Effective date: 1 October 2026. This notice explains personal-data use for ClearToApply CV, cover-letter, LinkedIn, custom website, domain, professional email, hosting and care services. It covers prospective customers, customers and people whose information is supplied for these services. It is a privacy notice, not consent to every use described below.
1. Who controls your information
INFINITE8 - FZE, FZCO, trading as ClearToApply, is responsible for deciding how personal information is used to operate and administer these services. Trade licence: 2665; authority: Dubai Integrated Economic Zones Authority. Address: DSO-OPERATIONS CENTRE-1-A-101-11-10, OPC, Dubai Silicon Oasis, Dubai, United Arab Emirates, OPC, Dubai Silicon Oasis, Dubai, United Arab Emirates.
Send privacy questions or rights requests to support@cleartoapply.com, marking the message “Privacy request”, or use your account support area or our postal address. We route requests to the person responsible for privacy. You do not have to buy a service, remain subscribed or supply an account password to contact us.
2. Information we receive
- Account and contact details: name, email, preferred language, account identifiers, authentication records and information needed to communicate with you.
- Career information: employment and education history, qualifications, skills, target roles, vacancies, achievements, project examples, portfolio links and the facts you choose to include in your documents.
- Project records: uploaded files, rough notes, messages, feedback, draft versions, review decisions, expert assignments, independent-check records and final deliverables.
- Order and payment records: selected services, agreed scope, prices, billing details, transaction references, payment status, refunds and the versions of terms accepted. Card-entry information is handled by the payment provider; do not send card details in workspace messages.
- Digital-service information: requested domain and mailbox names, registrar contact data, approved public content, configuration and activation records, support instructions and technical logs needed for the selected service.
- Technical and preference information: device/browser details, IP address, request and security logs, language preferences, cookie choices and permitted measurement data.
We receive most career information directly from you or an authorised person acting for you. We may receive payment status from your provider and service configuration/status from a selected registrar, host or mailbox provider. If you ask us to use a public professional profile, vacancy or portfolio, we use the relevant source for your project. We do not purchase an undisclosed employment-history profile about you.
3. Information you should not send
A normal CV project does not require passport scans, card details, passwords, one-time codes or extensive medical records. Avoid unnecessary dates of birth, identity numbers, precise home addresses, confidential employer information and third-party contact details. Tell us about a career gap or accommodation need only to the extent relevant and comfortable for you.
Career material can reveal health, disability, ethnicity, religion, political views, union membership or other specially protected information. We do not require these details merely to write a CV. If a requested use needs a separate legal condition or explicit consent, we address it specifically before using the information for that purpose. Uploading a file is not blanket permission to exploit all sensitive details within it. You can ask us to remove unnecessary information.
4. Why we use information
- To discuss and perform your order: agree a scope, organise your information, assign the appropriate people, write and revise your documents, conduct independent checks and deliver the purchased service.
- To operate the workspace: authenticate access, maintain project history, share work with you, record your decisions and resolve support requests.
- To administer payments and obligations: issue and reconcile orders, process refunds, prevent fraud and keep necessary financial and legal records.
- To carry out digital services you select: register or connect your domain, set up your mailbox, host the approved website and provide the agreed care and transfers.
- To protect and improve service operation: diagnose faults, investigate misuse, maintain security and evaluate service performance using the minimum information reasonably needed.
- For optional publication or marketing only under the separate choices described below.
Under applicable data-protection law, the relevant basis is performance of a contract or requested pre-contract steps, compliance with a legal obligation, or consent where required. Where the EU/UK framework applies and permits it, necessary security, fraud prevention, service administration and legal-claim handling may rely on our legitimate interests, balanced against your rights. We do not use that basis as a substitute for consent where the applicable law requires consent. You can ask which basis applies to a particular activity.
5. Your expert team and confidentiality
Assigned experts and independent reviewers access the material needed for their part of your project. Authorised support, payment and administration staff may access information needed to resolve their tasks. Access is governed by role, assignment and purpose, rather than general access for all customers or experts. Relevant contractors must respect confidentiality and data-use restrictions.
We do not send your CV to recruiters, contact your employer or references, update LinkedIn, or submit job applications without a separate clear instruction and appropriate authority. Someone paying for your order does not automatically receive your private messages, documents or mailbox contents.
6. Service providers and other recipients
We use providers in these categories as needed: infrastructure and storage, security and malware scanning, transactional communication, payment processing, and support tooling. If you select digital services, the relevant registrar, registry, website host and mailbox provider receive the data needed for those services. The actual payment provider is identified in checkout; the actual digital providers and relevant service terms are identified before activation. You can request the recipients relevant to your order from our privacy contact.
Providers acting on our instructions must be authorised for the task and subject to appropriate confidentiality, security and data-processing obligations. Payment providers, banks and domain registries may also act as independent controllers for their own legal and regulatory purposes; their notices apply to that separate processing. We share with professional advisers, regulators, courts or law enforcement only where necessary and lawfully justified, and in a genuine business transfer subject to appropriate protections and notice.
We do not sell your career information, provide it to employers for their own recruitment without your instruction, or make it available to other customers. A marketing example requires separate permission.
7. International handling
Our company operates in the UAE. Your information may be accessed there and in the locations used by the providers selected for your service. The countries and protections applicable to a particular provider or order can be requested through our privacy contact; a website's public audience is addressed separately below.
