Privacy Policy

HRvana is operated by Sky Vaults SARL AU, a single-member limited liability company based in Agadir, Morocco. For the data described here, Sky Vaults is the controller - the party that decides why and how it is processed.

An employer who receives your application becomes responsible for its own use of your data from that point, independently of us. Section 'Employers as separate controllers' explains what that means for you.

Data protection contact: hello@hrvana.ai.

Account details: your name, email address, password (held by our authentication provider, never by us in readable form) and the role you registered under.

Candidate profile: the CV you upload and what our parser extracts from it - work history, education, skills, certifications, projects - plus anything you add or correct yourself.

Employer details: company name, professional email domain, billing details and the job postings you create.

Usage data: IP address, browser, device and pages visited.

We do not ask for, and ask that you do not upload, special category data - health, religion, political opinion, trade union membership, ethnicity or sexual orientation. If your CV contains any, you are providing it on your own initiative and we process it only as part of your profile.

Performance of a contract: creating your account, hosting your profile, transmitting your application to an employer, and providing a paid plan to an employer.

Your consent: sending marketing email, and making your profile discoverable to employers you have not applied to. You can withdraw either at any time without affecting the rest of the service.

Our legitimate interests: keeping the platform secure, preventing fraud and abuse, and improving how matching works. We balance these against your interests and you can object.

Legal obligation: retaining billing records and responding to lawful requests from authorities.

Your CV is read and scored automatically, and applicants are ranked against the requirements of a role. This is profiling.

The score does not by itself decide whether you are hired or rejected: a person at the employer reviews the shortlist and makes the decision.

You may ask us how a score was reached, ask for human review of any automated ranking that affects you, contest the outcome, and provide corrections. Write to hello@hrvana.ai.

If an employer ever uses our tools to reject candidates without any human involvement, that is a decision taken by that employer and you may exercise the same rights directly against them.

Employers: they see your profile when you apply to their job, or if you have consented to being discoverable.

Identity and access management: our authentication provider handles sign-in and stores credentials.

Cloud hosting and databases: infrastructure providers that store the platform's data.

AI providers: they receive CV text in order to extract and score it. They process it on our instructions, are contractually barred from using it for their own purposes, and must not use it to train their models.

Email delivery and payment processing, for service messages and for employer billing.

We do not sell your data and we do not share it for advertising.

Some of the providers above operate outside Morocco, so your data may be transferred abroad.

Moroccan law requires authorisation from the CNDP before personal data is transferred to a country that does not offer an equivalent level of protection, and we rely on that route for transfers from Morocco.

Morocco has not received an adequacy decision from the European Commission. Where data reaches us from the European Economic Area, transfers are made under the European Commission's Standard Contractual Clauses together with additional safeguards where they are needed.

You can ask us which providers are involved and which safeguard applies to a given transfer.

An unverified signup is stored as a draft and deleted if the email address is not confirmed within 30 days.

An active account is kept for as long as it is open. If you stop using it, we delete or anonymise the profile after 24 months of inactivity, having contacted you first.

Applications and the correspondence attached to them are kept for 24 months after the role closes, so that both sides have a record.

Security and access logs are kept for 12 months.

Billing records are kept for as long as accounting and tax law requires, which is currently ten years in Morocco.

When you ask us to delete your account we do so, except for the records we are legally required to keep.

Data is encrypted in transit, access to production systems is restricted and logged, and passwords are never stored by us in readable form.

No system is perfect. If a breach occurs that is likely to put your rights at risk, we will notify the CNDP and, where required, the relevant European authority, and we will tell affected people directly without undue delay.

You can ask for access to your data, correct it, have it deleted, restrict or object to its processing, receive a portable copy, and withdraw a consent you gave.

Write to hello@hrvana.ai. We will reply within 30 days and will not charge you for a reasonable request.

If our answer does not satisfy you, you can complain to the CNDP in Morocco, or to the data protection authority where you live if you are in the European Economic Area or the United Kingdom.

HRvana is intended for people aged 18 and over, and accounts may not be created by children. If we learn that an account belongs to a minor we will remove it.

We set only the cookies needed to keep you signed in and to remember your language. We do not use advertising or cross-site tracking cookies, so no consent banner is required for them.

If that changes, we will ask for your consent before setting any non-essential cookie.

If we change this policy in a way that materially affects you, we will update the date above and tell account holders by email before the change takes effect.