Privacy notice

Your data at a glance

You control your career workspace. Optional AI assistance, job alerts and website measurement start off. You can use the editor and exports without optional AI or measurement, download your account data and delete your workspace. We do not sell personal information or share it for cross-context behavioural advertising. We do not submit job applications or provide your CV to employers.

Who this notice covers

Sarookh Technologies L.L.C-FZ, a UAE company licensed by Meydan Free Zone, is the controller of information used to operate Aven. This notice covers website visitors, account holders and people who contact us. Aven’s account and career-processing services are intended for people aged 18 or older who can legally enter a contract. We ask for an adult self-declaration before uploads or new personal processing and record the account choice. This is not independent age verification; we do not collect an identity document or date of birth for this check. Do not submit a child’s information. If you believe we hold a child’s data, contact our privacy address so we can investigate and arrange appropriate removal.

What we collect and where it comes from

• Account information: your email, sign-in details and name if supplied. Supabase handles authentication. If you choose an available external sign-in provider, it supplies the account information you authorize.
• Career content: CVs, experience, qualifications, skills, preferences, saved vacancies, cover letters, interview answers, application notes, document versions and writing samples you choose to provide.
• Payments and support: order identifiers, pass status, payment and refund status, limited billing details and correspondence. Stripe receives payment details directly; Aven does not receive your full card number or security code.
• Service records: request times, feature and model usage, costs, security counters, consent choices and technical errors. Hosting and authentication providers may receive IP addresses, browser information and request metadata when you connect.
• Optional measurement: page categories, completed steps, device-size category, performance measurements, a random session identifier and campaign labels. These events exclude CVs, job descriptions and typed answers. With the same optional measurement choice, we record visible recommendations, opens, saves, dismissals with fixed reason categories and self-reported applications, together with the listing identifier, source, country, matching-version identifier and evidence-fit score. This helps us assess recommendation usefulness; it does not automatically change your qualifications or decide hiring eligibility.
• Job information: public job postings, employer sources and search results, including any contact information already present in a posting. Coverage and freshness vary.

Please omit identity documents, banking details, health information, beliefs and other sensitive or third-party information unnecessary for your application. Such information can appear in free text even though Aven does not ask for it. Do not include confidential information you are not entitled to share.

Uploads, voice and AI

CV-import PDF and Word uploads are processed to extract text; Aven does not persist those original import-file bytes. Supporting documents explicitly added to an application pack are different: their original bytes are saved privately in Supabase storage until you remove them or delete the application/account. They are not sent to AI, employers or job-feed providers. Scan recognition runs on Aven’s server. Extracted text can be saved in your career workspace. Optional AI organization sends the CV text you approve to OpenAI, including information within that text.

When you request and permit AI assistance, OpenAI receives the content needed for that task: career evidence, relevant CV or job text, writing instructions or interview answers. Structured personal contact fields are omitted from application preparation and interview coaching requests. Before a text AI request proceeds, Aven shows a minimized copy for your approval, removing recognizable contact details and some explicitly labelled sensitive information. Automatic removal can miss details, including names or sensitive facts in free text. You can cancel and edit the source before sending. Job discovery sends your role, skills, location and search preferences and relevant job-feedback labels, rather than your full CV or contact fields; search queries may be shared through OpenAI’s web-search service.

Voice transcription sends your recording to OpenAI after you review it and explicitly confirm sharing. Audio cannot be automatically redacted before transcription. Aven does not persist the recording; you may save the resulting text. Text answers are available instead. OpenAI API response storage is disabled in Aven’s requests. This is not zero retention: provider security and abuse-monitoring rules still apply. OpenAI states that API data is not used to train its models by default. See its API data controls. Aven does not use your career content to train its own foundation model.

Account settings let you withdraw remembered AI permission. You can also decline individual requests. This stops future optional processing; it does not recall information already processed by a provider or automatically remove saved documents. Contact us about deletion of provider-held information. Versioned records of new account acceptance and authenticated AI/privacy choices help us demonstrate what was requested.

