Privacy Policy

Who we are

CORTAL ("we", "us") operates a recruitment platform at cortal.org that connects employers with job candidates and coordinates interviews on their behalf. This policy explains what personal data we collect, why, and the choices you have. It applies to employers using our dashboard, candidates whose profiles are in our talent pool, and visitors to our website.

Data we collect

Employer accounts: name, work email, company name, official legal name and commercial registration number, team member accounts, and billing records.

Candidates: information submitted through our application form or provided to our recruitment team — name, contact details, CV, job title, experience, education, expected salary, and city. We also keep a record of each candidate’s consent to be contacted.

Messages: when we contact candidates on WhatsApp, we store the conversation to coordinate interviews and honour opt-out requests.

Technical data: when an employer reports a technical issue we capture the page address and browser version to help us fix it.

How we use data

To match candidates with employer searches, to schedule interviews, to send WhatsApp messages related to job opportunities, and to operate, secure, and bill for the service. We use AI systems to interpret employer requests and to draft messages; AI output is always constrained to the data actually held in our system.

WhatsApp messaging and consent

We only message candidates who have consented to be contacted. The first message is always a pre-approved template about a job opportunity. A candidate can stop all messages at any time by replying with the word "إيقاف" (stop); we record the opt-out immediately and never message them again.

Who we share data with

Subscribed employers see the profiles of candidates matching their searches; full contact details are revealed only after the employer expresses interest in a candidate. We use trusted processors to run the service: Supabase (database hosting), Meta (WhatsApp Business Platform), Anthropic (AI processing), Moyasar (payment processing), and Netlify (website hosting). We do not sell personal data.

Retention

Candidate profiles remain in our pool while they are relevant for job matching. Opted-out candidates are excluded from all outreach permanently. Employers can ask us to remove their account data when their subscription ends; we keep invoices as required by law.

Security

Data is stored with per-company isolation enforced at the database level, encrypted in transit, and accessible to our staff strictly on a need-to-know basis. Payment card details are handled entirely by Moyasar and never touch our servers.

Your rights

You may request access to, correction of, or deletion of your personal data, and candidates may withdraw consent to be contacted at any time. Write to us and we will respond within a reasonable period.

Cookies

We use only functional cookies: your language preference, your theme preference, and the session cookie that keeps you signed in. We do not use advertising or cross-site tracking cookies.

Changes

We will post any changes to this policy on this page and update the date above. Material changes will be announced to signed-in customers.