekers — see tafseel.xyzfor what it does. When this document says “Tafseel,” “we,” or “us,” it means the people running the service.

Contact for any privacy question: hi@tafseel.xyz.

When you create an account and use Tafseel, the following data lives on our infrastructure:

• Account data. Email address (via Supabase Auth, which is the system that signs you in). If you sign in with Google, your Google email and profile name.
• CV content. The PDFs, text, or structured CV data you upload to your profile. Stored encrypted at rest on Supabase Postgres.
• Application data. Roles you save, application statuses, notes, follow-up dates, and timeline events you create on the tracker.
• Tailored CV history. Each version of your CV that Tafseel tailored against a specific job description.
• Telemetry events. Anonymous-ish event records (page viewed, CV tailored, application saved, status changed) used to understand whether the product is working — not used to identify you. See “Analytics” below.
• Email-delivery state. Whether and when notifications we sent you were delivered. Email content itself is generated on the fly and not retained beyond delivery.

Data we explicitly do not collect or store:

• Your AI provider API key. The key you paste into Tafseel (Ollama Cloud, OpenAI, etc.) lives in your browser's localStorage only. It is never sent to our servers, never logged, never proxied through our infrastructure. We literally cannot see it.
• Payment cards. The free plan doesn't need a card. If and when paid plans launch, payments will be handled by a third-party processor (Stripe or similar) — they hold the card data, not us.
• Browsing history outside Tafseel. We don't track what you do on other sites.

To run the product. Specifically:

• To authenticate you and keep you signed in.
• To save and restore your CV, applications, and tracker state across sessions and devices.
• To rank job postings by similarity to your CV, using vector embeddings computed on our servers.
• To send the notification emails you signed up for — daily nudges on stale applications, weekly digests, follow-up reminders. You can turn these off in settings or one-click-unsubscribe from any email.
• To measure whether the product is working (e.g. “does tailoring help people get to applied faster?”) using aggregated telemetry.

That's it. We don't use your data to build a profile for advertising, share it with employers, or train AI models.

When you click “Tailor,” Tafseel sends a prompt containing your CV plus the target job description to the AI provider whose key you brought (Ollama Cloud, OpenAI, etc.). What the provider does with that prompt is governed by theirprivacy policy, not ours. Most major providers (including Ollama and OpenAI's API tier) state they do not train on API-submitted data; you should verify the specific policy for the provider you choose.

Tafseel does not store the prompt-and-response exchange beyond what's needed to render the tailored result on your screen and save the resulting CV version to your account.

Tafseel uses a small number of third-party services to operate. Each one sees only the slice of data they need:

• Supabase — auth (email + session tokens) and database (your CV + applications). EU/US infrastructure. privacy policy.
• Vercel — hosting + analytics. Sees anonymised page views; no personal data. privacy policy.
• Resend — transactional email delivery. Sees your email address and the email content we generate for you. privacy policy.
• Your AI provider — whichever you bring (Ollama Cloud, OpenAI, etc.). Sees the CV + JD at tailoring time, per the boundary above.

We do not sell your data, share it with recruiters or employers, share it with advertisers, or use it for any purpose other than operating Tafseel.

Tafseel uses cookies and browser storage only for things the product needs to function:

• Supabase auth cookies — keep you signed in across sessions. Strictly necessary.
• localStorage — stores your AI provider key locally in your browser (so it never reaches our servers) and remembers UI state like “dashboard sort order.”
• Vercel Analytics — anonymous page-view counts. No tracking identifiers tied to you personally.

We do not use third-party advertising cookies, retargeting pixels, or social-media trackers.

Whether or not you're in a jurisdiction with formal data-protection laws, Tafseel honours these rights:

• Access. You can see all data Tafseel holds about you from inside the app (your profile, applications, tracker, settings).
• Export. Email hi@tafseel.xyz and we'll send you a JSON export of your full account within 7 days. A self-serve export button is on the roadmap.
• Delete. Delete your account from settings — it removes your profile, applications, tracker, notes, and all telemetry tied to you, within 30 days. Backups expire on the same window.
• Correct. All your data is directly editable from inside the app.
• Object / restrict. Email us if you want to limit how we process your data without deleting the account outright.

Tafseel is built for working-age job seekers. We don't knowingly collect data from anyone under 16. If you believe we've received data from a minor, contact us at hi@tafseel.xyzand we'll delete it.

Tafseel is operated from Egypt, but the infrastructure providers we use (Supabase, Vercel, Resend) operate from the United States and the EU. Using Tafseel means your data may be processed in those jurisdictions, subject to the providers' own data-protection agreements.

When this policy changes materially, we'll update the “Last updated” date at the top and notify signed-in users by email if the change affects how we handle data you've already given us.

Privacy questions, data requests, or concerns: hi@tafseel.xyz. We aim to respond within 7 business days.