Privacy Policy
Your data protection is our top priority
Introduction
Tawked Systems Company (National Unified Number: 7054950501) operates Astr and is the controller of personal data collected to provide the platform's services. This policy explains processing practices and your rights under the Saudi Personal Data Protection Law (PDPL).
This policy explains how we collect, use, process, and protect the information you provide when using our platform at astrsa.com.
Please note: This policy explains data processing; visiting the site does not mean you consent to every type of processing. Where consent is required, it must be requested for the specific purpose and may be withdrawn as explained in the Your Rights section.
Information We Collect
We collect different types of information to provide and improve our services:
1. Account Information
- Phone number when you choose signup or sign-in using a code sent to your phone
- Full name
- Email address when you choose email or Google sign-in, or add it to your account
- Profile picture (optional)
2. Resume Data
- Personal information (name, address, contact details)
- Work and professional experience
- Educational qualifications and certificates
- Skills and languages
- Professional profile and career objectives
3. Usage and Technical Data
- IP address and browser type
- Device type and operating system
- Pages visited and visit duration
- Visit source (Referrer)
4. Subscription and Payment Information
- Astr offers free features within usage limits and paid subscriptions for additional features.
- Subscription payments are processed by a payment provider; Astr does not store your full card details or card verification code.
- We retain subscription and transaction records, such as amount, currency, payment status, and transaction reference, to activate subscriptions, follow up on payments, and provide customer support.
5. Assistant conversations and support requests
We store user messages and assistant replies. Records may also include resume context relevant to the request, proposed commands, execution results, errors and technical request information. When you contact support, we process your message and any attachments you send to address your inquiry.
Authorized Astr team members may review these conversations through administration tools for support, troubleshooting, checking that requests were carried out and improving assistant quality. These conversations are not public and are not displayed to other users.
Which data is required or optional?
A contact identifier appropriate to your chosen sign-in method is required; not every method requires both a phone number and an email address. Your profile photo, resume details and attachments are optional, but a feature you request may need resume text or a file to process. Without the necessary input, that feature may not be available. Billing and verification information required for payment is requested when you subscribe.
How We Use Your Information
We use the information we collect for the following purposes only:
✅ Providing Services
Creating, saving and exporting resumes, and carrying out requested grading, matching, translation, PDF-tool and teacher-portfolio tasks according to the tool selected
✅ Content Improvement
Providing smart suggestions to improve your resume
✅ Service Improvement
Analyzing usage patterns to develop and improve user experience
✅ Communication
Sending sign-in codes and account, subscription and referral-reward notifications, and responding to support requests
✅ Friend invitations
Attributing visits and signups to invitation links, checking eligibility, awarding credits and preventing unearned repeat rewards
✅ Security
Protecting the platform from unauthorized use
❌ What We Don't Do With Your Data
- • We don't sell your personal data to any third party
- • We don't share your resume with employers without your permission
- • We don't use your data for third-party targeted advertising
Legal bases for processing
The basis for processing depends on its purpose. We do not rely on one blanket consent for every use:
- Performing our agreement with you: processing necessary to create your account, provide features you request, save account-linked resumes, manage subscriptions and rewards, and support your use of the service.
- Legal obligations: retaining required transaction records and handling rights requests and binding requests from competent authorities under applicable law.
- Legitimate interests, where their legal conditions are met: protecting the service, preventing fraud and abuse, diagnosing faults and measuring usage to improve the service, while respecting your rights, minimizing the data used and not applying this basis to sensitive data.
- Consent: where processing requires your consent, including teacher-portfolio organization and PDF translation inputs for which a consent request is shown before submission. Consent applies to the specified purpose; choosing a feature is not consent to unrelated uses.
Data Protection & Security
Data-protection measures include connection encryption, account verification and restricted administrative access. These measures are not an absolute guarantee against errors or security incidents:
SSL/TLS Encryption
All data is encrypted during transfer via HTTPS
Secure Servers
Data stored with trusted providers with advanced protection
Secure Authentication
Sign in with Google or a one-time code sent to your email or phone, with accounts and sessions managed using BetterAuth
Data Storage
The editor uses browser storage, and resumes linked to your account are saved in the cloud when you are signed in
Free Features and Paid Subscriptions
Astr lets you start free within account limits, with optional paid subscriptions. When subscribing:
- ✓Payment processing: You enter payment details with the payment provider to complete the transaction.
