What Siraty collects, why, who it is shared with, and how the Google permissions of auto apply are used.
1. About this policy
Siraty is an online platform that helps you build a resume, write a cover letter, check your resume against applicant tracking systems, find job posts, and apply to them. This policy explains what information Siraty collects, why it is collected, where it is stored, who it is shared with, how long it is kept, and the choices you have. It covers the Siraty website, the Siraty dashboard, and every feature inside them, including the auto apply feature that connects to your Google account. Please read section 5 and section 6 carefully if you use auto apply.
2. Who we are and how to reach us
Siraty is operated from the Kingdom of Saudi Arabia and is the party responsible for the personal data described here. You can reach us at any time through the contact page on this website, whether you want to ask a question, request a copy of your data, correct it, or have it deleted. We reply to every privacy request.
3. Information you give us
You give us this information directly while you use Siraty.
- Account details: your first name, your last name, your email address, and your password, which is stored only as a salted hash and is never readable by us.
- Resume content: everything you type into a resume, such as your work history, your education, your skills, your languages, your courses, your projects, your interests, your links, and any photo you upload.
- Cover letter content: the cover letters you write or generate, together with the company name, the job title, and the job description you paste in.
- Uploaded files: any PDF or Word resume you upload so Siraty can read it and turn it into an editable resume.
- Subscription details: the plan you chose and the payment reference returned by the payment gateway. Your card number is entered on the gateway and never reaches Siraty.
- Messages: anything you write to us through the contact form, including your name, your email address, and your message.
4. Information we collect automatically
Some information is collected by the service itself as it runs.
- Technical data such as your internet address, your browser, and the pages you opened, written to server logs so we can keep Siraty secure and diagnose problems.
- A sign in cookie that keeps you signed in, and a language cookie that remembers whether you read Siraty in Arabic or in English.
- Usage records of the features you ran, so we can apply the credits and the limits of your plan correctly.
5. Google account data and the auto apply feature
Auto apply is optional and is switched off by default. Siraty touches no Google data until you connect your Google account yourself and approve the permissions on Google’s own consent screen. This is exactly what Siraty asks for, and exactly what it does with it.
- Permission to send email on your behalf, the scope gmail.send. Siraty uses it for one purpose only, which is to send a job application from your own email address to the employer of a job you chose to apply to. Each message carries your resume as a PDF attachment and your general cover letter as the body.
- Your email address, the scope userinfo.email. Siraty uses it to show you which mailbox is connected and to set it as the sender of your applications.
- Your basic profile, the scope userinfo.profile. Siraty uses your name and your profile picture only to display the connected account in your dashboard, so you can confirm it is the right one.
- Siraty never reads, searches, downloads, prints, deletes, or modifies any message in your mailbox. The gmail.send permission gives no access to your existing emails, and Siraty requests no other Gmail permission.
- Siraty stores your Google access token and refresh token in encrypted form, together with your email address, your name, and the address of your profile picture. Nothing else from your Google account is stored.
- No employee of Siraty reads your Google account data. It is processed automatically and only to run the auto apply feature you switched on.
- Google user data is never used to create, train, or improve any artificial intelligence or machine learning model.
- Google user data is never sold, rented, traded, or shared with any advertiser, any data broker, or any other outside party.
- You can disconnect your Google account at any time from the find a job page in your dashboard, and you can also remove Siraty from the permissions page of your Google account at myaccount.google.com/permissions. When you disconnect, Siraty asks Google to revoke the tokens, deletes them from its database, and can no longer send anything from your address.
6. Limited use of Google user data
Siraty’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain words, the information Siraty receives from Google is used only to provide the auto apply feature that is visible in your dashboard, it is never used for advertising, for profiling, for credit decisions, or for training models, it is never transferred to anyone except as needed to send the application you asked for or as the law requires, and no human reads it.
7. Your permission to send emails on your behalf
When you switch auto apply on, you are giving Siraty your permission to send emails from your connected mailbox on your behalf. Those emails are job applications, addressed to the employers of the jobs published on Siraty, using the application address that the employer wrote in the job post. Every message Siraty sends for you is recorded in your account, so there is always a record of what was sent, to whom, and when. This permission stays in force until you turn auto apply off, disconnect your Google account, or delete your Siraty account, and you can withdraw it at any moment.
8. How we use your information
We use the information described above only for the purposes below.
- To create your account, sign you in, verify your email address, and let you reset your password.
- To save your resumes and cover letters and show them back to you on any device.
- To render the template you picked and produce your resume as a PDF file.
- To run the ATS checks and the artificial intelligence features you ask for.
- To show you job posts that match the filters you choose.
- To send your job applications when you switch auto apply on.
- To manage your plan, your credits, your payments, and your invoices.
- To answer your messages and send the emails your account needs, such as verification and password reset.
- To keep Siraty secure, prevent abuse, and meet our legal obligations.
