تخطَّ إلى المحتوى
وظيفتك علينا
أعلن عن وظيفة

Privacy Policy

Here we explain how we collect, use, and protect your data while you browse the Wazifatuk Alayna platform and use its official mobile apps.

آخر تحديث:

1. Who We Are and the Scope of This Policy

"Wazifatuk Alayna" (referred to as "the Platform" or "we") is a Saudi platform for browsing and applying to jobs, operated by Wazifatuk Alayna (Alayna Electronic Services Office), via the website wdeftksa.com and its official apps on the App Store and Google Play, along with related services such as app.wdeftksa.com, company.wdeftksa.com, cv.wdeftksa.com, a.wdeftksa.com, and pay.wdeftksa.com.

The Platform operates under a Ministry of Commerce permit no. (7032383478), a Ministry of Media license no. (158378), a General Authority for Media Regulation license no. (533421), a registered trademark no. (1443039458), and a Saudi Business Center license no. (0000103713).

This policy takes effect as of 2026-07-04. Our processing of your data is based on the Personal Data Protection Law (PDPL) issued by Royal Decree no. (M/19) of 1443H and its Implementing Regulation, under the supervision of the Saudi Data & AI Authority (SDAIA).

To contact us about privacy or to exercise your rights as a data subject: support@wdeftksa.com.

2. Our Role: A Job Aggregator/Publisher, Not an Employer

"Wazifatuk Alayna" is a platform for aggregating and displaying job listings (from public sources and from publishing entities) and enabling applications to them. We are not the employer, we are not a party to any employment relationship, and we do not guarantee employment or the accuracy of every job listing posted by a third party. Details are set out in the "Terms and Conditions."

We process your data as a controller with respect to your accounts and our services, and we may transfer your application data to the entity publishing the job you apply to, which acts as an independent controller of that data after receiving it.

3. Personal Data We Collect

a) Data collected automatically while browsing

  • IP address, browser type and operating system, date and time of access, pages visited, and the referring source.
  • Marketing attribution identifiers (UTM/click-id) captured from the entry link and stored in cookies to measure the traffic source.

b) Account and job-application data

  • Registration and account: name, email, and mobile number.
  • Job application form: name, email, mobile number, cover letter, and any additional fields the employer defines. This data is transferred to the entity publishing the job.

c) Career-Boost service data

A service to prepare a résumé and professional documents with AI assistance, offered for a fee once payment is activated in production. The intake form collects:

  • Full name, date of birth, nationality, city, mobile number, email, and LinkedIn URL.
  • Educational qualifications (type, major, university or institute, graduation year, GPA, honors, country).
  • Work experience (employer, title, dates, quantified achievements).
  • Technical and soft skills, and language levels.
  • Target field, titles and cities, expected salary range, work type, willingness to travel, and career goals.
  • Your current résumé file and an optional personal photo, stored with our storage provider (Cloudflare R2).

d) Employer and publisher data

Establishment data, team members, billing and wallet, verification, and applicant management, via company.wdeftksa.com.

e) Payment data

When you purchase a paid service (such as Career-Boost), payments are processed via the Moyasar gateway (mada/Visa/Apple Pay). We receive only basic invoice data (name, email, mobile number, invoice number, amount, and 15% VAT). Card data is entered and processed directly at Moyasar and is not stored by us.

f) Notification and device data

Device tokens for sending push notifications, and your subscription preferences for job alerts (email, SMS, push notification, or Telegram).

