Privacy Policy

This policy applies from the date it is published on the site. It explains what data Badali collects, why it uses it, who receives it, how long it is kept and how you use your rights.

1. Who is responsible for your data

Badali (منصة بدالي) provides the service at getbadali.com, commercial registration 7055012772. It is the controller of the personal data Badali processes.

For anything about your data: [email protected]

2. Data Badali collects

Account data

• Your name and email address.
• Your password, if you sign up with email. Badali stores a one-way hash of it (scrypt), never the password itself.
• If you sign in with Google: Badali receives only your name, email and profile picture link from Google.
• The IP address and browser type of each sign-in session, for the life of the session.

Profile and CV

• The CV you upload: Badali keeps the file in your account. You can download or delete it at any time. The CV is read in your browser to fill your profile. Badali never sends this file to an employer.
• The CV Badali makes: Badali builds an English CV from your profile and puts your managed @najdmail.com address on it instead of your personal email. This is the CV uploaded with every application.
• Translation: if you write your profile in Arabic, it is translated into English by Anthropic's Claude Haiku model. The translation is saved in your account and you can edit it.

Profile fields

Profile set-up asks for these fields. Some are optional. Many employers' application forms need them:

• Name and contact: first and last name in Arabic and English, father's and grandfather's names, email, mobile number, LinkedIn and portfolio link.
• Personal details: nationality, date of birth, gender, marital status, national ID or Iqama number (optional), country and city of birth, passport number, issue date and expiry date.
• Address: country, city, street address and postal code.
• Education and languages: degree, major, graduation year, GPA, Arabic and English level.
• Work and salary: current or last job title, years of experience, availability or notice period, current salary and expected salary.
• Work eligibility: your status in Saudi Arabia (citizen, resident, work permit, other), whether you may work in Saudi Arabia, and whether you need sponsorship.
• Experience and skills: summary, experience, education, skills, certifications, extra sections and cover letter.

Application answers

Badali saves your answers to employers' questions so it can reuse them in later applications. Some forms ask sensitive questions, such as nationality, ID, passport, gender, marital status, disability, religion and ethnic origin. Badali sends these answers only to the employer that asks for them, for a job you chose.

Automatic answers when nothing is saved

Under the agreement you accept at sign-up, Badali answers some questions automatically when you have not saved an answer. You can change these in "Default answers" in your profile, and a saved answer always comes first:

• Consents: Badali accepts the privacy and application terms an application cannot be sent without. It never accepts marketing, and never agrees to contact your current employer.
• Keeping your CV for future openings at the employer, or sharing it with its group companies: Badali agrees, even when this is optional.
• Interview recording: "Yes" by default; you can change it.
• Must-have job requirements: the answer that meets the requirement, because when you apply you confirm you meet the job's stated requirements.
• Willingness: "Yes" to relocating, travel, working on site and accepting the job's stated conditions.
• Work eligibility: you may work, and you do not need sponsorship.
• Disability: "No".
• Religion and ethnic origin: the form's own "prefer not to say" is chosen when it offers one. If the question is required and has no such option, "Islam" or "Arab" is chosen when offered. If neither is offered, you are asked once. An optional question is left blank. You can change this in your default answers.
• Salary: "Negotiable" for expected salary, and "0" for a required current salary.
• Missing required fields, such as an ID or passport number, are filled with zeros (0000000000), never an invented number.
• Truthfulness declarations, background checks and arbitration: accepted when required.

Employer hiring-system accounts

Badali creates accounts in your name on hiring systems such as Workday and SuccessFactors, only for the jobs you choose. Badali creates a password for each account, stores it encrypted (AES-256-GCM) on its servers, and never shows it to you or anyone else. It also keeps the encrypted sign-in session for a limited time. You can disconnect any account in Settings; its password and session are deleted at once.

Managed email

Each user has an address on @najdmail.com. Badali receives employers' emails there and automatically reads verification codes, links and application receipts, to finish your application and confirm it was sent. Messages are stored on Badali's servers in Jeddah, and the original received messages and their attachments are encrypted. Mail passes through the email provider Resend. When forwarding is available, a copy is sent only to a personal address you have verified with a code.

Search log

Badali keeps what you search for in the job catalogue and the results you open, with your account id if you are signed in. It uses this only to improve search results, and deletes it after 90 days.

Emails to companies

When you use Send Emails, Badali keeps the companies you chose, the message and the delivery result.

Payment

Paid plans are not open yet; today only the free start is available, so no payment data is collected. When paid plans open, payments will go through Moyasar with mada, Visa, Mastercard and Apple Pay. You will enter your card on Moyasar's page; card details will never reach Badali and will never be stored by it. Badali will keep only the Moyasar payment id and status, the amount, the date and the plan.

