This Privacy Policy describes how Dubinity("we", "us", "our") collects, uses and shares information when you visit or interact with this website.
We respect your privacy and aim to collect the minimum amount of data necessary to operate the site, run analytics, and (when applicable) serve advertising.
1 · Information we collect
We collect the following categories of information:
- Information you provide voluntarily - your email address when you subscribe to our newsletter or contact us, and any message content you send to our team.
- Automatically collected information - your IP address, browser type and version, device type, referring URL, pages visited, time spent on pages, and operating system.
- Cookies and similar technologies - see our Cookie Policy for a full list.
- AI feature data - CVs you upload, the text we extract from them, your conversations with the AI Career Centre and AI Travel Assistant, the documents those features generate, and the applications you track. Section 2 covers this in detail.
2 · AI features: CV uploads, chats and generated documents
This section describes the AI Career Centre and the AI Travel Assistant specifically, because they process more sensitive information than the rest of the site. It reflects how the features are actually built, not how they might work in future.
What we process
- Uploaded CVs. The original PDF, DOCX or text file you attach in the AI Career Centre.
- Text extracted from your CV. We parse the document on our servers and store the extracted plain text, capped at 20,000 characters, so the assistant does not have to re-read the file on every message.
- Your conversations. The messages you send to the AI Career Centre and the AI Travel Assistant, and the replies they generate.
- Documents you generate. CVs built in the Resume Builder, cover letters, interview answers and the scores given to them.
- Application tracking data. Roles, employers, job descriptions, statuses and notes you record in the application tracker.
- Saved trips. Destinations, dates, budgets and interests you give the AI Travel Assistant.
Who processes it
Message content, extracted CV text and any job description you supply are sent to Anthropic PBC, our AI provider, over its commercial API in order to generate a response. Anthropic processes this data on servers located outside the UAE, principally in the United States, and acts as our processor for that purpose.
We use the Anthropic API under its published commercial terms. We do not send your data to any other AI provider. We do not sell it, and we do not share it with recruiters, employers, advertisers or analytics providers.
Regarding model training: Anthropic's published commercial terms state that it does not use inputs or outputs submitted through its API to train its models. We rely on those published terms; we have not negotiated separate contractual commitments beyond them. If you would prefer your CV not to be processed by a third-party AI provider at all, do not use the AI Career Centre - every other part of Dubinity works without it.
Where it is stored
- Uploaded files are stored in Amazon S3. They are served only through an authenticated endpoint that verifies you own the file and then issues a link valid for five minutes.
- Extracted text, conversations, generated documents and application data are stored in a managed PostgreSQL database provided by Neon. Both Neon and our Amazon S3 bucket are hosted outside the UAE - section 10 lists every provider that receives personal data.
How long we keep it
- If you are signed in, your CVs, conversations and generated documents are kept until you delete them or ask us to delete your account.
- If you are not signed in, they are tied to a first-party session cookie that lasts 180 days. When that cookie expires or you clear it, you lose access to the data and we delete the orphaned records.
- Deletion is immediate and permanent. Deleting an uploaded CV removes both the stored file and the extracted text. Deleting a conversation removes its messages. There is no "trash" to restore from.
Your controls
- Delete an uploaded CV from the AI Resume Builder.
- Delete a generated CV, cover letter or saved trip from its own page.
- Email us at the address in section 12 to request deletion of everything associated with you.
- Before uploading, we show you a summary of this section and ask you to confirm it. You can review it again at any time from the upload control.
Abuse prevention and logging
AI endpoints are rate-limited per session, per signed-in user and per IP address, and we record aggregate token counts and costs per conversation so we can detect abuse and control spend. Our application logs deliberately exclude CV text, message content, filenames and generated documents; when something fails we log the shape of the error, not its contents. Our hosting provider keeps standard request logs containing IP addresses and URLs.
Please do not upload more than you need
A CV does not need a passport number, an Emirates ID number, a date of birth or a photograph. Remove them before uploading. If you have already uploaded a document containing them, delete it and upload a redacted version.
3 · How we use your information
- To operate, maintain and improve the website.
- To send you the newsletter you subscribed to (unsubscribe in any email).
- To respond to your enquiries.
- To measure aggregate site usage via Vercel Web Analyticsand Real-User Vitals - both privacy-friendly tools that do not set tracking cookies. They run only after you opt in via the consent banner.
- To prevent fraud, abuse and security incidents.
- To comply with legal obligations.
- To serve advertising - see Section 5.
4 · Legal basis for processing (GDPR)
Where the GDPR applies, we rely on the following legal bases: (a) your consent - for non-essential cookies, marketing emails and personalised ads; (b) contract - to provide services you've requested; (c) legitimate interests - to keep the site secure and improve it; and (d) legal obligation - for tax, audit and security records.
5 · How we share your information
We do not sell your personal data. We share information only with:
- Service providers who run infrastructure for us:
- Vercel (USA) - hosting, edge network, web analytics. EU SCCs in place.
- Neon (USA) - managed PostgreSQL database.
- Upstash (EU/USA) - Redis caching and rate-limit store.
- Amazon Web Services (Singapore region) - media file storage (S3).
- UploadThing (USA) - legacy media uploads being migrated to AWS.
- LinkMyDeals (India) - affiliate deals data feed.
- Google (USA) - Search Console verification, and Google AdSense if and when monetisation is enabled.
- Advertising partners - if Google AdSense becomes active on the Site, they may set their own cookies after you opt in.
- Law enforcement when required by a valid court order or regulatory request.
6 · Advertising & Google AdSense
If and when Google AdSense is enabled on the Site, third-party vendors (including Google) may use cookies to serve ads based on your prior visits to this and other websites. The AdSense script is loaded only after you accept advertising cookies in the consent banner; if you decline, no ads-network code runs in your browser.
You may opt out of personalised advertising by visiting Google Ads Settings or aboutads.info.
7 · Data retention
We retain personal data only for as long as needed to fulfil the purposes set out in this policy and to comply with legal, accounting and reporting obligations - typically up to 36 months for analytics records and as long as you remain subscribed for newsletter records.
8 · Your rights
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your data (subject to legal retention obligations).
- Object to or restrict certain processing.
- Withdraw consent at any time, including for cookies and emails.
- Lodge a complaint with your local data protection authority.
To exercise any of these rights, email hello@dubinity.com with your request. We will acknowledge your request within 5 working days and respond fully within 30 days. To verify your identity we may need to ask a few follow-up questions before we action a deletion or export request.
9 · Children
This site is not directed at children under 13 and we do not knowingly collect personal data from anyone under that age. If you believe a child has provided us with personal information, please contact us so we can delete it.
10 · International transfers
Most of our service providers are based outside the United Arab Emirates, so operating this site involves transferring personal data abroad. The providers that receive personal data are:
- Vercel - application hosting and request logs.
- Neon - managed PostgreSQL, holding your account, AI conversations, extracted CV text and generated documents.
- Amazon Web Services (S3) - storage for uploaded files, including CVs.
- Anthropic PBC - AI model responses, in the United States. See section 2.
- Upstash - rate limiting and caching. Holds request counters keyed to a session identifier or IP address, not content.
- Google - advertising, and only after you accept advertising cookies. See section 6.
Where data crosses borders we rely on the transfer terms in each provider's data-processing agreement, including standard contractual clauses where the provider offers them.
11 · Changes to this policy
We may update this Privacy Policy occasionally. The "Last updated" date at the top of this page reflects the most recent change. Material changes will be highlighted at the top of the home page for 14 days.
12 · Contact
Questions about this policy or how we handle your data? Email hello@dubinity.com.