1. Introduction

_{Qualiphi ("Qualiphi," "we," "us," or "our") is registered in Cairo, Arab Republic of Egypt. We run an AI-powered career services management platform that connects students, universities, schools, and employers (the "Services"), available at qualiphi.ai.}

_{This Privacy Policy explains what personal data we collect, how we use and share it, and the rights you have over it. It applies to all users of the Services, including students, alumni, university and school staff, and employer representatives.}

_{This Policy should be read together with our Terms and Conditions. Terms defined in the Terms and Conditions have the same meaning here.}

2. Our Role: Controller and Processor

• _{Qualiphi as Processor: When a university, school, or employer ("Customer") uploads or manages data through the Services, the Customer is the data controller. Qualiphi acts as a data processor and handles that data only on the Customer's instructions.}
• _{Qualiphi as Controller: Qualiphi is the data controller for data we collect directly to run, secure, and improve the Services. This includes account registration data, usage analytics, cookies, and support communications.}

_{If your data is managed by your institution, you can also contact the institution directly about how it uses your data.}

3. Personal Data We Collect

_{3.1 Students and Alumni}

• _{Identity data: first, middle, and last name; gender}
• _{Contact data: email address and phone number}
• _{Verification data: a picture of the national ID and a picture of the university ID}
• _{Academic data: faculty, major, current academic year, graduation year, and graduation status}
• _{Career data: your resume and any information it contains}
• _{Platform activity: applications, profile information, interactions with employers, and any use of career services features}

3.2 University and School Staff

• _{Career center director's or staff member's name, email address, and phone number}
• _{Institution name and related account information}

3.3 Employers

• _{Company name, size, and industry}
• _{Names and contact details of employer representatives using the Services}
• _{Job postings and related content}

3.4 Data Collected Automatically

• _{IP address}
• _{Device and browser information}
• _{Usage analytics, such as pages visited, features used, clicks, and session duration}
• _{Cookies and similar technologies (see Section 10)}

3.5 Data from Third Parties

• _{Single Sign-On (SSO): If you sign in with Google, Microsoft, or your institution's enterprise SSO, we receive basic profile information from that provider, such as your name, email address, and account identifier.}
• _{Institutions: Your university or school may invite you to the Services or provide information to set up your account.}

3.6 Sensitive Personal Data

_{Some data we process may be considered sensitive under applicable law, including gender, pictures of identity documents, and data relating to users under 18. We process sensitive data only where the law allows it, with appropriate safeguards and, where required, explicit consent.}

4. How We Use Your Personal Data

_{We do not sell your personal data. We do not use your data for third-party advertising, and we do not send marketing emails or newsletters.}

5. AI Processing

_{5.1 Qualiphi uses third-party AI providers, currently OpenAI and Anthropic, to power some features.}

_{5.2 No AI training: Your personal data and Customer Content are not used to train AI models, whether by Qualiphi or by our AI providers. Our agreements with these providers are set up to prevent training on your data.}

_{5.3 AI outputs are suggestions only. They do not make legally binding or similarly significant decisions about you without human involvement. Employers are responsible for applying human judgment in hiring decisions.}

6. How We Share Your Personal Data

_{6.1 With Your Institution}

_{If you are a student or alumnus, your university or school can see your profile, platform activity, applications, and career outcomes. This lets them provide and evaluate career services.}

_{6.2 With Employers (Opt-In Only)}

_{Employers cannot see your profile by default. Your profile is shared with employers only if you actively opt in, for example by turning on profile visibility or applying for an opportunity. You can change your visibility settings at any time.}

_{6.3 Institution Announcements}

_{Your institution may send you emails through the Announcements feature. The institution controls these communications. Please contact your institution if you have questions about them.}

_{6.4 Service Providers (Sub-processors)}

_{Google User Data}

_{This section explains how Qualiphi accesses, uses, stores, shares, and deletes data}

_{we receive from Google when you choose "Sign in with Google.}

_{Data we access with Google}

_{When you sign in with Google we receive:}

• _{Your name}
• _{Your email address and whether it is verified}
• _{Your Google account identifier}
• _{Your profile picture (if available)}

_{We do not access your Gmail, Google Drive, Calendar, Contacts, or any other Google Workspace data.}

_{How we use Google user data}

_{We use this data only to:}

• _{Create and authenticate your Qualiphi account and keep you signed in}
• _{Verify that your email belongs to an institution that uses Qualiphi (domain whitelisting)}
• _{Pre-fill your profile name and photo}
• _{Send you service-related notifications about your account}

_{We do not use Google user data for advertising, retargeting, or interest-based ads. We do not sell Google user data. We do not use it to determine creditworthiness or for lending purposes. We do not use Google user data to develop, improve, or train generalized or non-personalized AI or machine learning models, and we do not send it to our AI providers (OpenAI, Anthropic) for training.}

_{How we share Google user data}

_{We do not sell, rent, or transfer Google user data to third parties for purposes other}