Note on sensitive categories: your résumé or personal photo may contain data that could be considered sensitive. We do not intentionally request sensitive data (such as health or religious data), and we advise you not to include it. We process only what you voluntarily provide, solely within the purpose of the service.

g) Data collected by the mobile app (iOS / Android) via embedded SDKs

Our app relies on embedded third-party SDKs (software development kits) that collect data for operating the app, analytics, notifications, advertising, and subscriptions. The list below sets out each data category, what it is, its purpose, the legal basis for processing under PDPL, and the party that collects it:

  • Device Advertising Identifier (IDFA on iOS / Advertising ID on Android): The device's unique advertising identifier — Serving personalized ads and measuring their performance. Legal basis: Your explicit consent via the iOS ATT prompt and the UMP consent form, revocable at any time. Collected by: Google AdMob and Firebase.
  • Other Identifiers (Internal User/Device ID): Device token and internal installation identifier — App operation, session linking, notification routing, and analytics. Legal basis: Performance of the service and legitimate interest in platform security, and your consent for marketing notifications. Collected by: Firebase and OneSignal.
  • Advertising Data: Your interaction with ads, such as views, clicks, or measurement — Serving ads and measuring their effectiveness. Legal basis: Your explicit consent, revocable at any time. Collected by: Google AdMob.
  • Usage and Interaction Data: Screens and features browsed within the app and usage patterns — Analytics and improving the user experience. Legal basis: Legitimate interest in aggregate analytics, and your consent when linked to ad personalization. Collected by: Firebase Analytics.
  • Diagnostic Data (Crash / Performance Data): Crash reports, performance data, and app stability — Detecting crashes and improving app stability. Legal basis: Legitimate interest in service safety and security. Collected by: Firebase Crashlytics and Performance.
  • Approximate Location (Coarse Location): Determining your city or region approximately, without precise GPS location — Making the jobs and ads shown to you more relevant. Legal basis: Your explicit consent for ads, in addition to the OS location permission. Collected by: Google AdMob.
  • Purchase History: Record of your in-app subscriptions and purchases and their status — Managing, verifying, and restoring your subscription. Legal basis: Performance of the service you requested. Collected by: RevenueCat.

The app does not collect your precise (GPS) location for these SDKs — only your approximate location. You can adjust location, tracking, and notification permissions at any time from your device's OS settings (see the next section, "Tracking and Advertising in the Mobile App").

4. Legal Bases for Processing (PDPL)

We process your data on one or more of the following bases, depending on the case:

  • Performance of a contract or service you requested (creating an account, applying to a job, delivering the paid Career-Boost service).
  • Your explicit consent (marketing job alerts, non-essential cookies, and personalized ads).
  • Balanced legitimate interest (platform security, fraud prevention, and improving performance and aggregate analytics).
  • Legal obligation (responding to a request from a competent authority in the Kingdom, and tax invoicing obligations).

Consent is revocable at any time without affecting the lawfulness of processing prior to withdrawal.

5. Purposes of Use

  • Operating the Platform and enabling job search and application.
  • Creating and managing your account, and communicating with you about jobs, applications, and inquiries.
  • Delivering paid services (AI-assisted preparation of Career-Boost documents).
  • Sending alerts and newsletters based on your consent, and necessary operational notifications.
  • Processing payments and issuing tax invoices.
  • Security, fraud and abuse prevention, and regulatory compliance.
  • Analytics, performance measurement, improving the experience, and serving ads.

6. Advertising and Data Sharing with Google

The Platform relies on Google ads as a primary revenue channel. We use Google AdSense (publisher ID ca-pub-3335862771619351) and Google Ad Manager to display ads that may be personalized based on interests, context, or approximate location.

When personalized ads are enabled, Google and its partners may use cookies and identifiers to collect data about your visits in order to serve relevant ads and measure their performance, and your IP address, device/browser identifiers, and browsing data may be shared with Google. Google then acts as an independent controller or processor under its own policies.

We apply Google Consent Mode v2 to manage consent signals for ad storage, user data, and ad personalization. You can adjust your Google ad preferences at any time via adssettings.google.com, and review Google's privacy policy via policies.google.com/privacy.

