Legal

Privacy Policy

Last updated 4 October 2026

1. Who we are

This policy explains how Al Hayat Solutions ("Al Hayat", "we", "us") collects, uses and protects personal information when you use alhayatsolutions.com, our client portal, the Al Hayat Jobs board and our services. Al Hayat Solutions is responsible for your personal information.

Al Hayat Solutions, 3994 White Plains Rd, Bronx, NY 10466, United States · info@alhayatsolutions.com · +1 347-323-9801.

2. What we collect, service by service

Accounts and sign-in

• Your email address, the language you use and your account role (client, employer or staff).
• One-time sign-in codes (stored only in scrambled, hashed form) and, if you add one, your passkey's public key. We never receive your device's private key, fingerprint or face data.
• If Google sign-in is turned on and you use it, the name and email address Google gives us for that sign-in. We never receive your Google password.
• If Google sign-in is turned on and you use it, we also keep Google's stable account identifier, so that we know it is the same Google account next time.
• A session record (stored only as a hash) with its start and last-activity times.
• Access codes and invitations. A code or invitation we give you opens a Pathways or Global space. We store only a scrambled form of the code, the service it opens, who issued it and whether it was used. Attempts to type a code are counted against a hashed form of your IP address for 24 hours, to stop guessing.

Consultations and the client portal

• Your name, email, phone number, preferred language and contact method, and what you tell us about your goal, timing and budget.
• Requests, messages, status updates and the documents you upload (PDF, JPEG, PNG or DOCX, up to 10 MB). Documents are stored in Cloudflare R2 object storage under a random name, not your file name.
• If you leave a review after a completed request: your rating, your text, and whether you agree to its publication. Published reviews show only your first name and city.

Orders and payments (Studio and Careers packs)

• Your order details: the package or pack, add-ons, your project brief, your name and email.
• An order can also include a phone number. It is optional.
• Payment status and a payment reference. Card payments are made on Square's secure checkout page; we never see or store your full card number.
• Payments we record by hand for Pathways and Global (the owner takes payment outside the site): the amount, the date and the service, in a record only the owner can see, and the hours a team member worked on your file.
• A payment recorded by hand also keeps how it was paid (cash, transfer, card or other) and a short note.

Business: Studio previews, the supplier check and funding help

• Studio previews. When we make a free private preview of a website for a business, we keep the business details we typed from public sources or from the business itself: its name, its trade, its city, its phone number, an optional tagline and a short list of services. We keep no email address of the business and import no list of businesses. The link carries a random secret that we store only as a hash; the preview is not listed in search results and ends after 30 days. We count how many times the page is opened (a number and two dates); we do not record who opens it, and we set no cookie. If a business asks us to stop, we keep its phone number (digits) and its name and city so that we never make a new preview for it.
• After a business asks us to stop, we keep its whole preview record (the details we typed, the dates and the view count) with a stop mark, so that we do not contact it again. The preview page itself keeps a scrambled form of the visitor's network address for up to one day, to limit abuse.
• Supplier check and funding help. What you tell us about a supplier or your business so that a team member can answer; the first look is free and a full check or report is by quote. We never hold your money and we do not contact a supplier unless you ask us to.

Al Hayat Careers, the Job Finder and match scores

• Your resume (file up to 5 MB or pasted text), the text we read from it, your target roles, location, experience and whether you need visa sponsorship.
• A PDF or DOCX resume is converted to text by Cloudflare Workers AI. A numerical summary of the resume text (an embedding) is stored with your Job Finder profile to compute match scores.
• Private resume score. On the Careers pages you can choose a resume file or paste text and get a score. The file is read in your browser: nothing is uploaded and nothing is stored. (This is a different thing from the Job Finder resume above, which you choose to save in your account.)
• Jobs you save and the status you record (saved, applied, interview, offer, rejected). Before you have an account, "My jobs" lives only in your browser (local storage) and a reminder appears after five days; we never see that list.
• When an employer sets an application you made on our site to interview, rejected or hired, that status also appears in your own tracker (hired shows as offer).
• Career facts (jobs, education, skills, certificates and similar) drawn from your resume or added by you, with your own wording.
• Your tailoring credits and the tailored resumes and cover letters you generate.
• Contact details for your documents (Settings): a phone number, a city, a country and up to three web links, printed on the resume and cover letter you download. There is no field for an ID or passport number. These details are never sent to the AI.
• "Report a job we got wrong". The job (as you name it), what happened, and nothing else: no IP address, email or account is stored with a report.