Logs and abuse protection

• The site runs through Cloudflare, and Badali takes your real IP address from Cloudflare.
• For usage limits, Badali keeps one-way hashes of IP addresses and emails, not the values themselves, and deletes them within 2 days.
• Server error logs do not contain your name, email or IP address in plain text, only a short hash of them.

Cookies and browser storage

• Badali uses only session cookies to keep you signed in, plus a short-lived cookie for Google sign-in.
• It stores simple preferences in your browser, such as language.
• Badali uses no analytics, advertising or tracking tools.

3. Why Badali processes your data, and on what basis

Article 6 of the Personal Data Protection Law (PDPL) allows processing needed to perform an agreement you are party to. Badali does not use your data for marketing and does not sell it. If Badali ever needs your consent for a new purpose, it will ask for that purpose alone, and you can withdraw it. PDPL, Articles 5, 6 and 7

4. Who receives your data

• Employers whose jobs you choose: they receive your application, CV and answers through their hiring systems. Each employer handles your application under its own policy, and deleting your Badali account does not delete its copy.
• Companies you choose to email: they receive your message and CV.
• Service providers: the providers in section 5, only as needed to run the service.
• Competent authorities: when the law requires it, and only what is required.

Human access: Badali's owner can see accounts, a profile summary, and applications and their status in an internal admin dashboard on the server, and the databases when needed to fix a problem or carry out your request. No one else has access.

When your data is corrected or destroyed, Badali informs those it disclosed it to where the law requires. Implementing Regulation, Articles 7 and 8

5. Where your data is processed, and transfers outside Saudi Arabia

Badali's databases, files and backups are stored on Oracle Cloud servers in Jeddah, and in Oracle's storage service in Jeddah. Running the service also requires sending some data outside Saudi Arabia:

Your name, email, mobile number, date of birth, ID number and passport are not sent to Anthropic when answers are written. Your name may be sent for translation if you have not written it in English.

These transfers are made to perform your agreement with Badali, limited to the minimum each purpose needs, under Article 29 of the PDPL and the Regulation on Personal Data Transfer outside the Kingdom. You can avoid the transfer to Google by signing in with email. PDPL, Article 29 and Personal Data Transfer Regulation

6. How long Badali keeps your data

When you delete your account, Badali deletes within 30 days: your account, profile, CVs, translation, answers, application history, hiring-system passwords and sessions, and your managed mailbox and its messages. This data then leaves the backups within 14 days, and the managed email backups within 35 days. Only payment records stay, for the legal period.

Your managed address stops receiving and forwarding when your account is deleted, and it is never given to anyone else.

Applications in progress: you can cancel any application that has not been sent yet. When you delete your account, unsent applications are cancelled. An application that has reached the employer cannot be recalled by Badali.

Hiring-system accounts created in your name stay with the employer after you disconnect or delete. To delete one there, ask the employer, or email Badali for help.

Data is deleted when it is no longer needed, except what the law requires to be kept or what a pending case needs, which is deleted when that reason ends. PDPL, Article 18

7. Your rights and how to use them

You have the right to:

• know how and why your data is processed;
• get a copy of your data in a clear format;
• correct, complete or update your data;
• delete your data or your account;
• withdraw consent where consent is the basis for processing.

PDPL, Article 4

You can edit most of your data and delete your uploaded CV in your account. For anything else, including deleting your account, email [email protected] from your account email and say what you want. Do not send a password or a copy of your ID.

Badali replies within 30 days. If a request needs longer, Badali tells you the reason before the 30 days end, and extends by 30 more days at most. Implementing Regulation, Article 3

You can also complain to the Saudi Data and AI Authority (SDAIA) through its complaints service.

8. How your data is protected

• The site uses an encrypted connection (HTTPS).
• Your account password is stored as a one-way hash, never as text.
• Hiring-system passwords and sessions, and the original managed email messages and attachments, are encrypted (AES-256-GCM).
• Daily backups are encrypted.
• Data files on the server can be read only by the service itself.
• The admin dashboard works only from inside the server.

If your data is breached, Badali informs the competent authority, and informs you where the law requires.

9. Age

Badali is for adults aged 18 and over. Badali does not knowingly collect data from anyone younger, and deletes it if it learns of it.

10. Changes to this policy

For a material change, Badali tells you by email and on the site 14 days before it applies. The last updated date is shown at the top of this page.

11. Language

This policy is in Arabic and English. If the two differ, the Arabic text prevails.