6-bis. Tracking and Advertising in the Mobile App (ATT and UMP)

Our iOS and Android app displays ads via Google AdMob, and may use the device's advertising identifier (IDFA on iOS / Advertising ID on Android) to serve personalized ads and measure their performance. Linking your device data or activity within our app with data from other companies' apps or sites for targeted advertising or its measurement constitutes "tracking" as defined by Apple, and requires your prior permission.

  • Tracking permission (ATT) on iOS: before any tracking or access to the advertising identifier (IDFA), the app displays the "App Tracking Transparency" permission request. We will not access IDFA and will not track your activity unless you explicitly agree to the request.
  • Effect of declining: if you choose "Ask App Not to Track," we will not access the advertising identifier and will not track your activity via other identifiers. You may continue to see ads, but they will be non-personalized (contextual). Declining does not affect your use of the rest of the app's services.
  • UMP consent for ads: we use Google's User Messaging Platform (UMP) to manage your consent for ads and the processing of their data. If you do not consent via UMP, you will not be asked for IDFA permission and personalized ads will not be loaded.
  • Control from system settings at any time: on iOS, "Settings → Privacy & Security → Tracking"; on Android, "Settings → Privacy → Ads" (reset or delete the advertising identifier). You can also withdraw location and notification permissions from your system settings.

Legal basis: processing of personalized ads and tracking relies on your explicit consent under PDPL, revocable at any time without retroactive effect on the lawfulness of processing prior to withdrawal.

7. Analytics, Measurement Tools, and Third Parties (Sub-Processors)

We rely on external providers (sub-processors) to operate specific services:

  • Google Analytics (GA4) / Google Tag Manager: Analyzing website usage and managing analytics and advertising tags — Processed outside the Kingdom.
  • Google AdSense / Ad Manager: Displaying ads on the website — Processed outside the Kingdom.
  • Google AdMob (mobile app): Serving and measuring ads, including use of the advertising identifier (IDFA), advertising data, and approximate location — Processed outside the Kingdom.
  • Google Firebase (Analytics / Crashlytics / Performance / Cloud Messaging): App operation, analytics, crash and performance reporting, and push notifications — Processed outside the Kingdom.
  • Google User Messaging Platform (UMP): Managing your consent for ads and processing their data within the app — Processed outside the Kingdom.
  • Cloudflare: Protection, network, storage (R2), and AI infrastructure (AI Gateway) — Global network, outside the Kingdom.
  • Anthropic (Claude): AI processing for the Career-Boost service and preparing professional documents — United States, outside the Kingdom.
  • Moyasar: Payment processing when paid services are activated — Saudi provider.
  • RevenueCat (mobile app): Managing and verifying in-app subscriptions and purchases — Processed outside the Kingdom.
  • OneSignal / Firebase Cloud Messaging / Apple Push Notification: Sending push notifications via device tokens — Processed outside the Kingdom.
  • Telegram: Job alerts via the official channel and bot — Processed outside the Kingdom.
  • Hotjar: Analyzing user experience on the website — Processed outside the Kingdom.
  • Meta (Facebook Pixel) / Snapchat Pixel: Measuring marketing campaign performance on the website — Processed outside the Kingdom.
  • Sentry: Monitoring technical crashes and improving service stability — Processed outside the Kingdom.
  • Apple App Store / Google Play: Distributing the app and managing in-app purchases — Processed outside the Kingdom.

Roles of the main mobile-app processors

  • Google (AdMob, Firebase, and UMP): ads, analytics, crashes, notifications, and ad-consent management — a processor outside the Kingdom that may act as an independent controller for some ad processing under its own policy.
  • OneSignal: sending push notifications and managing device tokens — a processor outside the Kingdom (privacy policy).
  • RevenueCat: managing subscriptions and verifying purchases — a processor outside the Kingdom (privacy policy).

We do not sell your personal data. We share data with these processors only to the extent necessary to perform the service, and we undertake that such sharing is governed by appropriate contractual safeguards and the cross-border transfer requirements set out in the next section.

