سياسة الخصوصية.

Your resume says a lot about you, so we want to be clear about what we do with it. This page covers the data ShiftAssigner collects, why we need it, who helps us handle it and what you can do about it.

The short version: we use your data to run your account and build your resumes, and that's it. We don't sell it. Analytics only runs if you say yes, and you can download your data or delete your account yourself, whenever you like.

Who we are

ShiftAssigner is run by Teklick, a company based in Tunisia. When this page says “we” or “us”, that's who we mean, and we're the ones responsible for your data. If you have a question about any of this, write to us at support@shiftassigner.com.

Data we collect

What you give us

• Your account. Your name, email address and password. We never store the password itself, only a secure hash of it. If you fill in your profile, we also keep your bio, location, website and photo.
• Signing in with Google, GitHub or LinkedIn. If you do, that service tells us your name, email address and profile picture. We never see your password there.
• Your resumes. Whatever you type into the editor: jobs, education, skills, contact details. Some country formats ask for things like a photo, date of birth, nationality, marital status or visa status. Those are always optional, and you decide what goes in. A photo can reveal things like your ethnic origin or religion, so only add one where employers in that country expect it.
• Resumes you import. When you upload a PDF or Word file for AI import, we read the text out of it and then let the file go. We don't keep a copy.
• Messages to support. Your name, email and whatever you write to us through the contact form or Help & Support.

What we collect as you use the site

• Technical details. Your IP address, browser and device, and the usual server logs every website keeps to run and protect itself. On the sign-up and contact forms we also use your IP address and Google reCAPTCHA to stop spam and fake accounts.
• Your plan and usage. Which plan you're on, how many AI credits you have left, which AI tools you've used and when.
• Analytics, only if you agree. If you click “Accept” on the cookie banner, Google Analytics (through Google Tag Manager) records which pages you visit and a few key moments, like signing up or starting checkout. Before anything is sent, we remove private bits from page addresses, such as password-reset links.

Payments

Dodo Payments handles our payments. They're our reseller (the “merchant of record”), so your card or other payment details go straight to them and never touch our servers. From them we only learn what we need to run your subscription: your plan, whether it's monthly or yearly, when it renews, and the email you used to pay.

How we use your data

Privacy laws ask us to say why we use each piece of data and what gives us the right to. Here's how that works for us:

We don't sell your data, and we don't use it for ads.

AI features

When you use one of the AI tools, we send the text it needs, such as a bullet point, your resume or a job description, to OpenRouter. OpenRouter passes it to the AI model that writes the answer. You see the result, and it only goes into your resume if you choose to use it. We don't use your resumes to train AI, and we tell OpenRouter to only use AI providers that don't store what we send or train on it.

The results of the ATS review, country check and job match are saved to your account, so you can look back at them (seeing that history is part of the paid plans). They're deleted with the resume they belong to, with your account, and in any case after 12 months.

AI gets things wrong sometimes, so read what it gives you before you send it to an employer. It's also a good idea to keep things like ID or passport numbers out of anything you send to the AI tools.

Portfolio websites, contact forms and team passes

Your portfolio website. If you make a portfolio, what you put in it (your name, photo, headline, work, links and anything else) is public at its address once you publish it, and search engines can list it unless you switch that off in its settings. Images you upload for it are stored with your other files. We count visits without recording who visited. You can unpublish or delete it at any time.

Messages sent through a portfolio’s contact form. When a visitor writes to a portfolio’s owner, we email the owner the visitor’s name, email address and message so they can reply. We don’t keep the message once it’s sent; we only count how many arrive each day, to stop spam. If you write to someone this way, they receive your details.

Team passes and gifts. If someone buys a pass for you, they see whether your code has been used. If they asked us to email you the code, we keep your email address and the name they gave, so they can see who received which code. Once at least 3 people in a group have started, the buyer sees totals for the whole group (resumes tailored and the average score gain, applications, interviews and offers), never one person’s resume, activity or details. A coach who takes the free trial gives us the name of their organisation.

Who we share it with

We don't hand your data to anyone except the companies that help us run ShiftAssigner, and each one only gets what it needs for its job:

Beyond that, we'd only share your data if the law forces us to, if we need to protect someone's safety or our rights, or if ShiftAssigner is ever sold or merged. In that last case, this policy would still apply to your data.