- ✓Clear costs: Review the displayed plan price, duration, and terms before confirming payment.
- ✓Subscriptions: Duration, benefits, and renewal terms depend on the selected plan.
- ✓Transaction records: Astr retains the information needed to link payments to your account, manage subscriptions, and provide support, without full card details or the verification code.
Note: Free access does not mean unlimited use of every feature. Service pages explain free-account limits and features that require a subscription.
Use of Artificial Intelligence
We use AI to improve, translate and analyze content and organize teacher portfolios when you request these features. Here's what you should know:
What We Send to AI
Depending on the feature, we may send the text you enter and the resume data needed for your request to an AI provider. When you organize a teacher portfolio with AI, after your consent, inputs include your notes, filenames, extracted text, page images and uploaded images prepared for analysis. Original evidence files stay in your browser and are not sent in their original format through the organization service
Model providers and request routing
Some features use OpenRouter to route requests to the selected model provider; others may connect directly to an AI provider. Both the routing service and the model provider may therefore process inputs. The provider varies with the feature and its configuration.
How different tools process files
Not every tool uses the same file-processing path. The following distinguishes local processing from sending data to a server or AI service:
- Merging, splitting, writing on and compressing PDFs, and converting between images and PDF: file contents are processed in your browser and are not uploaded to a server to perform these operations. Technical usage-event recording is separate from file content.
- Converting between PDF and Word or PowerPoint: the file is uploaded to the conversion service, which processes the uploaded copy and the output file. These conversions are not browser-only operations.
- PDF translation: text is extracted in the browser, then the text and requested language are sent to the translation and AI service after your consent. Local text extraction does not mean that the content stays on your device.
- Teacher portfolios: original attachments remain local, but AI organization sends notes, filenames, extracted text, page images and prepared images after consent. Resume import, analysis or translation tools may instead upload a file and retain request- and account-linked data; those paths differ from the local PDF tools.
When uploading documents containing other people's data, such as student names or photos in teaching evidence, make sure you have the necessary legal basis or permission. Include only data needed for the purpose and remove unnecessary identifying information.
Data Sharing with Third Parties
Astr uses the following provider categories to operate the features you use. Not every provider receives all your data: the scope depends on the task and enabled feature. Disclosure to a competent authority may also be required in response to a legally binding request:
| Service | Purpose | Data Shared |
|---|---|---|
| Google and phone verification-code delivery providers | Authentication and sign-in using your chosen method | Account identifier, name, email and photo made available by Google, or the phone number and verification code required for delivery, depending on the sign-in method |
| DataFast and PostHog when enabled | Usage analytics, feature performance and error monitoring | Device and browsing data, usage events and errors; signed-in events may be linked to an account identifier in PostHog, so not all analytics data is anonymous |
| noon payments and Polar | Payment processing and subscription management | Payment information required by the provider; transaction reference, amount, currency and payment status held by Astr |
| OpenRouter and AI model providers | Content improvement, translation, analysis and teacher portfolio organization | Text and resume data depending on the request; for portfolio organization after consent: notes, filenames, extracted text, page images and images prepared for analysis |
| Vercel and Supabase | Platform hosting, request processing, databases and storage for service-related files | Account data, resumes, conversations, files and records needed to process a request, depending on the service; local-tool files are not all uploaded to storage |
| Resend email services | Delivering sign-in codes and account, subscription, reward and user-requested messages | Recipient address and message content, plus a file or download link when you request an email copy |
| Upstash and caching and usage-limit services | Usage controls, abuse prevention and operational caching | Identifiers, usage counters and technical data needed for the task |
| Office file conversion service | File conversion between PDF, Word and PowerPoint | The file you select for conversion, the output file and necessary job information |
Processing outside Saudi Arabia
Your data may be processed or stored outside Saudi Arabia by the hosting, database, analytics, email and AI services used to fulfil your request. Processing locations depend on the provider and service configuration; using Astr from Saudi Arabia does not mean all data remains within the Kingdom.
Transfers of personal data outside Saudi Arabia are subject to the law and its regulations, including a lawful basis and safeguards appropriate to the transfer. This policy is not blanket consent to unrestricted transfers. To ask about providers involved in a service you use or exercise your rights, contact support@cushk.sa.