8. Artificial Intelligence and Automated Processing

The Career-Boost service (and related résumé-preparation services) uses AI models from Anthropic (Claude) via Cloudflare AI Gateway to generate professional documents (résumé, cover letter, interview preparation, and a suggested job list) and to compute a data "completeness score."

The data you enter is sent for processing to the provider outside the Kingdom. The Platform does not make hiring decisions and does not automatically accept or reject applicants; outputs are assistive and are subject to human review or regeneration by our team before delivery.

You have the right to inquire about the processing logic, request human intervention, and object, in accordance with the PDPL Implementing Regulation on automated processing. Contact: support@wdeftksa.com.

9. Cross-Border Transfer (Outside the Kingdom)

All mobile-app processors — namely Google (AdMob, Firebase, and the UMP platform), OneSignal, and RevenueCat — as well as our web processors (Google, Cloudflare, Anthropic, Apple, Hotjar, Meta, Snapchat, Telegram, and Sentry) process data outside the Kingdom of Saudi Arabia. This transfer is carried out under the Regulation on Transferring Personal Data outside the Kingdom issued by SDAIA and the Transfer Risk Assessment Guide.

Legal basis for the transfer: in the absence of an "adequate level of protection" decision issued by the competent authority in the Kingdom (SDAIA) regarding the level of protection in the recipient's country or entity, the transfer relies on one of the approved appropriate safeguards, such as Standard Contractual Clauses, Binding Common Rules, or an approved certification, together with a transfer risk assessment where required.

We do not claim that your data is hosted exclusively within the Kingdom on Cloudflare R2 or otherwise; the operator determines the actual storage configuration, and any external transfer is governed by this section.

10. Retention Periods

We retain data for the period necessary to fulfill the purpose of its collection or to meet a legal obligation. When the purpose ceases, the data is deleted or anonymized.

Mobile app data: analytics, crash, and usage identifiers are retained with our processors (Firebase, AdMob) for the period set out in each service's retention settings, then deleted or aggregated. Collection of advertising and tracking data stops as soon as you withdraw consent or decline the ATT prompt.

In-app account deletion: you can delete your account and its associated data directly from within the app on iOS and Android, or by request via support@wdeftksa.com. Upon deletion, we destroy or anonymize your data, unless the law requires retaining some of it for a defined period (such as tax invoices).

11. Data Subject Rights (PDPL)

You have the right to: be informed of the processing of your data and its purposes, access it and obtain a copy, rectify or update it, erase (delete) it, withdraw your consent at any time, and object to certain processing. This includes, in particular:

  • Objecting to processing for targeted advertising or tracking, and withdrawing your consent via the ATT prompt (on iOS), the UMP consent window, or your OS settings.
  • Stopping marketing notifications from the app or your OS settings.

These rights are exercised via support@wdeftksa.com, and we respond within the statutory periods stipulated in PDPL and its Implementing Regulation. If you are not satisfied with our response, you may file a complaint with the Saudi Data & AI Authority (SDAIA).

12. Data Security and Breach Notification

We apply reasonable technical and administrative controls to protect data. In the event of a breach affecting personal data or the rights of its subjects, we undertake to notify SDAIA within 72 hours of becoming aware of it, as required by law, and to notify affected individuals where required.

13. Children's Privacy

The Platform is intended for those aged 18 years or older (see the "Terms and Conditions"). We do not knowingly collect data from those under the statutory age, and if we become aware of this, we delete it.

The Platform may include links or services to third parties (such as Google or Cloudflare) that operate under their own independent policies; review them before providing your data.

15. Policy Amendments

We may update this policy to keep pace with regulatory or technical developments, and we publish the update here with a revised last-review date. Your continued use after publication constitutes awareness of the update.

16. Contact and Complaints

Email: support@wdeftksa.com.

Supervisory authority: the Saudi Data & AI Authority (SDAIA) — sdaia.gov.sa.

Follow Our Verified Accounts