Al Hayat Jobs board: applicants and employers

• Applicants: when you apply on our site, a copy of your resume, your optional note, and your name and email are sent to that employer and kept with the application.
• Guest applicants (no account): your name, email, optional phone number, resume, optional note, the email verification record and a hashed form of your IP address used to prevent abuse.
• Employers: your company name, website, logo, description, location, workplace information, employer type, your job posts, your acceptance of our posting policy, and, if you connect one, your public Lever or Greenhouse board name; plus the phone number and street address a post needs (they are stored with your profile and are not shown to applicants), and, if you tick it, "we offer visa sponsorship" (shown as your own statement).
• Automatic check of a listing. Before a listing is shown, a program reads the listing's own words and the employer's company details (name, website, address, phone) against our listing policy and scam warning signs. It never reads resumes, applicant messages or anything personal. The result (passed, held or rejected, with reason codes) is stored with the listing; a person reads every post from an employer before it is published.

Pathways and Global (access code needed the first time)

• Your intake, one short question at a time and phone-first, which you can leave and finish later: the country you are a citizen of (a choice from a list, with "more than one" and "I am not sure"), the country you live in, your date of birth (you may skip it), your education, work, languages and test scores, skills and certificates, what you are looking for, where, your budget band and timing, and which documents you have. For Global also your business: its name, your role, sector, stage, size, website, what it does, proof you choose to give (a sentence and a number) and your travel history in broad terms. We never ask for a passport number or photo, or an ID number or photo; the intake asks only the country, and the portal says so on every screen where a document could be sent.
• A fact ledger. What you tell us that is a fact is stored in one place, with your own words, so that a team member can verify it (and mark it verified) and so that every document we draft can only use facts that are there.
• Your two consents, which you can change at any time in your space: (1) that we compare what you told us with scholarships, jobs, events and programs, and (2) that Cloudflare Workers AI may help read a CV you upload and draft your documents. Without the first there are no matches; without the second a team member writes by hand.
• Matches and notes. The matches our rules find, with the reasons, what you did with each (saved, dismissed), the notes a team member writes about your file, and what the team opened for you (tracks). A team member can see all of it.
• Documents we draft (resume, cover letter, essay, statement, founder card), their versions and the evidence line that shows which fact each sentence rests on; the confirmation you make ("I have read this and every statement is true"); your applications tracker; reminders. A team member may mark a version "Polished by [first name]".
• Pitch Studio (Global). A founder card you can share by a private link that ends on the day you choose (1 to 30 days) and that you can stop at any time. The link carries a random secret stored only as a hash; the page shows a copy of the card as it was the day you made the link.
• Event registration help (Global). The event and the details needed for a registration that a team member prepares with the events engine; we never submit, pay for or accept anything for you, and we never write or sell an invitation letter.
• Sponsor preview. A read-only preview of what a parent or sponsor would see (no messages, no documents). There is no sponsor sign-in; nothing is shared with anyone.
• Documents a team member asks you for in the secure document step (for example a transcript) and what we read from them.

Visa document readiness

When a team member adds visa document readiness to your Pathways or Global space: the documents you upload for that case (for example a passport page, bank statements, an employment letter, insurance, a reservation) and the details we read from them. Passport numbers are shown masked (last three characters) in our tools. The visa category you or your lawyer chose, travel dates and your answers. We never ask for or store your government-website passwords. If you agree to a hand-off to a licensed partner (UK or Canada), the case details that partner needs.

Ask Al Hayat (website assistant)

Most answers are written in advance and stay in your browser. If we have no written answer, your question is sent to our own assistant, which runs on Cloudflare Workers AI, to produce a general answer from our website pages. A message that looks like a password, a code, a card, a passport or an ID number, or a bank number is never sent. We do not store or log the content of your messages; we keep only counts of use, linked to a hashed form of your IP address, to enforce daily limits. This tab remembers the conversation in your browser's session storage only.

Job search and location

• What you search for (keywords, location and filters).
• Your approximate location (country, region and city) as provided by Cloudflare from your connection, used only to show jobs near you first. You can change the location at any time. We do not store your IP address for this purpose.
• Your location is also used to fetch results. When live search uses Adzuna, Jooble, Careerjet or USAJOBS, the words you type and the place (with its country) are sent to that service. The place is the one you typed or, if you typed none, the region or city your connection shows.

Technical information

Cloudflare, which hosts our site, processes your IP address and browser information to deliver pages and protect the site. We store hashed (not readable) forms of IP addresses to enforce rate limits on forms, sign-in, applications, searches, access codes, the assistant and Studio previews; the shortest lives 24 hours, the longest two days.

3. How we use your information

• To provide the services you request: consultations, planning, documents, websites, career tools, job applications, scholarship and event matching and visa document readiness.
• To create and secure your account, sign you in and keep your session safe.
• To take payments, grant credits and confirm orders.
• To send service emails: sign-in and verification codes, order confirmations, application updates, appointment reminders and a request for a review after a completed request.
• To show job listings, rank them by relevance to you and calculate match scores; to screen job posts and listings against our listing policy and for scam warning signs.
• To compare your intake with scholarships, visa-sponsored jobs, events and programs and say honestly how well they fit (never a percentage chance), and to draft documents from the facts you gave us.
• To make a private preview for a business and, by hand and from a separate domain, to send that business one email about it that says who we are, says it is an advertisement, gives our postal address and a way to stop. If a business asks us to stop, we stop within 10 business days and keep the record that says so.
• To prevent fraud, spam and abuse, and to meet our legal and accounting obligations.

We do not sell or rent personal information, we do not share it for cross-context behavioural advertising, and we do not use it to build advertising profiles.

4. Artificial intelligence and its limits

We use AI models run on Cloudflare Workers AI for specific tasks. Your content is processed to produce the result you asked for; we do not use it to train AI models.

• Ask Al Hayat answers general questions only from our own website pages. It does not give personal, legal or immigration advice, and it does not store your messages. Every reply is checked before you see it: a reply that names a price that is not ours, promises a result, claims a legal fact or names a service we no longer offer is replaced with "I am not sure, a person can help".
• Instant tailoring (Careers) produces a tailored resume or cover letter immediately, without review by our staff, using only facts found in the resume you provide or that you confirm. Automatic checks remove any employer, title, skill, number or claim that is not in those facts, and a draft that fails the checks is not shown to you.
• Pathways and Global documents. Only if you agree to AI help, an AI model drafts a resume, cover letter, essay or statement from the facts in your ledger. By default your adviser reviews it before you see it; where a team member has switched that off for you, you read and confirm it yourself. In both cases every line is tied to a fact, the same automatic checks refuse a draft that contains something you did not tell us, and nothing is final until you confirm that you read it and that every statement is true. A draft is labelled as AI-assisted in your space. Your contact details are never sent to the AI. If you say no, a person writes by hand and the AI is never used for you.
• Funders' rules. Some funders and organizers do not allow AI-written essays or paid application help. Where we know a rule we show it; for a funder that does not allow paid application help we write no documents.
• "Polished by [first name]". A team member may edit a document and mark that version as polished by them; the mark applies to those exact words and disappears if a word changes.
• Match scores and "fit" words compare your facts or your resume with a listing, scholarship, event or program using automated methods. A score or word is an estimate to help you choose where to apply, not a judgement about you, and it is never shared with employers.
• Resume reading. When you upload a PDF or DOCX resume, Cloudflare Workers AI converts it to text. Workers AI also makes a numerical summary of your Job Finder resume text (an embedding), which is stored with your profile and compared with listings to compute match scores.
• We do not promise that any document will pass, or avoid, an AI-detection tool.