Cookies and local storage

We keep cookies to a minimum. Here's everything we use:

• A sign-in cookie (shiftassigner_token). It keeps you signed in for up to 7 days, and scripts on the page can't read it. The site can't work without it.
• A short-lived security cookie. It lasts 10 minutes while you sign in with Google, GitHub or LinkedIn, and stops anyone faking that sign-in. The site needs this one too.
• Browser storage. This remembers things on your device: light or dark mode, language, your cookie choice, your profile details for display, and the resume you're editing. Your profile and resume are removed from the browser when you sign out.
• Analytics cookies. Google Tag Manager and Google Analytics aren't loaded at all until you click “Accept”, so nothing is sent to Google before that. Say no and they stay off.
• reCAPTCHA. Google's spam check runs only on the sign-up and contact forms, and it may set its own cookies there.

Our fonts are served from our own site, not from Google. You can change your analytics choice whenever you want with the “Cookie settings” link at the bottom of the site, and we ask again every 6 months.

International transfers

We're based in Tunisia, and our servers and database run in the European Union. Several of the companies above are also based in the United States (OpenRouter and the AI providers it uses, Google, GitHub, LinkedIn), while photos are stored in the EU (Stockholm) and emails are sent by Brevo from the EU.

Neither Tunisia nor the United States as a whole has an EU “adequacy decision”, so when your data leaves the EU or UK we protect it with the European Commission's standard contractual clauses in our agreements with these companies, or rely on the EU-US Data Privacy Framework where a US company is certified under it. You can ask us for a copy of the relevant safeguards at support@shiftassigner.com.

How long we keep it

• Your account and resumes stay for as long as you have an account. Delete your account in Account settings (Security) and it's gone straight away, with your resumes, photos, AI results and support tickets. If you ask us by email instead, we'll do it within 30 days.
• A resume you delete is gone straight away, with its photo and its saved AI results.
• Sign-ups that are never activated are deleted after 30 days.
• Saved AI results are deleted after 12 months.
• Support conversations stay while your account is open. If you wrote to us without an account, we delete them 12 months after the last message. Either way, you can ask us to delete them sooner.
• Usage statistics (which AI tool was used and when) are deleted after 2 years. When you delete your account, the ones we keep no longer point to you.
• Billing records (plan changes and credits) are kept for as long as tax and accounting laws say we must.
• Records of what our team did in the admin panel, including opening your resume, are kept for 3 years so we can check who accessed what.
• Server logs are only kept for a short time, for security and fixing problems. Email addresses in them are partly hidden.
• Your portfolio stays until you delete it or your account. Unpublishing takes it offline straight away, and images you remove from it are deleted soon after.
• Contact-form messages sent through a portfolio aren’t stored: they’re emailed to its owner and then dropped.

Your rights

It's your data, so depending on where you live you can:

• ask what we have about you and get a copy of it. You can download it yourself, as a file you can reuse elsewhere, in Account settings (Security);
• fix anything that's wrong. You can change most of it yourself in Account settings and the editor;
• delete your account and everything in it, yourself in Account settings or by asking us;
• object to some uses of your data, or ask us to pause them;
• switch analytics off at any time with “Cookie settings”.

Just email support@shiftassigner.com from the address on your account, or open a ticket in Help & Support. We'll get back to you within 30 days. If you're not happy with how we handle it, you can also complain to a data protection authority: in Tunisia that's the INPDP (Instance Nationale de Protection des Données Personnelles), and in the EU or UK it's your local regulator (in France the CNIL, in the Netherlands the Autoriteit Persoonsgegevens, in Belgium the APD/GBA).

Security

Everything travels over HTTPS. Passwords are stored as salted hashes, never as plain text. Your session lives in a secure cookie that page scripts can't read, and only a few people on our team can access user data. Every time one of them opens a resume, it's recorded. No website can promise perfect security, though, so please use a strong password you don't use anywhere else, and tell us right away if something looks wrong with your account.

Children

ShiftAssigner is for people aged 16 and over, and you confirm your age when you sign up. We don't knowingly collect data from anyone younger. If you think a child has made an account, let us know and we'll delete it.

Changes to this policy

As ShiftAssigner grows, this page will change too. We'll update the date at the top, and if a change really matters, we'll tell signed-in users by email or in the app before it takes effect.