Cookies
We use cookies for the following purposes:
Essential
To operate the platform and remember your login
Analytical
To understand how the platform is used and improve it
Functional
To remember your preferences and settings
You can control cookies through your browser settings. Disabling some cookies may affect your experience. When you open an invitation link, we use a random browser identifier and a 30-day cookie to attribute the signup and reward. We do not disclose the invited friend’s personal details to the inviter.
Browser Storage and Cloud Saving
Storage depends on the tool and whether you are signed in:
- •The resume editor uses browser storage while you work. Changes to resumes linked to your account are automatically saved on our servers when you are signed in, so you can retrieve them from your account
- •You can clear local data in your browser settings; this does not delete cloud copies saved in your account. Local drafts may be lost when browsing data is cleared or removed by the browser
- •Your teacher portfolio and original attachments are saved in your browser after you accept the draft; the portfolio is not synced with your Astr account. AI organization sends the analysis inputs described above after your consent, but does not enable cloud saving for the portfolio
Your Rights (Under PDPL)
You may exercise the following rights subject to the conditions and exceptions of the Saudi Personal Data Protection Law, identity verification and protection of other people's rights:
🔍 Right of Access
Request a copy of your personal data that we hold
✏️ Right of Rectification
Update or correct your inaccurate data
🗑️ Right of Erasure
Request permanent deletion of your personal data
📤 Obtaining a copy of your data
Obtain your data in a readable format
🚫 Right to Object
Object to the processing of your data for certain purposes
⏸️ Right to Restrict Processing
Request restriction on how we use your data
How to exercise your rights: Send your request to support@cushk.sa, specifying the right you wish to exercise and account information needed for verification. Rights requests are handled and eligible requests fulfilled within 30 days without undue delay. Where statutory grounds apply, this may be extended by no more than 30 additional days, with advance notice explaining why. If a request cannot be fulfilled in full or in part, we explain the legal reason.
Withdrawing consent and making a complaint
Where processing relies on your consent, you may withdraw it for future processing by contacting support@cushk.sa and identifying the feature and purpose. A feature that depends on that consent may no longer be available. Withdrawal does not affect the lawfulness of earlier processing or processing based on another lawful basis. Stopping use of an optional feature does not erase previous requests; you may request deletion of the relevant data under your rights.
You may complain to us at the same email address. You may also contact Saudi Arabia's competent personal-data protection authority through the National Data Governance Platform.
Data-subject rights and complaint channels at SDAIAData Retention Period
Retention depends on the type of data, the processing purpose, legal obligations and rights requests, as follows:
- •Account data: While the account is active. A deletion request starts a 30-day recovery period; signing in during this period cancels the request. After that, the account and linked data are deleted, subject to the exceptions below. To prevent repeat invitation rewards after account deletion and re-registration, we retain a keyed one-way digest of the verified contact identifier used to qualify for a reward. This digest contains no name or CV and is not used to contact you.
- •Resumes: While the account is active unless you delete them. Account-linked data and files are removed as part of permanent deletion after the 30-day recovery period.
- •Financial transaction records: Retained for accounting and statutory purposes for 7 years, with account links removed upon deletion. Deleting an account does not delete these records.
- •Analytics and technical records: Retention is determined by the record's purpose, the need to measure service performance, troubleshoot errors, support security and prevent abuse, legal obligations and deletion requests. There is no single fixed period for all these records; continued retention depends on a necessary purpose, not simply the ability to store data.
- •Assistant conversations: Account-linked conversations are stored to provide service context, support and error review. Account-linked records are removed during permanent account deletion after the 30-day recovery period. You may also contact us to request deletion of specific data under your rights. Technical records not linked to an account follow the purpose-and-necessity criteria above.
When there is no longer a legitimate or statutory need to retain personal data, it must be destroyed or anonymized so the person cannot be reidentified. Closing a page or completing file processing does not immediately remove every copy from every system. Reviewing a deletion request includes considering relevant data held by processors and in backups under applicable requirements.
Policy Updates
We may update this policy from time to time. When making significant changes:
- •We will update the "Last updated" date at the top of the page
- •We will send an email notification for important changes
- •We will display a clear notice on the platform
Contact Us
If you have any questions or inquiries about our privacy policy or data practices:
Tawked Systems Company
National Unified Number: 7054950501
Saudi Arabia