AI can make mistakes. No automated tool on our site makes decisions with legal or similarly significant effects on you; visa, admission, scholarship, event and hiring decisions are made by governments, institutions, funders, organizers and employers.

5. Service providers and other third parties

• Cloudflare hosts the website and portal and provides our database, file storage (R2), AI models (Workers AI), security and approximate location.
• Square processes card payments on its own checkout page.
• Brevo sends our transactional emails (codes, confirmations and updates).
• WhatsApp (Meta). When you write to us on WhatsApp, WhatsApp and its owner handle the message and your number under their own terms; we see the number and the message.
• Google, when you choose "Continue with Google".
• Fonts are served from our own website, so no font provider receives your IP address when a page loads.
• Job sources. Many listings come from third-party job sites and company career boards and are credited "Listed on [source]". When you open an outside listing, you apply on that website under its own terms and privacy policy.
• Careerjet. When live search uses Careerjet, its service requires the searcher's IP address and browser user agent with each search. We forward them from your request for that purpose only and do not log or store them.
• Job-search services. When live search uses Adzuna, Jooble, Careerjet or USAJOBS, the words you search for and the place (the one you typed or, if you typed none, the region or city your connection shows) are sent to that service to fetch results.
• Employers receive your application, resume and note when you apply to their post on our site.
• Licensed partners (for example an OISC adviser in the UK or an RCIC in Canada) receive case information only with your consent, through a secure link that expires after 7 days.
• GitHub runs our automated job-data refresh; it handles public job listings and public sponsor registers, not client information.
• GitHub also runs our encrypted backups, which are separate from the job-data refresh above. Unlike the refresh, a backup is a copy of our database, which holds client information. It is made on a temporary GitHub machine and encrypted there before it is uploaded. The optional off-site copy is kept in a private GitHub repository.
• Legal requirements. We may disclose information when required by law, to protect rights and safety, or as part of a business transfer, in which case this policy continues to apply.
• Public data we publish: scholarship, sponsor-register, visa-rule and event records come from official and public sources; each shows its source and the date we last read it. They are not personal data.

6. How long we keep information

• Sessions: you are signed out after 30 minutes of inactivity and after 8 hours at most. Sign-in and verification codes expire after 10 minutes; guest verification lasts 30 minutes.
• Guest resumes: 30 days after you apply (or upload a resume for match scores), we delete the resume file, its text, your phone number, the hashed IP address and your note. The employer keeps a record of your name, email and application status. If you save your application to a portal account, you become a client and the account rules below apply.
• Your saved resume stays in your account until you delete it, which you can do at any time. Copies already sent to employers with an application remain with that application.
• Assistant: message content is not kept at all; only usage counts are.
• Job listings from outside sources are removed after 30 days.
• Rate-limit records (hashed addresses and counters): 24 hours to two days.
• Studio previews: the link ends after 30 days. The record (business details and view count) is kept; the record of a business that asked us to stop is kept so that we honour it.
• Pathways and Global: your intake, ledger, matches, notes, drafts and tracker are kept while your account is active and for as long as needed to deliver the service, resolve disputes and meet legal obligations. You can delete your drafts in your space (an adviser-approved version is kept as an unchangeable record of what was approved, and we tell you so); you can ask for the rest to be deleted by email. Private Pitch Studio links end on the day you chose.
• "Report a job we got wrong" entries are read by a person and can be deleted by hand after a year.
• Account, request, order and document records are kept while your account is active and for as long as needed to deliver the service, resolve disputes and meet tax, accounting and legal obligations. Approved documents are saved as unchangeable records so we can show what was delivered.
• Backups: every day an automated job on GitHub makes an encrypted backup of our database, which holds client information. The newest 8 copies (about 8 days) are kept in our own Cloudflare storage and, if the owner has switched it on, the newest 30 daily copies are kept in a private encrypted off-site copy. Older off-site copies can stay in the history of that private repository. A record you delete can remain in a backup for as long as that backup is kept.