Why we process information and the legal grounds

• Providing the service you request: creating an account, saving and exporting documents, managing passes and necessary service/security communications. Under the UAE Personal Data Protection Law, necessary processing to enter or perform our agreement relies on the contractual exception.
• Optional activities: AI assistance, Careerjet searches, opportunity emails and non-essential measurement rely on your separate choices and consent. Refusing measurement or alerts does not prevent use of the basic workspace. AI features cannot run without the information needed for that requested task.
• Legal obligations and claims: tax and accounting records, lawful requests and establishing or defending legal claims, where the applicable law permits or requires this processing.
• Service security: necessary access controls, fraud prevention and abuse limits support performance of our service and applicable legal duties. Where EU/UK law applies, we may also rely on our legitimate interest in protecting users and the service, balanced against your rights. We do not treat this as a general-purpose UAE legal basis.

We do not treat acceptance of the terms as consent to every data use. If we need to use information for a materially different purpose, we will provide the required notice and obtain a new lawful basis or consent where required.

Who receives information and international processing

Access is limited to authorized personnel and providers for service delivery, support, security and legal requirements. Our providers include:

• Vercel: website hosting, application execution and a private encrypted copy of the minimal account-deletion ledger used during recovery. The configured application and archive region is Frankfurt; delivery, security and support infrastructure can operate elsewhere.
• Supabase: authentication and our primary database in Frankfurt, Germany.
• OpenAI: the optional AI and transcription tasks described above. Aven uses the standard API configuration and does not promise UAE-only or EU-only AI processing.
• Stripe: hosted checkout, payment processing, fraud prevention, receipts and refunds. Stripe also acts as an independent controller for some payment and regulatory activities under its privacy policy.
• Resend: account, opportunity and operational support email delivery, receiving the address, message content and delivery events. Staff support alerts contain a protected request link, not the customer's message or CV.
• Google Workspace: support and business email correspondence, and restricted Google Drive storage of an encrypted recovery package containing service configuration and the minimal account-deletion ledger. The decryption key is kept outside that Drive folder; the package does not include CVs or the workspace database.

Providers and their subprocessors may process data in the United States and other countries, and authorized support may access it from outside Germany or your home country. A German database does not mean all processing stays in Germany. Provider agreements and applicable transfer rules govern this processing; EU/UK transfers may involve standard contractual clauses or other legally available mechanisms. UAE and other countries’ transfer requirements must also be met. Contact privacy@avencareer.com for the countries, recipients and safeguards relevant to your data, or to request a copy of an applicable safeguard.

If you connect an external assistant such as ChatGPT, the information you request through that integration is also handled by that service under its own terms. You can disconnect authorized integrations in Settings. Opening a job-posting link takes you to a separate website. We may disclose information when legally required or necessary for a permitted legal claim; we assess the request and disclose only what is appropriate.

Automatic job recommendations

Aven can retrieve public remote vacancies from Jobicy on a schedule. This sends server requests to Jobicy, without your CV, account email, browser IP or matching profile. Aven compares vacancies with your confirmed career record inside its own services. Opportunity emails are optional and use your verified account address. Listings retain their source link and geographic eligibility; remote does not mean available in every country.

Optional Careerjet searches

When available, live job search is separate from AI discovery. Before searching, you choose whether to share your search filters, IP address, browser user-agent information and the Aven jobs-page address with Careerjet. Our server sends these required details only when you request a search or another result page. We do not send your CV, career record, name, email or account identifier to Careerjet. Avoid including personal or sensitive information in search keywords.

Careerjet returns job excerpts and referral links. Provisional matching runs in your browser against your career record; an excerpt may omit important requirements. Aven does not save these results to your account or browser storage. Unchecking the page’s search permission clears the displayed results; your browser may retain an open page in memory. Aven does not add them to its shared catalogue or use them for scheduled emails. We keep a versioned consent receipt and usage counters, without storing the search filters or results in those records. You can decline future searches at any time.