9. Artificial intelligence processing
Some Siraty features are powered by artificial intelligence models provided by Anthropic. When you press the button for one of these features, the text you are working on is sent to the provider, processed, and returned to you. These features are reading an uploaded resume, enhancing a field, optimizing a resume for a job description, extracting keywords from a job description, generating a cover letter, and turning a cover letter into a general one.
- Only the text the feature needs is sent. Your password, your payment details, and your Google account data are never sent to any artificial intelligence provider.
- Under our agreement with the provider, the text is used only to produce your result and is not used to train the provider’s models.
- Nothing is sent to a model unless you ask for that feature, so you stay in control.
10. Payments
Payments are processed by Moyasar, a payment gateway licensed in the Kingdom of Saudi Arabia, which supports mada, Visa, Mastercard, American Express, and UnionPay. Your card details are entered directly on the gateway and are never seen, transmitted, or stored by Siraty. Siraty keeps only the payment reference, the amount, the currency, the status, and the plan you bought, so your subscription and your invoices stay correct.
11. Cookies
Siraty uses the smallest number of cookies it can.
- A session cookie that holds your sign in token. It is httpOnly, which means the JavaScript in your browser cannot read it, and it expires after thirty days.
- A language cookie that remembers whether you read Siraty in Arabic or in English.
- We use no advertising cookies, and we do not track you across other websites.
12. How we share information
We do not sell your data, we do not rent it, we do not trade it, and we do not share your personal information, your resume content, or your Google account data with any outside party for that party’s own purposes. The only companies that touch your data are the service providers that run parts of Siraty for us. They act on our instructions, they receive only the minimum they need, they may use the data solely to deliver their service to us, and they may not use it for anything else.
- Hosting: the server that runs Siraty and holds its database.
- Google: only when you connect your Google account, and only to send the applications you asked for.
- Anthropic: the artificial intelligence provider behind the features listed in section 9.
- Moyasar: the payment gateway that processes your subscription payments.
- PigDF: the service that turns your rendered resume into a PDF file.
- Email delivery: the mail server that sends account emails such as verification and password reset.
- We may also disclose information when the law requires it, when a competent authority orders it, or when it is needed to protect the rights, the property, or the safety of Siraty and its users.
13. Where your data is processed
Siraty stores your account and your content on its own servers. Some of the providers listed in section 12 process data outside the Kingdom of Saudi Arabia. When that happens we send only the minimum the provider needs, and we work with providers that commit to protecting the data with appropriate safeguards and to using it only on our instructions.
14. Security
We protect your information with measures that match how sensitive it is.
- All traffic between your browser and Siraty travels over HTTPS.
- Passwords are stored as salted hashes, never in a readable form.
- Sign in tokens are stored as hashes, expire after thirty days, and stop working the moment you sign out.
- Google access tokens and refresh tokens are encrypted before they are written to the database.
- Access to the production servers is limited to the people who operate the service.
- No system can be perfectly secure, so please choose a strong password, keep it private, and tell us at once if anything looks wrong with your account.
15. How long we keep your data
We keep each kind of data only as long as it is needed.
- Your account, your resumes, and your cover letters are kept while your account exists.
- Google tokens are revoked and deleted as soon as you disconnect your Google account.
- Records of the applications sent for you are kept so you have a history of what was sent in your name.
- Payment and subscription records are kept for as long as accounting and tax rules require.
- Server logs are kept for a short period and then removed.
16. Deleting your data
You are in control of your data at every moment.
- Delete a resume or a cover letter at any time from your dashboard, and it is removed from your account.
- Disconnect your Google account at any time, which revokes and deletes the stored tokens immediately and leaves the rest of your account untouched.
- Delete your whole account from the account page. Deleting signs you out everywhere, releases your email address so it can be used again, and closes the account permanently so nobody can reach it or its content.
- If you want everything you ever stored to be erased completely, contact us and we will erase it and confirm it to you.
17. Your rights
Under the Personal Data Protection Law of the Kingdom of Saudi Arabia, and under similar laws where they apply to you, you have the rights below. Use them by contacting us or through your dashboard, free of charge.
- The right to know what data we hold about you and why.
- The right to get a copy of your data in a readable form.
- The right to correct anything that is wrong or incomplete.
- The right to have your data deleted.
- The right to withdraw a consent you gave, such as the Google permission for auto apply, at any time.
- The right to object to a particular use of your data or to ask us to restrict it.
- The right to complain to the competent supervisory authority if you believe we handled your data wrongly.
18. Children
Siraty is made for people who are looking for work and is not directed at children. We do not knowingly collect data from anyone under sixteen years old. If you believe a child has given us personal data, contact us and we will delete it.
19. Changes to this policy
We may update this policy as Siraty grows or as the law changes. The date at the top of this page always shows the last update. When a change is significant, we will tell you inside the service or by email before it takes effect, and where the law requires it we will ask for your consent again. We will never use data we already collected in a new way without telling you first.
20. Contact us
For any question about this policy, about the data we hold, or about the Google permissions used by auto apply, reach us through the contact page on this website and we will reply.
Siraty