Privacy Policy

1. Introduction

Cheghel ("we", "us", "Cheghel") is a Lebanese job platform operating at cheghel.com. We connect job seekers (white-collar professionals, blue-collar workers, freelancers, and Lebanese diaspora) with employers whose companies we verify before they can post a job.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to:

• The Cheghel website and Progressive Web App at cheghel.com
• Future Cheghel mobile apps for iOS and Android
• WhatsApp and Telegram alerts and integrations operated by Cheghel
• Transactional and opt-in emails sent from @cheghel.com

English is the authoritative version of this policy. An Arabic translation will follow. If there is any conflict, the English version prevails.

2. Data Controller and Contact

• Data controller: Cheghel (legal entity name to be finalised at launch).
• Privacy contact / DPO: privacy@cheghel.com
• Legal contact: legal@cheghel.com
• Postal address: Beirut, Lebanon (full address to be added at company registration).
• EU representative: Not currently appointed. Cheghel does not target EU residents, but we honour data rights requests from anywhere in the world.

3. Data We Collect

We group the data we collect into the same categories used by Apple's privacy labels and Google Play Data Safety, so you can compare directly.

a) Contact Info

• Email address: required to create an account.
• Full name: required on your profile.
• Phone number / WhatsApp number: required when you create an account with an email address and a password. Signing up with Google does not ask for one; you can add one later in Settings. Employers do not see it.
• Physical address: we do not collect a home address. We only store your Lebanese governorate selection.

b) Identifiers

• A Cheghel user ID (a random UUID generated at signup).
• Google account identifier: only if you sign in with Google OAuth.
• A consent ID: a random ID for your browser, set in an essential cookie the first time a choice you make in the cookie banner is recorded, and used only to keep the record of your cookie choices (Section 4(c)). It is not PostHog’s ID.
• Device identifiers: we do not use Apple's IDFA or IDFV, nor any equivalent cross-app identifier. If a future mobile app ships, it will use Apple's session-only, on-device identifiers only.

c) User Content

• CV / resume file (PDF or DOCX) and extracted text.
• Profile photo, headline, bio.
• Skills, portfolio URLs, LinkedIn URL.
• Salary expectation and availability.
• Job applications you submit and cover messages.
• Reviews you leave about companies. Your review text is public; your identity as the reviewer is never shown publicly and is permanently protected under Law 81/2018 (see Section 5).
• Saved jobs and saved search alerts.
• Messages you send to employers through Cheghel, if any.

d) Usage Data

• Pages you view and links you click on Cheghel.
• Search queries you run on the platform.
• Which jobs you view, save, and apply to.
• Session duration and activity timing.
• Referrer URL (where you came from to reach Cheghel).

e) Diagnostics

• Crash and error reports via Sentry. Personal data is scrubbed before a report leaves your device or our server. What we do send is limited to: the address (URL) and method of the request that failed, a small set of technical headers (browser type, language preference, content type and encoding), the error and its stack trace, and an error code. Account and record identifiers are replaced with a placeholder before a report is sent.

4. How We Use Your Data

a) App Functionality

• Match seekers with jobs using profile data and search filters.
• Process applications (CV + profile + the job you applied to).
• Manage reviews, including moderation and employer replies.
• Administer paid plans and payment status.

b) Communications

• Transactional emails: welcome, application received, application status changes, review published, password reset.
• Weekly "Top Jobs for You" digest: opt-in only, with a one-click unsubscribe link in every email.
• WhatsApp messages via Twilio: used only for phone-verification codes, and not currently sent at all. We do not send job alerts over WhatsApp.
• We do not send marketing or promotional emails without your explicit consent.

