Privacy Policy

1. Introduction

Cheghel ("we", "us", "Cheghel") is a Lebanese job platform operating at cheghel.com. We connect job seekers (white-collar professionals, blue-collar workers, freelancers, and Lebanese diaspora) with employers who post real, paid, funded positions.

This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It applies to:

• The Cheghel website and Progressive Web App at cheghel.com
• Future Cheghel mobile apps for iOS and Android
• WhatsApp and Telegram alerts and integrations operated by Cheghel
• Transactional and opt-in emails sent from @cheghel.com

English is the authoritative version of this policy. An Arabic translation will follow. If there is any conflict, the English version prevails.

2. Data Controller and Contact

• Data controller: Cheghel (legal entity name to be finalised at launch).
• Privacy contact / DPO: privacy@cheghel.com
• Legal contact: legal@cheghel.com
• Postal address: Beirut, Lebanon (full address to be added at company registration).
• EU representative: Not currently appointed. Cheghel does not target EU residents, but we honour data rights requests from anywhere in the world.

3. Data We Collect

We group the data we collect into the same categories used by Apple's privacy labels and Google Play Data Safety, so you can compare directly.

a) Contact Info

• Email address: required to create an account.
• Full name: required on your profile.
• Phone number / WhatsApp number: optional, used mainly for blue-collar listings where one-tap WhatsApp apply is the expectation.
• Physical address: we do not collect a home address. We only store your Lebanese governorate selection.

b) Identifiers

• A Cheghel user ID (a random UUID generated at signup).
• Google account identifier: only if you sign in with Google OAuth.
• Device identifiers: we do not use Apple's IDFA or IDFV, nor any equivalent cross-app identifier. If a future mobile app ships, it will use Apple's session-only, on-device identifiers only.

c) User Content

• CV / resume file (PDF or DOCX) and extracted text.
• Profile photo, headline, bio.
• Skills, portfolio URLs, LinkedIn URL.
• Salary expectation and availability.
• Job applications you submit and cover messages.
• Reviews you leave about companies. Your review text is public; your identity as the reviewer is never shown publicly and is permanently protected under Law 81/2018 (see Section 5).
• Saved jobs and saved search alerts.
• Messages you send to employers through Cheghel, if any.

d) Usage Data

• Pages you view and links you click on Cheghel.
• Search queries you run on the platform.
• Which jobs you view, save, and apply to.
• Session duration and activity timing.
• Referrer URL (where you came from to reach Cheghel).

e) Diagnostics

• Crash and error reports via Sentry. Personal data is scrubbed before a report leaves your device or our server. What we do send is limited to: the address (URL) and method of the request that failed, a small set of technical headers (browser type, language preference, content encoding), the error and its stack trace, and — where a failure relates to your account — your user id and an error code.
• What we remove before sending: session cookies and authentication tokens, and IP addresses. We do not send the content of your data — your CV, applications, messages, screening answers, and profile fields do not appear in a crash report.
• Performance traces of requests to Cheghel (route name and timing; currently every request is traced). Request and response bodies are not included.

f) Location Data

• Your Lebanese governorate (Beirut, Mount Lebanon, North, Akkar, Bekaa, Baalbek-Hermel, South, Nabatieh) or "Abroad" selection.
• We do not collect precise GPS or device-level location.
• IP addresses are logged with login events for security, abuse detection, and fraud prevention, and retained for 90 days.

g) Sensitive Data: what we do not collect

• We do not collect religion, sect, political views, sexual orientation, or health data.
• We enforce this at the platform level: employer HR queries naming religion or sect, political affiliation, age, marital or family status, physical appearance, sexual orientation or gender identity, or disability are hard-blocked and never reach our AI provider. The attempt is logged as a compliance event for moderation.
• Gender and nationality are not blocked. Both are lawful hiring criteria in Lebanon — genuine occupational requirements exist, and Lebanese labour law requires work-permit verification with certain professions restricted to nationals. An employer may therefore ask about either, and our AI assistant may answer. We hold no gender or nationality field about you: any such query is matched against the free text of your profile and CV, and we neither infer nor derive these attributes.

h) Financial Info

• Cheghel does not currently process payments and does not share any payment data with third parties. When paid subscriptions launch, our payment provider will be named here before any payment is taken.
• We never store full card numbers, CVV, expiry dates, or banking credentials. These never touch our servers.
• We store only: subscription status, the last four digits of the card (if the payment processor returns them), transaction IDs, amount, currency, and timestamps.

i) Data Linked to You vs. Not Linked to You

Reviewer identity on company reviews is stored internally but is never returned by any API, UI, or admin screen. See Section 5.

