Privacy for candidates

Who is responsible

The employer you applied to decides how your CV is used and is responsible for it. Masirah is the tool they use, and handles your CV only on their instructions.

What is processed

Your CV file and the details read from it: your name and contact details, work history, education, skills, languages and certifications.

How it is used

To help the employer compare applications for a job. An AI model reads your CV and suggests how well it matches the job, with its reasons. The suggestion is advice only: a person at the employer makes every decision.

Your name, contact details and education dates are removed before your CV is scored. Gender, age, photograph, nationality and marital status are not used in scoring.

AI providers

The AI models are run by Anthropic and OpenAI. Under their terms, neither uses what Masirah sends to train its models. Each deletes it within 30 days, unless it must be kept longer to investigate misuse or because the law requires it.

Where it is kept

In private storage in Frankfurt, Germany. In Masirah, only people at the employer you applied to can see it. Reports of errors in Masirah go to Sentry, also in Frankfurt, and never include what your CV says.

How long it is kept

Your personal data is deleted automatically once your application has been inactive for the period the employer chooses: 6, 12 or 24 months. If the employer shortens that period, nothing is deleted under the new period for 7 days. It is kept longer only if the employer has shortlisted you or has turned automatic deletion off.

Your rights

To see, correct or delete your data, contact the employer you applied to. Once they record your request to delete it, Masirah deletes your personal data, normally within the hour. If a fault delays it, the deletion is retried until it completes. A record that a decision was made stays, without your personal data.

The waitlist

A company that joins the waitlist on masirah.online gives a work email and nothing else. It is kept privately, used only to tell that company once when its account opens, and never shared or used for marketing. To have it removed, reply to that email.