Privacy policy

Controller

The data controller is the site provider:

• — PromptWork · Licence 28 710293 834
• — Emiratos Árabes Unidos
• — Rights and questions: hola@promptworkai.app

What we process

Only what you enter or what your use of the service generates:

• — Account: email, name (optional) and password. The password is stored as a bcrypt hash; nobody can read it.
• — Data pack: what you fill in so the operator never invents anything: identity, contact details, address, visa and right-to-work status, education and grades, languages, tools, salary bands, notice period, allowed documents, banned firms and, if you paste it, your CV text.
• — Desk activity: jobs you save, applications you log with their confirmation line, notes, letters and follow-up.
• — Payment: Stripe customer and session identifiers, amount, currency, status and date. Card numbers are handled by Stripe; we never see or store them.
• — Technical: session cookie, language cookie, IP address and server logs for as long as the hosting provider keeps them for security.

Why, and on what basis

• — To provide the service you bought (account, pack, base, downloads, follow-up): performance of a contract (PDPL Art. 4; GDPR Art. 6(1)(b)).
• — To charge you and issue receipts: performance of a contract and tax and accounting obligations (PDPL Art. 4; GDPR Art. 6(1)(b) and (c)).
• — Site security and fraud prevention: legitimate interest (PDPL Art. 4; GDPR Art. 6(1)(f)).
• — To answer your questions and requests: legal obligation and legitimate interest.
• — No profiling, no automated decisions with legal effects, no advertising, no selling of data.

What we do NOT store

To leave no doubt, this never reaches our servers:

• — Your card or any bank details: Stripe collects them on its own page and we only receive an identifier and the amount.
• — Your CV PDF, your transcript or any file: the site has no file upload. You attach them yourself, from your machine, on each employer's portal.
• — What you paste or type into Cursor, Claude, ChatGPT or Gemini, or their replies: that happens between your machine and that provider.
• — Your job-portal passwords: the kit forbids giving them to the model and we never ask for them.
• — Your password for this site in clear text: only a bcrypt hash.
• — Browsing data, analytics, advertising profiles or third-party identifiers: there is no such script.
• — Anything you did not type yourself into the pack or the desk. We do not buy, match or enrich data from external sources.

What happens on your machine is not our processing

The kit downloads as a text file that you paste into the AI tool of your choice (Cursor, Claude, ChatGPT, Gemini or another). That file carries your pack. From that point the processing is done by that tool's provider under its own terms and privacy policy, not by us. The same applies to the job portals where you submit applications. Read those policies before pasting the file.

Who has access

We do not share your data with third parties for their own purposes. We use processors who handle it on our behalf under contract:

• — Vercel Inc. (hosting and running the application).
• — The managed PostgreSQL database provider that holds your account, pack and follow-up.
• — Stripe Payments Europe, Ltd. and Stripe, Inc. (payments). Stripe is an independent controller of the payment data you give it on its Checkout page.
• — Public authorities where the law requires it.

International transfers

These providers process data outside the UAE, in the European Union and the United States. The PDPL allows transfers to countries with adequate protection or under contractual safeguards, which is what we have in place with each of them. For EU residents, transfers to the United States rely on the EU–US Data Privacy Framework where the provider is certified and otherwise on standard contractual clauses. You can ask us for a copy of the safeguards.

How long

• — Account, pack and follow-up: as long as your account exists. You can delete packs from the desk at any time, and delete the whole account from the desk whenever you want (no refund): your packs, queue and follow-up are removed and the account is anonymised and made unusable immediately.
• — Payment and invoicing data: for as long as tax and commercial law requires, even after you close the account.
• — Technical logs: for the period the hosting provider applies for security, normally under 90 days.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to hola@promptworkai.app from your account email. We reply within one month. If you believe we have mishandled your data, you can complain to the UAE Data Office, the Emirates' data protection authority, or, if you live in the EU or EEA, to the supervisory authority of your country.

Security

Encrypted connection (TLS), bcrypt-hashed passwords, HttpOnly and SameSite session cookie, restricted Stripe keys with no access to card data. The site loads no analytics or advertising scripts.

Minors

The service is for job seekers aged 18 or over. We do not knowingly process data of minors.

Changes

If we change this policy we update the date on this page. If a change affects how we use data we already hold, we email you before it applies.