We must establish a lawful transfer basis before a transfer requiring one. Depending on the applicable law, this may require an adequacy decision, approved contractual safeguards and additional measures, or a narrowly applicable statutory exception. This notice does not claim that the UAE has EU/UK adequacy, that every supplier has signed a particular instrument, or that accepting service terms waives transfer protections. You can request information or a copy of relevant safeguards, with genuinely confidential material redacted where lawful.
8. Your public website and professional email
Your private workspace does not become public because you buy Signature. Before launch, you approve the specific website content, files and contact details to be published. Visitors, search engines and recipients may copy or index published information. Removing it from the website cannot guarantee removal from third-party caches or copies; we help with reasonable removal requests within our control.
Domain registration requires accurate registrant information. Disclosure, verification and public directory rules depend on the chosen registrar and registry; we explain the relevant terms before registration and do not promise absolute anonymity. DNS records are generally public. Your branded email address becomes known to people you contact or to visitors if you approve its publication.
Routine mailbox setup and technical care do not authorise staff to read your private emails. Specific troubleshooting access requires your instruction or another lawful necessary basis and is limited to the task. A website collecting visitor information or using tracking needs the corresponding privacy, consent and security arrangements agreed before those features are enabled; the basic personal-portfolio service does not silently add a mailing list or advertising tracker.
9. Automation and AI
Our CV writing and independent-review promises refer to people doing that work. The platform may use technical automation for functions such as validation, document handling, routing, security and payment reconciliation. We do not use your private CV, chats or uploads to train public or general-purpose AI models without a separate, explicit choice. Purchasing a service is not that choice.
We do not make hiring decisions about you. No promised independent human quality review is replaced by an automated score. If a new feature would introduce a solely automated decision with significant effects, it requires a separate lawful assessment and clear information about the decision and applicable safeguards before use.
10. Retention and deletion
Retention depends on the category and its purpose, not a single invented automatic deletion date:
- Workspace material and delivered files are retained while needed for the active project, your account's document access and agreed follow-up, including the 60-day review. Closure or a deletion request triggers a review of what still needs to be kept; we do not promise lifetime storage.
- Order, payment, invoice and accepted-terms records are kept for the applicable accounting, tax, dispute and legal-record periods. We limit these records to what is required instead of retaining every CV attachment merely because an invoice must be kept.
- Security and technical logs are kept for as long as reasonably needed to investigate incidents, prevent abuse and operate the service. A specific incident or legal hold may justify retaining relevant records for longer.
- Domain, website and mailbox data follow the purchased term, necessary transfer/export arrangements and the selected provider's disclosed lifecycle. Ending live hosting is distinct from removing retained administrative records.
When information is no longer necessary and no legal reason requires retention, it should be deleted or irreversibly anonymised. Deletion is a reviewed process, not a promise that clicking a button instantly removes every record or backup. Restricted backup copies may persist until their rotation or lawful removal; they are not available for ordinary service use. If restoration is necessary, applicable deletion restrictions must be reapplied. We explain relevant retention grounds and applicable periods when responding to your request, including any lawful refusal or hold.
11. Your choices and rights
Depending on applicable law, you may request access or a copy, correction, deletion, restriction, portability, information about recipients or transfers, or object to particular processing. Where we rely on consent, you may withdraw it for future processing without affecting the lawfulness of earlier use. Declining optional publication or marketing does not remove the writing service you purchased.
We verify identity and authority proportionately and respond within the applicable legal deadline. Under EU/UK rules this is generally one month, with any permitted extension explained within that initial period. We explain a refusal and the available complaint route. These rights can have lawful exceptions, including necessary financial records, security and legal claims; we do not use them as a blanket reason to refuse deletion.
You may complain to the competent UAE data-protection authority, or to a competent authority in your country where its law applies. EU/EEA residents may approach their national supervisory authority, and UK residents the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. Contacting us first is helpful but not a prerequisite to a legal complaint.
12. Cookies, preferences and measurement
Account security, sessions and essential site functions use necessary cookies or similar storage. The site also records language and consent preferences. Where optional analytics or advertising measurement is offered, the available cookie controls explain the choice; rejecting optional measurement does not prevent buying a CV service. We do not treat privacy-notice acknowledgement as advertising consent.
You can reopen Cookie preferences where provided, change your choices and use browser controls to remove storage. Removing necessary cookies may sign you out or reset preferences. Optional campaign measurement, if enabled, must follow the recorded permission; operational security logs remain distinct from advertising tracking. A customer website has its own approved configuration and does not inherit permission from your ClearToApply account.
13. Security and incidents
We use proportionate access controls and technical and organisational measures to protect information. No website or email system can promise absolute security. Keep credentials private and tell us promptly about suspicious access or accidental sharing. We investigate relevant incidents and notify affected people and authorities where legally required. We will not request your password, card security code or one-time account code in a support conversation.
14. Children, changes and contact
These services are ordered by adults or an authorised adult for a younger applicant. We do not use a child's information for behavioural advertising. A parent or guardian can contact us about an appropriately authorised project, subject to the young person's own applicable privacy rights.
We update this notice when the relevant data practices change and give additional notice or seek consent where required. The effective date identifies this version; a new notice does not retroactively authorise an incompatible use. For any concern, contact support@cleartoapply.com with “Privacy request” in the subject or write to the address in section 1.