Privacy Policy

In effect from 2026-09-06.

This policy explains what ⟨operating company⟩ ("Nabesh", "we", "us") collects about you, who sees it, who else it is sent to, and how long we keep it.

It describes what the system actually does. Where we have not yet decided something — a deletion schedule, for instance — this policy says so rather than implying a practice we do not have.

1. The short version

• Your profile is private until you activate it. Activation is your own deliberate act.
• Once activated, your name, photograph, headline, city, experience, education, skills and languages are public to anyone on the internet and are indexed by search engines.
• Your date of birth, age, gender, nationality, phone number and email address are never public. A company sees your contact details only after you apply to them.
• We use no analytics service, no advertising network and no tracking pixels. Nothing on Nabesh reports your browsing to anyone.
• The text of your CV is sent to an AI provider to help fill in your profile. The file is not. Your introduction video is stored by a specialist video host and never passes through our servers.
• We do not currently delete most data automatically. Section 8 is exact about this.

2. What we collect

When you create an account. Your name and email address. A one-way scrambled form of your password, from which the password cannot be recovered. The public username your profile lives at, which is generated from your name. The language you chose. If you sign in with Google, your Google account identifier, your email address, whether Google has confirmed it, and your name as Google holds it — nothing else; we ask Google for no additional access.

Your candidate profile, if you build one. Your date of birth, gender and nationality. Where you live, as country, governorate and city. Your phone number and whether it has WhatsApp. Your field of work, the job titles you want, your skills, the languages you speak and how well, your work history, your education and your work preferences. A profile photograph. All of it is optional in the sense that you type it yourself, but a profile has to be complete before it can be activated.

Your CV, if you upload one. We keep the file, and we also keep the text extracted from it in our database.

Your introduction video, if you record one. The video itself is held by our video host, not by us; we store its identifier. The host also generates captions, which means a written transcript of what you said exists there.

Your applications. Your answers to a company's questions, and a copy of your profile as it stood at the moment you applied, so that what the company reviewed does not change under them afterwards.

Your company, if you are hiring. The company name, type, industry, size, location, description, website, social link, company email and company phone, and which people belong to the workspace and in what role.

Automatically, for security. When you sign in, change your password, change your address or take another security-relevant action, we record what happened, when, your IP address and a description of your browser and device. This is what lets you review where your account is signed in, and lets us tell you about a sign-in you did not make.

Automatically, for administration. A record of significant changes made in the product, and — for each AI request — which feature ran, the model used and how many tokens it consumed. That last record contains no message content.

Counts. We count events such as completed sign-ups. These counts never carry your email address; where an account has to be distinguished it appears as an irreversible cryptographic digest, and where the email matters only the part after the @ is kept.

3. Who can see it

Anyone on the internet, once you activate your profile: your name, your username, your photograph, your headline, your city, governorate and country, your work history, your education, your skills and your languages.

A company you applied to: everything above, plus your answers to their questions, your CV, your introduction video, and — only for staff whose role grants it — your email address and phone number.

Never shown to anyone but you: your date of birth and the age derived from it, your gender, your nationality, and your password. Your phone number and email address are never public and reach a company only through an application you sent.

A company never shows you its private notes, its hiring stages, or any internal assessment of you. That is a property of how the data is built, not a setting somebody could change by mistake.

Our own staff can see account data where their work requires it, through an internal console that is restricted to administrators and records what is done in it.

4. Who else receives it

An AI provider (OpenRouter), and the model it routes to. This receives the text of your CV, the profile facts already saved for you, and what you type to the assistant; for a company, the company details listed above. It does not receive your CV file, your video, your photograph, your password, or any identifier for your account — the request carries the application's name where a user identifier would go. On every request we require routing to endpoints that do not retain the content and do not train on it. That is a requirement we set and the provider honours; it is not a promise we can make on their behalf. At the time of writing the model is DeepSeek v4 Flash, reached through OpenRouter.

Our video host (Bunny Stream). Your introduction video goes from your browser directly to the host and never passes through Nabesh. The host stores it, produces the versions used for playback and the still image, and generates captions. Deleting your video from Nabesh instructs the host to delete it.

Our email provider (Amazon Web Services). Your email address and the content of every message we send you — verification codes, recovery codes, security notices and updates about your applications. Our new-sign-in alerts include the IP address and device the sign-in came from, so that message carries those to the provider and onward through the mail system. Emails about applications deliberately contain a link rather than your profile.