c) Analytics

• We use PostHog for product analytics. It is pseudonymous, not anonymous: PostHog gives this browser a random ID, which we never link to your account.
• With each event it records the page you are on and the page you came from — with anything after the “?” or “#” removed before it is sent — which links and buttons you click (the kind of element, its design class names and where it sits on the page, and for a link the page it leads to, again without anything after the “?”; never the words on it or any label attached to it), how far down the page you scroll, and your browser, device, language, time zone and screen size. PostHog also receives your IP address, as any site you connect to does, and may use it to estimate your approximate location.
• In your browser, PostHog keeps that ID in a cookie that expires a year after your last visit, and in local storage, where it has no expiry. Local storage also holds the address of the first page of each visit — which can include what follows the “?” — and the page that sent you there. See the Cookie Policy.
• Analytics only load if you accept analytics cookies in the consent banner. If you choose "Essential only" — at first, or at any time later — PostHog does not start, or stops straight away in every Cheghel tab you have open and deletes what it stored in this browser. Anything it had already sent is not deleted from PostHog, and events from the moments just before you chose may still arrive.
• We keep a record of each choice you make in the cookie banner — what you chose, when, which version of the banner you saw and in which language — so that we can show that consent was given. “Accept all” takes effect only once it has been recorded; if we cannot record it, analytics stays off. The record is kept against a random ID for your browser, never PostHog’s ID. If you are signed in when you choose, it is linked to your account, and a choice made while signed out may be linked to your account when you next sign in on the same browser. If your browser chose “Accept all” before we began keeping these records, we ask you once more.

5. The 3-Tier Information Wall

Cheghel uses a tiered disclosure model for job listings:

Reviewer identities are never disclosed: not to other seekers, not to employers, not through the admin UI, and not via any API. This is a permanent protection under Law 81/2018 and is enforced at the database row-level security layer.

6. Legal Bases for Processing

7. Third-Party Service Providers

We rely on the following providers. Each one processes data only for the purpose listed below, under a written contract.

8. Data Retention

9. Your Rights

Under Lebanon Law 81/2018 and GDPR-equivalent principles, you have the following rights:

• Right of access: request a copy of the personal data we hold about you. Self-serve at /data-request.
• Right of deletion: request deletion of your account. Self-serve at /data-request.
• Right of correction: edit your profile, or email privacy@cheghel.com.
• Right of portability: get a JSON export of your data via /data-request.
• Right to withdraw consent: unsubscribe links in emails, WhatsApp STOP, your profile settings, and — for analytics cookies — the Cookie preferences link in the site footer or on the Cookie Policy page, which stops analytics straight away, and is then recorded (Section 4(c)).
• Right to object to a specific processing activity: email privacy@cheghel.com.
• Right to lodge a complaint with the relevant Lebanese data protection authority.

We respond to all rights requests within 30 days, as required by Law 81/2018. Self-serve actions are immediate.

10. Children's Privacy

• Cheghel is not intended for users under 18.
• We do not knowingly collect data from minors.
• Parents or guardians can email privacy@cheghel.com to report a minor's account or request its deletion.

11. International Data Transfers

Your data is processed in Japan: our database, authentication and file storage, and the servers that run Cheghel’s pages and features, are in Tokyo. Each request is first handled at the location of our hosting provider’s (Vercel’s) network nearest to you, which may be in another country. Your data may also be processed in the United States or the European Union by the other providers listed in Section 7, including by Vercel, which may transfer data to the United States, and, when you make a purchase, in Kuwait and the wider region by our payment provider, Tap Payments. Where available, we rely on standard contractual clauses or equivalent safeguards. By using Cheghel from Lebanon, you consent to this transfer for the purposes described in this policy.

12. Security Measures

• Encryption in transit using TLS 1.2 or higher.
• Encryption at rest at the database level.
• Row-level security on every database table.
• Regular security reviews and dependency audits.
• Documented incident response plan. Any confirmed breach is notified within 72 hours, as required by Law 81/2018.