4. How We Use Your Data

a) App Functionality

• Match seekers with jobs using profile data and search filters.
• Process applications (CV + profile + the job you applied to).
• Manage reviews, including moderation and employer replies.
• Manage subscriptions and payment status.

b) Communications

• Transactional emails: welcome, application received, application status changes, review published, password reset, billing receipts.
• Weekly "Top Jobs for You" digest: opt-in only, with a one-click unsubscribe link in every email.
• WhatsApp job alerts via Twilio: opt-in only, and you can opt out at any time from your profile or by replying STOP.
• We do not send marketing or promotional emails without your explicit consent.

c) Analytics

• We use PostHog for product analytics, anonymised by default.
• Analytics only load if you accept analytics cookies in the consent banner. If you choose "Essential only", PostHog is never initialised.
• We use analytics to understand feature usage in aggregate, not to profile individuals.

d) Product Personalisation

• AI job recommendations based on your extracted profile and activity.
• Search result ranking tailored to your history.
• All personalisation happens server-side. The results are visible only to you.

e) Fraud Prevention and Security

• Detecting spam accounts, fake jobs, and abusive behaviour.
• Rate limiting to prevent automated abuse.
• Login anomaly detection based on IP and session patterns.

f) Legal Compliance

• Retaining financial records for 7 years as required by Lebanese tax law.
• Responding to valid legal requests from Lebanese authorities where there is a lawful basis.

5. The 3-Tier Information Wall

Cheghel uses a tiered disclosure model for job listings:

Reviewer identities are never disclosed: not to other seekers, not to employers, not through the admin UI, and not via any API. This is a permanent protection under Law 81/2018 and is enforced at the database row-level security layer.

6. Legal Bases for Processing

7. Third-Party Service Providers

We rely on the following providers. Each one processes data only for the purpose listed below, under a written contract.

What we do NOT do:

• We do not sell your personal data.
• We do not share your data with advertisers.
• We do not use data brokers.
• We do not transfer your data to any third party outside the providers listed above.

8. Data Retention

9. Your Rights

Under Lebanon Law 81/2018 and GDPR-equivalent principles, you have the following rights:

• Right of access: request a copy of the personal data we hold about you. Self-serve at /data-request.
• Right of deletion: request deletion of your account. Self-serve at /data-request.
• Right of correction: edit your profile, or email privacy@cheghel.com.
• Right of portability: get a JSON export of your data via /data-request.
• Right to withdraw consent: unsubscribe links in emails, WhatsApp STOP, and your profile settings.
• Right to object to a specific processing activity: email privacy@cheghel.com.
• Right to lodge a complaint with the relevant Lebanese data protection authority.

We respond to all rights requests within 30 days, as required by Law 81/2018. Self-serve actions are immediate.

10. Children's Privacy

• Cheghel is not intended for users under 18.
• We do not knowingly collect data from minors.
• If we discover that an account belongs to a minor, we delete it within 7 days.
• Parents or guardians can email privacy@cheghel.com to report a minor's account or request its deletion.

11. International Data Transfers

Your data may be processed in the United States or the European Union by our providers (see Section 7). Where available, we rely on standard contractual clauses or equivalent safeguards. By using Cheghel from Lebanon, you consent to this transfer for the purposes described in this policy.

12. Security Measures

• Encryption in transit using TLS 1.2 or higher.
• Encryption at rest at the database level.
• Row-level security on every database table.
• Two-factor authentication available on your account.
• Regular security reviews and dependency audits.
• Documented incident response plan. Any confirmed breach is notified within 72 hours, as required by Law 81/2018.

13. Cookies and Tracking

• Essential cookies (cannot be disabled): authentication session, language preference, and your cookie consent choice itself.
• Optional cookies (require consent via the banner): PostHog analytics.
• No third-party advertising trackers.
• No Meta / Facebook pixels.
• No cross-site tracking.
• No device fingerprinting.

See our Cookie Policy for details and controls.

14. Mobile App Privacy (Future iOS and Android Apps)

Cheghel is currently a web and Progressive Web App. When native iOS and Android apps launch, the following additional rules will apply, consistent with this policy:

• App Tracking Transparency (ATT): We do not track you across apps or websites owned by other companies. Our ATT answer is "not tracking".
• No IDFA or IDFV collected or used.
• Push notifications: opt-in only, with system-level and in-app toggles.
• Background location: not collected.
• Contacts, photos, microphone, camera: accessed only with your explicit permission, and only when you use the feature that needs it (for example, uploading a profile photo).
• Face ID / Touch ID: used on-device only to unlock the app if you enable it. We never see biometric data.

15. Changes to This Policy

• We notify users of material changes by email and an in-app banner, at least 30 days before they take effect.
• Non-material changes (typo fixes, clarifications, broken links) may be posted without notification.
• Previous versions are available on request.

16. Contact Us

• Privacy questions: privacy@cheghel.com
• Data access, export, or deletion requests (fastest route): /data-request
• Legal notices: legal@cheghel.com
• Postal: Beirut, Lebanon (full address at company registration).