Privacy policy

1. Data controller

The data controller is the publisher of Sirafy: a private individual residing in Algeria, who runs this site personally and non-commercially.

For any question or request about your data: contact@sirafy.com.

Processing is carried out under Algerian Law No. 18-07 of 10 June 2018 on the protection of natural persons in the processing of personal data, as amended and supplemented.

2. Data we process

We do not collect any sensitive data and advise you not to include any in your CV (health, opinions, religion, identity numbers).

• Account: first name, last name, email address, phone number, date of birth, preferred language, password (stored only as a hash), date you accepted the terms.
• CV: everything you enter or import (headline, summary, experience, education, skills, languages, projects, references, etc.), in each language.
• Page settings: page address, visibility, access code (hashed), colour, whether your phone and date of birth are shown.
• CV import: the file you upload (LinkedIn PDF, LinkedIn export, Europass) is read and then deleted immediately; only a review draft is kept for 24 hours so that you can undo the import.
• Messages received through the contact form: the name, email address, subject and message of the person writing to you. Their IP address is not stored with the message.
• Technical data: session cookies, IP address and browser type for the duration of the session, temporary attempt counters (login, access code, contact form), tied to the IP address or to a fingerprint of it.

3. Purposes

This processing is based on your consent, given at sign-up, and on providing the service you ask for. Sirafy does no advertising, no profiling, no resale of data, and uses no artificial intelligence.

• Creating your account, authenticating you and securing access.
• Building, scoring (quality score computed by fixed rules) and displaying your CV.
• Publishing your page with the visibility you choose, and generating the QR code, business card and contact card.
• Forwarding to you by email the messages sent from your page.
• Sending service emails: address verification, password reset.
• Preventing abuse and keeping the service secure.

4. What is visible on your page

Your email address never appears, neither on the page, nor in the contact card, nor on the business card. Your phone and date of birth appear only if you tick the corresponding boxes. Until your email address is verified, your page is visible to nobody but you.

• Public: visible to everyone and indexable by search engines.
• Unlisted (default): visible only to people who have the link; we ask search engines not to index it.
• Protected: visible after entering the access code you share.
• Offline: visible to you only.

5. Recipients

Your data is accessible only to you, to the publisher of the site for technical administration, and to the strictly necessary providers:

• Hosting of the site and database, and sending of emails: Hostinger International Ltd (61 Lordou Vironos Street, 6023 Larnaca, Cyprus).
• Fonts: Bunny Fonts (bunny.net), which receives your browser’s IP address in order to serve the files and states that it does not keep it.
• Password checking: when you choose a password, the first five characters of its hash are sent to the Have I Been Pwned service to check that it has not been leaked; the password itself is never transmitted.

No third-party analytics, no advertising tracker and no social network is embedded in the site. Your data is disclosed to authorities only where the law requires it.

6. Hosting outside Algeria

The hosting provider’s servers are located outside Algeria. By creating an account, you are informed of this hosting location and you consent to it. Exchanges with the site are encrypted (HTTPS).

7. Cookies and local storage

Sirafy uses only strictly necessary cookies: the session cookie, the form-protection token and, if you tick “Remember me”, a long-lived login cookie. Your browser also keeps your appearance preference (light or dark) and, if you install the app, a copy of pages you have already viewed for offline display. None of these is used to track you, which is why there is no consent banner.

8. Retention periods

• Account and CV: for as long as your account exists.
• Deleted account: the page is taken offline immediately, then all data is permanently erased after 30 days.
• Import drafts: 24 hours.
• Messages received through the contact form: 12 months, or until you delete them.
• Attempt counters: from a few minutes to 24 hours.
• Hosting provider backups: overwritten on its usual cycle, a few weeks at most.

9. Your rights

You have the rights of information, access, rectification, erasure and objection provided by Law No. 18-07. You can exercise them yourself, without asking us:

• Access and copy: Settings → My data → “Download my data” (full JSON file).
• Rectification: Settings → Profile, and the “My CV” editor.
• Limiting disclosure: Settings → Public page (visibility, phone, date of birth, contact form).
• Erasure: Settings → My data → “Delete account”.

You can also write to contact@sirafy.com: we reply as soon as possible. These rights are open to all users, whatever their country of residence. If you believe your rights are not respected, you may refer the matter to the National Authority for the Protection of Personal Data (ANPDP, anpdp.dz).

If someone has published information about you without your agreement (for example as a reference), write to contact@sirafy.com and we will handle your removal request.

10. Security

Encrypted connection, hashed passwords and access codes, passwords of at least twelve characters, limits on the number of attempts, password required to change the email address. As no system is infallible, we will inform you without delay of any incident affecting your data.

11. Minors

Sign-up is reserved for people aged 16 or over.

12. Changes to this policy

The date of the last update appears at the top of the page. Significant changes are notified to registered users, by email or by a message in their account.