_{than providing the Services. Google user data is shared only:}

• _{With Amazon Web Services (AWS), which hosts our systems, under a data processing agreement}
• _{With your university or school, which can see your name and email as part of your account}
• _{With employers, only if you opt in}
• _{When required by law, or as part of a merger or acquisition}

_{How we protect Google user data}

_{Google user data is encrypted in transit (TLS) and at rest, stored on AWS, and accessible only to authorized personnel}

_{Retention and deletion}

_{We keep Google user data for as long as your account is active. If you delete your account in Settings, we delete your Google user data from active systems within 30 days and from backups within 90 days. You can also request deletion at any time by emailing}

_{[email protected]. You can revoke Qualiphi's access to your Google account at any time at https://myaccount.google.com/permissions. Revoking access does not delete your Qualiphi account. To delete it, use account settings or contact us.}

_{All service providers are bound by contracts requiring them to protect your data and use it only to provide services to us.}

_{6.5 Legal and Business Transfers}

_{We may disclose data when required by law, court order, or a competent authority, or to protect the rights and safety of Qualiphi and our users. If Qualiphi is involved in a merger, acquisition, or sale of assets, personal data may be transferred under the protections of this Policy.}

7. Where Your Data Is Stored and International Transfers

_{7.1 Data hosting:}

• _{AWS data centers}

8. Data Retention

_{8.1 We keep personal data while your account is active or your institution holds an active subscription.}

_{8.2 After a subscription ends or an account becomes inactive, we keep personal data for up to 12 months, then delete or anonymize it, unless the law requires us to keep it longer.}

_{8.3 Account deletion: If you delete your account, we delete your personal data from active systems within 30 days. Backup copies are deleted on a routine cycle within 90 days.}

_{8.4 Anonymized and aggregated data that cannot identify you may be kept for analytics and service improvement.}

9. Data Security

_{We use technical and organizational measures to protect personal data, including:}

• _{Encryption of data in transit and at rest}
• _{Role-based access control (RBAC) so institution staff see only the data their role allows}
• _{Domain whitelisting and SSO to verify that users belong to their institution}
• _{Restricted internal access on a need-to-know basis}
• _{Security practices aligned with GDPR requirements; Qualiphi is working toward ISO/IEC 27001 certification}

_{No system is completely secure. If a data breach is likely to affect your rights, we will notify you, the relevant Customer, and the competent authorities as required by law.}

10. Cookies and Analytics

_{We use cookies and similar technologies to:}

• _{Essential cookies: keep you signed in and secure the Services}
• _{Analytics cookies: understand how the Services are used}

_{Where required by law, including for EU users, we ask for your consent before setting non-essential cookies. You can manage your preferences in our cookie banner or your browser settings. Blocking essential cookies may stop some features from working.}

11. Users Under 18

_{11.1 The Services are intended for users aged 18 and over. Users aged 16 to 17 may use the Services only where their institution has obtained any parental or guardian consent required by applicable law.}

_{11.2 Data about minors is treated as sensitive and receives additional protection.}

_{11.3 We do not allow users under 16. If we learn that a user under 16 has created an account, we will delete it. Contact us at the email in Section 15 if you believe this has happened.}

12. Your Rights

_{Depending on where you live, you may have the right to:}

• _{Access the personal data we hold about you}
• _{Correct inaccurate or incomplete data}
• _{Delete your data}
• _{Restrict or object to certain processing}
• _{Data portability, meaning you can receive your data in a structured, machine-readable format}
• _{Withdraw consent at any time, without affecting processing that happened before you withdrew it}
• _{Not be subject to solely automated decisions that significantly affect you}
• _{Lodge a complaint with a data protection authority}

_{Deleting your account: You can delete your account and data directly in your account settings. You do not need to request this through your university or school.}

_{To exercise your other rights, email us at the address in Section 15. We will respond within the time limits set by applicable law, usually within 30 days. We may need to verify your identity first. If your request concerns data controlled by your institution, we may refer it to them or help them respond.}

13. Regional Information

• _{Egypt: We process personal data under Law No. 151 of 2020 on the Protection of Personal Data and its executive regulations.}
• _{European Union / EEA: Where the GDPR applies, the legal bases in Section 4 apply. You may complain to your local supervisory authority.}
• _{United Arab Emirates: We comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and with free zone laws where applicable.}
• _{Kingdom of Saudi Arabia: We comply with the Personal Data Protection Law (Royal Decree M/19) and its regulations.}
• _{Bahrain: We comply with Law No. 30 of 2018 on Personal Data Protection.}
• _{Other Gulf countries: We comply with applicable local data protection laws.}

14. Changes to This Policy

_{We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Services before they take effect. The "Last Updated" date at the top shows when the Policy was last revised.}

15. Contact us

_{For questions, notices, or support, contact us at:}

_Qualiphi

_{Egypt, Cairo, 5 Abu Bakr Al Seddik Street, Sheraton Heliopolis
Email: [email protected]}