Careerjet handles the information it receives under its privacy policy, including processing outside your country. Its published policy does not specify a fixed retention period for these API request details; Aven cannot promise immediate deletion by Careerjet. Opening a result sends you through Careerjet’s referral service to a separate website, where its own privacy and cookie practices apply. Where a fixed-IP connection is used, Fixie carries an encrypted tunnel between Aven’s server and Careerjet. It receives server connection metadata, such as the server IP, destination and timing; the CV is not part of that request. See Fixie’s security and retention information.

Browser companion

If you install Aven’s browser companion, opening its popup reads the current tab’s title and URL. Clicking “Review this job in Aven” sends that selected URL to Aven’s job-import screen. The companion does not collect background browsing history, cookies or page contents, and does not apply for jobs. Some common tracking parameters are removed; other URL parameters needed by the posting may remain. Review the selected page before sharing. Importing a posting and using AI are separate actions in Aven.

Job recommendations and your control

Aven compares your stated skills, confirmed experience, role requirements and chosen location, seniority and work preferences to rank opportunities. Missing evidence, uncertain requirements and filters affect the score. These automated assessments personalize your workspace; a score is not a hiring probability or a decision about employment, legal eligibility or access to a job.

You choose whether to use a recommendation or apply. Correct your career record and filters to change the inputs. You can ask support for a human explanation or challenge an inaccurate recommendation. Aven does not infer protected characteristics to rank you and does not make hiring decisions for employers.

Opportunity emails require opt-in and include an unsubscribe link. You can change frequency, pause or disable them in your workspace. Delivery, bounce and complaint events are processed to avoid repeated unwanted or undeliverable messages. Account-security and purchased-service messages are separate from optional alerts.

Cookies and browser storage

• Pricing preference: we use a country-level location supplied by our hosting provider to suggest a payment currency; we do not request your precise device location. If you choose a currency, browser local storage remembers it for up to 30 days. Aven requests exchange rates on its server without sending the rate provider your IP, country, CV or account details.
• Adult eligibility: aven_adult_eligibility stores a signed yes/no declaration for up to 30 days. Account declarations are retained with your preferences until account deletion.
• Sign-in cookies: Supabase session and refresh cookies maintain authenticated access until they expire, are cleared or the session is revoked. They are necessary for your account.
• Temporary handoff cookies: aven_signin_draft lasts up to two hours; aven_legal_acceptance lasts up to 24 hours during external sign-in and is cleared after processing.
• Privacy choice: aven_measurement remembers your yes/no choice for up to 180 days. With permission, aven_measurement_session lasts up to 30 days and may be renewed during visits.
• Browser drafts: sign-in drafts expire after two hours. Workspace recovery drafts use browser session storage until saved, cleared or the browser session ends. Avoid shared devices for private career information.

Use “Privacy choices” to withdraw optional measurement and remove the current measurement session’s events and purchase attribution. We also treat a browser Global Privacy Control signal as a request to keep this measurement off. Stripe’s hosted checkout has its own necessary payment and fraud-prevention technologies.