7. Security

We use HTTPS throughout, sign-in with email codes, passkeys, passwords (kept only as salted hashes) or Google, secure session cookies, hashed session tokens and codes, strict checks on uploaded file types, and role-based access: clients see only their own requests, and staff see only the divisions they work in. Staff and administrators cannot see Job Finder resumes. Changes to requests, documents and accounts are logged. No system is perfectly secure; if you think your account has been compromised, contact us straight away.

8. Children

Our website and portal are intended for adults. We do not knowingly collect personal information directly from children under 13, and accounts are for people aged 18 or over. If you believe a child has given us personal information, contact us and we will delete it.

9. International users

We are based in the United States, and our providers may process information in the United States and other countries. If you use our services from outside the United States, including from the European Union or the United Kingdom, your information will be transferred to and processed in the United States. We rely on our providers' standard contractual protections for these transfers. Where the GDPR applies, we process your information to perform our contract with you, to meet legal obligations, for our legitimate interests in running a secure service, or with your consent (for example, publishing a review or a partner hand-off).

10. Your rights and choices

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy (access);
• correct inaccurate information (correction);
• delete your information (deletion), subject to records we must keep by law;
• withdraw a consent you gave, such as consent to publish a review.

California residents and residents of other US states with privacy laws, and people protected by the GDPR or UK GDPR, may also have rights to know, to data portability, to restrict or object to processing, and to complain to a data protection authority. We do not sell personal information, and we do not share it for targeted advertising, so there is nothing to opt out of, and we will not treat you differently for exercising your rights.

To make a request, email info@alhayatsolutions.com from the address linked to your account, with "Privacy request" in the subject. We may need to verify your identity. We aim to respond within 30 days, and in any case within the time the law requires. You may use an authorised agent where the law allows it.

11. Cookies and local storage

We use only the cookies and browser storage needed for the site to work. We do not use advertising or tracking cookies.

• Session cookie (__Host-ah_session): keeps you signed in. Secure and not readable by page scripts; ends after 30 minutes of inactivity or 8 hours at most.
• Guest verification cookie (__Host-ah_guest): remembers for 30 minutes that you verified your email to apply as a guest.
• Short-lived sign-in cookies (__Host-ah_invite while you accept an invitation, __Host-ah_google while you use Google sign-in): they hold a signed value for a few minutes and are removed when the step ends.
• Language cookie (ah_lang): remembers the language you chose, for one year.
• Browser local and session storage: ah_portal (a marker that you are signed in, so the public pages can say "Hello"), ah_account (your first name and initials, for that greeting), ah_signup_names (the first and last name you typed at sign-up, kept on your device), ah_myjobs_v1 and ah_apply_pending_v1 (your "My jobs" list and the reminder: this browser only), ah_lang_banner, ah_home_nudge and the conversation with the assistant (this tab only). They stay on your device and are not sent to us.
• Also kept in your browser: your language choice (ah_lang, as well as the cookie), small marks that remember a closed banner or something you have already seen, and your choice about needing visa sponsorship (ah_needs_sponsorship), which your browser sends to us with each match-score request; we do not store it from that request. In the portal, a service worker keeps a cache of the app files on your device and, only if you choose "Available offline" for an item such as a confirmation, a copy of that item.

You can clear cookies and local storage in your browser settings; you will then be signed out and your preferences reset.

12. Changes to this policy

We will update this policy when our services or the law change, and change the "Last updated" date above. If a change materially affects how we use information you have already given us, we will tell you by email or in the portal before it takes effect.

13. Contact us

Al Hayat Solutions, 3994 White Plains Rd, Bronx, NY 10466 · info@alhayatsolutions.com · +1 347-323-9801. See also our Terms of Service.