13. Cookies and Tracking

• Essential cookies (cannot be disabled): authentication session, language preference, the mode you chose (job seeker, employer or freelancer), your cookie consent choice itself, and a random ID used only to keep the record of that choice (Section 4(c)).
• Optional cookies (require consent via the banner): PostHog analytics — pseudonymous, not anonymous (see section 4c and the Cookie Policy). Withdrawing consent stops it straight away and deletes its cookie and browser storage.
• Bot-protection storage (cannot be disabled, auth screens only): Cloudflare Turnstile may keep short-lived data in its own frame while it runs its challenge on sign-up, sign-in and password reset. It is not analytics and is not used to track you between visits.
• Storage on your device: some features keep working data in your browser — your progress through the welcome steps, a job post you are still writing, the jobs you have previewed, and a display choice. Our servers do not read these entries. They are removed whenever someone signs in or out on this browser or deletes their account, and if a session ends another way, the next time Cheghel loads a page; only the display choice is kept. If you accept analytics, PostHog keeps its identifiers there too, and they are different: they go to PostHog with every analytics event, together with the address your visit began on and the page that sent you there (each without anything after the “?”). They are replaced with new random ones when you sign out, and removed if you withdraw consent.
• Cookies set by other companies: Google sign-in, Tap's payment page and your bank's security check, and Cloudflare in front of our database provider (the __cf_bm cookie on supabase.co) set their own cookies under their own policies; Cloudflare Turnstile may keep data in its own frame, as described above. We cannot read or remove them.
• No third-party advertising trackers.
• No Meta / Facebook pixels.
• No cross-site tracking.
• No fingerprinting for advertising or identity. We run no script that profiles your device to build a marketing or cross-site identity. Cloudflare Turnstile, on the sign-up, sign-in and password-reset screens (and on the resend-confirmation action inside sign-up), does inspect browser signals — that is how it distinguishes a person from a bot — and it is listed in the processor table above. It runs before any account exists and is not used to identify you.

See our Cookie Policy for details and controls.

14. Mobile App Privacy (Future iOS and Android Apps)

Cheghel is currently a web and Progressive Web App. When native iOS and Android apps launch, the following additional rules will apply, consistent with this policy:

• App Tracking Transparency (ATT): We do not track you across apps or websites owned by other companies. Our ATT answer is "not tracking".
• No IDFA or IDFV collected or used.
• Push notifications: opt-in only, with system-level and in-app toggles.
• Background location: not collected.
• Contacts, photos, microphone, camera: accessed only with your explicit permission, and only when you use the feature that needs it (for example, uploading a profile photo).
• Face ID / Touch ID: used on-device only to unlock the app if you enable it. We never see biometric data.

15. Changes to This Policy

This section was rewritten on 2 October 2026. The rewrite is a material change, so it takes effect 30 days after we notify users of it by email and an in-app banner. Until then, the previous rules of this section apply. Both are set out below.

When this rewrite takes effect

• A change that reduces your rights or uses your data for a new purpose is a material change. We notify users of a material change by email and an in-app banner, at least 30 days before it takes effect. A change that fits none of the kinds in this section is treated as material and gets the same notice.
• A change that strengthens your protection or that is required by law takes effect when it is published, and is recorded, with its date, in the change log below.
• A change that extends a practice this policy already discloses to another part of the same service, for the same purpose and the same period, takes effect when it is published, and is recorded, with its date, in the change log below.
• Non-material changes (typo fixes, clarifications, broken links) may be posted without notification.
• Previous versions are available on request.

Until this rewrite takes effect

• We notify users of material changes by email and an in-app banner, at least 30 days before they take effect.
• Non-material changes (typo fixes, clarifications, broken links) may be posted without notification.
• Previous versions are available on request.

Change log

Each entry says whether the change was treated as material, and why. An entry for a material change shows the date it was published and when it takes effect.

• 29 September 2026: the servers that run Cheghel’s pages and features moved from the United States to Japan (Tokyo), beside our database. Each request is still first handled at the location of our hosting provider’s network nearest to you. See Sections 7 and 11. Basis: not material — it strengthens your protection: processing moved to a country the European Union recognises as protecting personal data adequately.
• 29 September 2026: the applicant search stopped running searches by gender or nationality, and a refused search is logged. See Section 3(g). Basis: not material — it strengthens your protection: we process less.
• 1 October 2026: the per-job applicant assistant stopped answering questions by gender or nationality, as the applicant search had; a question about the right to work in Lebanon is still answered, from applicants’ own screening answers. See Section 3(g).

16. Contact Us

• Privacy questions: privacy@cheghel.com
• Data access, export, or deletion requests (fastest route): /data-request
• Legal notices: legal@cheghel.com
• Postal: Beirut, Lebanon (full address at company registration).