Retention and deletion

• Operational safeguards: minimal staff-access records and a hashed account-deletion ledger are kept for up to one year plus scheduled cleanup; unresolved deletion requests remain until resolved. They contain no CV text or message bodies and help investigate access and reapply deletions after a restore. The latest encrypted ledger copy is stored separately from the database and replaced on the next successful archive run; Aven does not keep a history of these archive copies.
• Saved workspace: career records, documents, versions and preferences remain until you remove them or delete the account. Closing a browser or letting a pass expire does not delete them.
• Sign-in handoff: encrypted copies expire after two hours and are deleted after restoration or scheduled cleanup, which runs every ten minutes.
• AI recovery: temporary preparation results are kept for up to seven days, plus the next scheduled cleanup. Saved application documents remain part of your workspace.
• Measurement: raw events and purchase attribution are removed after 90 days by daily cleanup, or earlier through the applicable deletion/withdrawal controls.
• Security counters: expired rate-limit records are removed after one day plus the next hourly cleanup. Account-linked counters are also removed during account deletion.
• Consent evidence: optional account-consent receipts are kept for one year plus the next hourly cleanup. Account-terms acceptance records remain for the account’s lifetime. Both are deleted with the account.
• AI cost ledger: feature, model, time, usage and estimated cost records contain no CV, prompt or recording. They support usage limits and cumulative spending controls. Account deletion replaces the stable account link with a random reference; individual de-linked cost entries remain while those cumulative controls are needed. They are not described as fully anonymous aggregates.
• Payment, support, logs and backups: provider-held records are separate from the workspace. Legal tax/accounting and dispute records may survive deletion for applicable retention periods. Support correspondence is retained to resolve your request and any necessary related claim; ask us to review it for erasure. Infrastructure logs and restricted backups expire under the provider’s applicable schedule. If a backup is restored, deletion requests must be reapplied.

Deletion removes active Aven career data, document history, preferences, account-consent records, alert subscriptions and the local billing copy. Stripe and other providers may retain records under their own legal duties. Deletion does not itself issue a refund. We will explain any legally necessary exception to an erasure request.

Security

We use encrypted transport, provider-managed storage protection, account authentication, owner-restricted database access, server-side secret handling and signed payment/email webhooks. Encrypted temporary handoffs and limits on optional processing reduce exposure. No system can guarantee absolute security. Report a suspected problem to privacy@avencareer.com without sending passwords or payment credentials. We investigate incidents and make notifications required by the laws that apply.

Application packs and submission history

Application packs combine the saved CV, cover letter, answers and professional supporting files you select. Downloading or recording a pack does not send an application. Submission history preserves the exact saved content, attachment names and checksums, date, channel and notes. Later edits do not change this history. Removing a supporting file removes its bytes; historical records retain its name and checksum until the application or account is deleted. Files are private and downloaded through an authenticated owner-only route. Interrupted file removal is retried by scheduled cleanup; contact privacy support if removal is not complete. Structured account exports include the attachment manifest and submission records; download supporting files individually before deleting your account.

Your rights and requests

Settings provides profile correction, a structured data export, integration disconnection and permanent workspace deletion. You can also email privacy@avencareer.com for access, correction, erasure, restriction, portability, withdrawal, objection to permitted processing or a human review of automated assessments, as provided by applicable law. You need not pay for ordinary requests. We use proportionate identity checks and do not routinely request identity documents. We will explain any lawful refusal, limitation, fee or extension and the available complaint route.

Our operational target is to acknowledge requests within seven days and respond within 30 days. Where applicable law sets a different or shorter deadline, it takes priority; EU/UK GDPR requests generally require a response within one month. Extensions require a lawful reason and notice. Withdrawing consent does not make earlier lawful processing unlawful.

You may complain to the UAE Data Office or the competent UAE authority, and to your local authority where applicable—for example an EEA supervisory authority, the UK Information Commissioner or Saudi Arabia’s SDAIA. California rights, where the law applies, include access, deletion, correction and applicable opt-out rights without unlawful discrimination; an authorized agent may submit a request subject to verification. These examples do not limit rights elsewhere.

Changes to this notice

The date and version identify the notice in effect. We will explain material changes through the website or appropriate account communications, and seek renewed consent when required. An update does not retrospectively authorize a new use of your information.

Operator and contact details

Sarookh Technologies L.L.C-FZ
Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
Licence: 2423989.01 · Meydan Free Zone
UAE VAT registration: 104751904400001

Privacy and data rights: privacy@avencareer.com
Support and complaints: support@avencareer.com
Payments and refunds: billing@avencareer.com

Read our terms · Privacy & trust overview

Version: 2026-10-11.privacy-8