Google, only if you use "Continue with Google", and only to identify you. If you already have a Nabesh account with the same address and Google confirms that address belongs to you, we connect the two rather than creating a second account.

A website you ask the assistant to read. If you give the assistant a link — your portfolio, a company page — our server fetches that page. The site's operator sees a request from us, identified as Nabesh, and does not see your IP address. The text of the page then forms part of the conversation sent to the AI provider.

Nobody else. We do not sell your data, we do not rent it, and we do not share it with advertisers, data brokers or recruiters who are not the company you applied to.

5. AI features, and their limits

An assistant can read your CV and fill in your profile from it, and can record what you tell it — including your date of birth, gender and nationality when you state them outright. It does this as you talk to it, and what it writes is visible to you and editable by you.

No automated system decides anything about your application. We do not score candidates, we do not rank people by machine judgement, and we do not give employers an algorithmic assessment of you. A person at the company decides.

Some AI features are switched on or off depending on how the service is configured. Where one is off, nothing is sent to a provider at all.

6. Cookies

We use five, and none of them tracks you.

• A session cookie, so the site knows your browser is signed in. It contains no personal information — only an encrypted pointer to a record on our server.
• An anti-forgery cookie, which proves a form came from a real Nabesh page.
• A stay signed in cookie, if you ask to remain signed in. Changing your password or recovering your account invalidates it everywhere.
• A layout preference cookie, remembering whether you collapsed the side menu.
• For our own staff only, a cookie remembering the language of the internal console.

There is no advertising cookie, no analytics cookie and no third-party script on any page. Your language is part of the web address rather than something we store on your device.

7. Where your data is

Our servers and our providers may be located outside Syria. Using Nabesh means your information is stored and processed in those places, under the safeguards those providers offer.

8. How long we keep it

We will be exact, because a vague answer here is worth nothing.

Deleted automatically today: expired email verification and recovery codes, about a day after they expire. That is the only thing.

Kept until you or we delete the account: everything else — your profile, your CV file and the text taken from it, your applications, your company records.

Kept even after that: security records containing your IP address and device description, with the link to your account removed; conversations you had with the assistant, which include a copy of your CV text; the usage and cost records for AI requests; and the administrative log of changes.

Not deleted when replaced: if you upload a new CV or record a new video, the previous one is kept. Applications already sent point at the version they were sent with, which is why.

Withdrawing an application does not delete it. The company keeps what you already sent them; only the status changes.

We have not yet set retention periods for security records, assistant conversations or administrative logs. Until we do, they are kept. When periods are set, this section will say what they are and this policy's date will change.

9. Your choices

Correct anything. Your profile is editable at any time, by hand or by asking the assistant.

Take your profile out of public view. Removing a section, or removing what made your profile complete, takes it out of employer search results.

Delete your account. There is no button for this yet. Write to [email protected] and we will do it. Deleting an account removes your profile, your CV files including replaced versions, your photograph, your applications, and the company workspaces you alone own. It does not remove the items listed as kept in section 8, and it does not by itself remove a video already held by our video host — ask us and we will remove that too.

Ask what we hold. Write to [email protected]. There is no self-service export yet.

Ask us to stop. If you object to something described here, write to us. Where the processing is something Nabesh cannot work without, the answer may be that we delete your account instead, and we will say so plainly rather than pretend otherwise.

A record of your consent. Each time you accept these documents we record which version, in which language, on which screen and when. Those records are never edited — a withdrawal is a new record, not a change to an old one.

10. If you are under 18

You can create an account and build a complete profile before you turn 18. You cannot make it public, appear in employer searches, or apply for work until you are 18 — that limit is enforced in the product.

If you are under 18, please do not upload a CV or record a video: those go to the providers described in section 4, and a policy specifically covering the processing of minors' data is not yet in place. If a parent or guardian wants a minor's account and its contents removed, write to [email protected] and we will remove it.

11. Keeping it safe

Passwords are stored as one-way hashes and are never readable. CVs, photographs and videos are never served from a public address: each is reached through a short-lived signed link that also checks who you are and whether you are allowed. Access to the internal console is restricted and recorded.

No system is perfectly secure. If a breach affects you, we will tell you what happened, what it means for you and what we are doing, without waiting to be asked.

12. Changes

We will update this policy as Nabesh changes. Every version carries the date it took effect, and that date is recorded against your acceptance. If a change materially affects you, we will ask you to accept the new version rather than assume you have.

13. Reaching us

Questions about this policy, requests about your data, and complaints:

⟨operating company⟩ ⟨postal address⟩ [email protected]