Data Processing Agreement
Last updated: May 13, 2026 · GDPR-compliant
1. Introduction and Scope
This Data Processing Agreement ("DPA") forms part of your agreement with HireMe.ai ("Processor") and describes how we process personal data on your behalf when you use our Services. This DPA is designed to comply with applicable data protection laws including the GDPR and Pakistan's Personal Data Protection Act.
This DPA applies to all personal data processing activities carried out by HireMe.ai in relation to the provision of our job-application automation services.
2. Data Controller Information
Data Controller: The user (you) in relation to your own personal data
Data Processor: HireMe.ai
Registered Address: Bhakkar, Punjab, Pakistan
Data Protection Contact: hello@hireme.ai
When HireMe.ai collects and uses your personal data for its own business purposes (e.g., improving our AI models), HireMe.ai acts as a Data Controller. When processing your data solely to deliver the service you requested, HireMe.ai acts as a Data Processor.
3. Categories of Personal Data Processed
Identity Data
- Full name
- Email address
- Phone number
- Profile photograph (optional)
Professional Data
- CV and resume content
- Work history and experience
- Educational qualifications
- Skills and certifications
Preference Data
- Job preferences and filters
- Salary expectations
- Geographic preferences
- Industry and role targets
Technical Data
- IP address and device identifiers
- Browser and session data
- Usage and interaction logs
- Authentication tokens
4. Purposes and Legal Bases for Processing
Service Delivery
Processing your CV and job preferences to autonomously apply to jobs on your behalf. Legal basis: Contract performance
Account Management
Managing your user account, authentication, and subscription. Legal basis: Contract performance
AI Model Improvement
Using anonymized interaction data to improve job-matching accuracy. Legal basis: Legitimate interests
Communications
Sending transactional notifications about your applications and account. Legal basis: Contract performance / Consent
Legal Compliance
Retaining records as required by applicable law. Legal basis: Legal obligation
5. Data Retention Periods
| Data Category | Retention Period | Justification |
|---|---|---|
| Account data | Duration of account + 90 days | Service delivery |
| Application history | 2 years | Service improvement |
| Payment records | 7 years | Legal obligation |
| Technical logs | 90 days | Security monitoring |
| Anonymized analytics | Indefinite | Aggregate statistics only |
6. Sub-processors
We use the following categories of sub-processors to deliver our service. All sub-processors are contractually bound to equivalent data protection standards:
- Cloud infrastructure providers (server hosting and storage)
- Payment processors (for subscription billing)
- Email service providers (for transactional notifications)
- AI/LLM providers (for cover letter and application generation)
- Analytics platforms (anonymized usage data)
You may request a current list of our sub-processors by emailing hello@hireme.ai.
7. Security Measures
HireMe.ai implements the following technical and organizational security measures:
- AES-256 encryption for data at rest
- TLS 1.3 encryption for data in transit
- Multi-factor authentication for system access
- Role-based access controls (principle of least privilege)
- Regular security audits and penetration testing
- Automated vulnerability scanning
- Incident response plan with 72-hour breach notification
8. Data Subject Rights
Under applicable data protection law, you may exercise the following rights:
- Right of Access — obtain a copy of your personal data within 30 days
- Right to Rectification — correct inaccurate personal data
- Right to Erasure — request deletion of your data
- Right to Portability — receive your data in JSON or CSV format
- Right to Restriction — limit how we process your data
- Right to Object — object to processing based on legitimate interests
Submit requests to hello@hireme.ai with subject "DSR Request." We respond within 30 days.
9. Contact
For data processing inquiries: