Privacy Policy

1. Introduction

This Privacy Policy explains how HJ Vision FZ-LLC, trading as HeyAmara (“we,” “us,” “our,” or “HeyAmara”), collects, uses, shares, and protects personal data in connection with our website at heyamara.com (the “Website”), our technology platform (the “Platform”), the HeyAmara Chrome extension (the “Chrome Extension”), and related services (collectively, the “Services”).

HeyAmara provides technology services for the recruitment industry. Recruiters who use our Platform are independent business operators — we are not a recruitment agency, employer, or joint venture partner.

This Privacy Policy applies to all individuals whose personal data we collect or process. We comply with applicable data protection and privacy laws, including the UAE Personal Data Protection Law (Federal Decree-Law No. 45/2021, “UAE PDPL”), the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), and the New Zealand Privacy Act 2020 and the Information Privacy Principles (“IPPs”).

By using our Services, you acknowledge that you have read and understood this Privacy Policy. Where your consent is required as a legal basis for processing, we will obtain it separately and explicitly.

2. Definitions

“Candidate” means any individual whose personal data is processed through the Platform in connection with recruitment activities.

“Client” means any company, organisation, or individual that engages a Recruiter’s recruitment services and whose data may be processed through the Platform.

“Data Controller” (or “Controller”) means the party that determines the purposes and means of processing personal data. Depending on the context, this may be HeyAmara or a Recruiter, as described in Section 5.

“Data Processor” (or “Processor”) means the party that processes personal data on behalf of a Data Controller.

“Personal Data” (or “personal information”) means any information that relates to an identified or identifiable natural person, as defined by the applicable privacy law of the relevant jurisdiction.

“Platform Data” means data generated, uploaded, or processed through the Platform in connection with a user’s use of the Services.

“Recruiter” means an independent business operator who registers for and uses the Platform to provide recruitment services.

3. Information We Collect

3.1 Information You Provide

  • Account and profile data: Name, email address, phone number, business details, and professional credentials.
  • Financial and billing data: Payment information, invoicing details, and transaction records necessary to process fees and payments.
  • Application data: Information provided when applying to join the Platform, which may include professional background and location.
  • Communications: Messages, emails, support requests, and feedback you send to us.

3.2 Information Generated Through Your Use of the Platform

  • Usage data: Information about how you interact with the Platform, such as pages visited, actions taken, IP address, device type, and session duration.
  • Content you generate: Materials, configurations, and other data created through your use of the Platform.

3.3 Information from Third-Party Sources

  • Data providers: We may receive data from third-party sources at the direction of users.
  • Payment processors: We receive transaction confirmations and related data from our payment processor.
  • Connected accounts: If you connect third-party accounts, we may access data from those accounts to enable Platform features.

3.4 HeyAmara Chrome Extension

When a Recruiter installs the Chrome Extension from the Chrome Web Store and uses it while signed in to HeyAmara, we may process the following data through the extension. This is the same personal data the Recruiter already manages in the Platform; the extension is another way to collect and send it to HeyAmara.

  • HeyAmara account authentication: A session token synced from the Recruiter’s signed-in heyamara.com browser session, stored in the extension so API calls can be made as that Recruiter. We do not use the extension to collect general browsing history.
  • Page content the Recruiter chooses to save: Information visible on a page the Recruiter has open, used at their direction to create or update Candidates, Contacts, or Prospects in the Platform.
  • Contact details from AI Ark: Email addresses and phone numbers requested when the Recruiter clicks Get Contact Details. This request is proxied through HeyAmara to AI Ark; we do not sell that data.
  • Profile photos: Images the Recruiter chooses to save from the page they are viewing, uploaded to HeyAmara storage as the Candidate or Contact photo.
  • Optional document attach: Only if the Recruiter enables CV attach; uploaded as a Candidate document.
  • Session cookies (Connect only): We read session cookies for a third-party site the Recruiter chooses to connect, and only when they click Connect in the Chrome Extension. We do not fetch those cookies in the background or on page load. The purpose is to attach that signed-in session to HeyAmara so recruiting automation can run as that Recruiter. Cookies are sent only to HeyAmara and are not sold. The Connect control may be hidden in a given extension release.

The Chrome Extension runs only on HeyAmara and the host origins declared in the extension package. It does not collect location history or browsing across unrelated websites.

3.5 Sensitive Information

Some personal data requires heightened protection. Under the Privacy Act 1988 (Cth) APP 3, sensitive information may only be collected with consent and where reasonably necessary. Categories of sensitive information we may collect include:

  • Biometric data: Audio and video recordings may capture facial images and voice characteristics. We do not extract or store biometric templates or identifiers from recordings.
  • Health information: Accessibility requirements voluntarily disclosed for interview or work arrangements.
  • Background check data: Results of background screenings submitted by Recruiters as part of candidate management.

We collect sensitive information only where you have consented or where we are required or authorised by law.

4. How We Use Your Information

We process personal data for the following purposes:

Purpose Legal Basis (UAE PDPL)
Providing and operating our Services Consent; performance of contract
Account management and billing Consent; performance of contract
Recruitment assistance tools and features Consent; performance of contract
Security, fraud prevention, and platform integrity Consent; legal obligation
Monitoring compliance with platform terms Consent; performance of contract
Legal compliance Legal obligation
Service improvement and analytics Consent
AI model training and improvement using de-identified data Performance of contract
Marketing communications (where you have opted in) Consent (explicit)

We may create aggregated, anonymised, or de-identified data from personal data we process. Such data cannot reasonably identify any individual and may be used for any lawful business purpose.

5. Our Role as Data Processor

HeyAmara operates in two data protection roles:

  1. Data Controller — for Recruiter account data, usage data, analytics, and data we independently generate or derive from Platform operations.
  2. Data Processor — for Candidate and Client personal data uploaded or managed by Recruiters through the Platform. In this role, we process data on behalf of the Recruiter (who is the Controller).

HeyAmara may also act as an independent Controller for service improvement and AI model development, as described in Section 6. In that capacity we retain a copy of platform-derived data under the licence in our Platform Agreement; identifiable elements are retained for no more than 7 years from collection and, where a Recruiter’s agreement has ended, are de-identified or securely deleted within 90 days of the post-termination export period ending (see Section 9).

If you are a Candidate or Client whose data has been entered into the Platform by a Recruiter, the Recruiter is primarily responsible for having a lawful basis to collect and use your personal data, providing you with appropriate privacy notices, and responding to your data rights requests.

Where HeyAmara acts as a Data Processor, we enter into a Data Processing Agreement (DPA) with each Recruiter governing how we process personal data on their behalf.

6. AI and Automated Processing

6.1 How We Use AI

We use artificial intelligence to assist with recruitment-related services. AI features may process personal data of Candidates, Clients, and other individuals provided through the Platform.

6.2 Third-Party AI Providers

We use third-party service providers to power AI features. These providers are engaged on zero-data-retention terms: they process the minimum data necessary for the specific feature, are contractually prohibited from using data submitted through our Platform to train their own or any third party’s models, and do not retain that data after the request completes, other than any transient retention strictly required for safety and abuse monitoring under the provider’s terms.

6.3 Automated Decision-Making

We do not make fully automated decisions that produce legal effects or similarly significant effects on individuals without human involvement. AI tools are designed to support human decision-making, not replace it. The final decision to engage, interview, or hire a Candidate is always made by the Recruiter or their Client.

If you believe an automated decision has significantly affected you, you may request human review by contacting privacy@heyamara.com. We will respond within fifteen (15) business days.

6.4 AI Model Training

We train and improve our own AI models using de-identified and aggregated data only. We never use identifiable Candidate or Client personal data for AI model training — our Data Processing Agreement makes de-identification before any training use mandatory, and failure to de-identify is a material breach of that agreement. Because identifiable data is never used for training, no opt-out is needed. Data sent to third-party AI providers to power live Platform features is separate and described in Section 6.2: it is minimised, subject to zero-data-retention terms, and never used to train those providers’ models. Anonymised and aggregated data derived from Platform data may be shared with third parties for research, analytics, and technology development; such data cannot reasonably identify any individual.

7. Sharing and Disclosure

We do not sell personal data. We share personal data only in the following circumstances:

7.1 Service Providers

We use service providers for hosting, payments, and other operational services. These providers process data on our behalf under contractual obligations to protect personal data. The current list of service providers is available on request at privacy@heyamara.com. We will notify Recruiters of material changes to our service providers by written notice at least 30 days before the change takes effect.

7.2 Recruiter-Directed Sharing

When a Recruiter uses the Platform to share data with Candidates, Clients, or other third parties, we facilitate this sharing as a Data Processor acting on the Recruiter’s instructions. That includes Recruiter-directed Chrome Extension actions such as requesting AI Ark contact details and saving page content, photos, or an optional document into the Platform.

We may disclose personal data to comply with applicable law, enforce our terms, protect rights and safety, or detect and prevent fraud.

7.4 Business Transfers

If HeyAmara is involved in a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction with appropriate notice.

7.5 Aggregated and De-identified Data

We may share aggregated, anonymised, or de-identified data with third parties for research, analytics, and technology development. We do not sell identifiable personal data.

8. International Data Transfers

Personal data may be transferred to and processed in countries other than where it was collected, including Australia, the United States, and Canada.

We protect personal data transferred internationally through:

  • Contractual safeguards with service providers requiring them to protect data in accordance with applicable laws;
  • Compliance with UAE PDPL cross-border transfer requirements (Articles 22 and 23);
  • Compliance with Australian APP 8, ensuring overseas recipients handle information in accordance with the APPs; and
  • Compliance with New Zealand IPP 12, ensuring comparable privacy protections through contractual mechanisms.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, or as required by law.

Category Retention Period
Account and billing data Duration of account plus up to 7 years
Candidate and client data (where we are Processor) As directed by the Recruiter, or upon account termination per the DPA
Usage and platform data Up to 7 years from collection
Platform-derived data retained in our independent Controller capacity Up to 7 years from collection; on termination of a Recruiter’s agreement, identifiable elements are de-identified or securely deleted within 90 days of the export period ending

Data no longer required is de-identified or securely deleted. Anonymised data may be retained indefinitely for analytics and service improvement.

10. Data Security

We implement appropriate technical and organisational measures to protect personal data from misuse, interference, loss, and unauthorised access, modification, or disclosure, including encryption, access controls, and monitoring.

No method of transmission or storage is completely secure. If you become aware of any security incident, please notify us immediately at privacy@heyamara.com.

11. Your Rights

You have rights regarding your personal data under applicable privacy laws.

11.1 Rights Under UAE PDPL

If the UAE PDPL applies, you have the right to: access your personal data (Art. 13); correct inaccurate data (Art. 15); request deletion (Art. 15); restrict processing (Art. 16); data portability (Art. 14); withdraw consent (Art. 7); object to processing (Art. 17); and not be subject to solely automated decision-making with legal effects (Art. 18). You may also lodge a complaint with the Emirates Data Office.

We will respond within thirty (30) days, extendable to forty-five (45) days for complex requests.

11.2 Rights Under Australian Privacy Act

If the Australian Privacy Act applies, you have the right to: access your personal information (APP 12); correct inaccurate information (APP 13); and complain about a breach of the APPs.

To make a complaint, contact privacy@heyamara.com. We will acknowledge receipt within 5 business days and respond within 30 calendar days. If unsatisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11.3 Rights Under New Zealand Privacy Act 2020

If the New Zealand Privacy Act 2020 applies, you have the right to: access your personal information (IPP 6); correct inaccurate information (IPP 7); and complain to the Office of the Privacy Commissioner at www.privacy.org.nz.

We will respond to access and correction requests within twenty (20) working days.

11.4 Candidates and Clients

If you are a Candidate or Client whose data was entered by a Recruiter, the Recruiter is the Data Controller. Contact the Recruiter directly to exercise your rights. If you cannot reach the Recruiter, contact us at privacy@heyamara.com and we will assist you.

12. Cookies

We use cookies and similar technologies on our Website:

  • Essential cookies: Required for core functionality (authentication, security, sessions). Set automatically.
  • Functional cookies: Enable preferences and personalisation.
  • Analytics cookies: Help us understand how visitors use the Website.

Non-essential cookies are only set after you provide consent via our cookie consent banner. We do not use advertising or cross-site tracking cookies.

You can manage cookies through your browser settings or our cookie consent banner.

13. Children’s Privacy

Our Services are not intended for individuals under 18. We do not knowingly collect personal data from children. If we become aware of such collection, we will promptly delete the data. Contact us at privacy@heyamara.com if you believe we have inadvertently collected data from a child.

14. Communications

14.1 Service Communications

We send communications necessary for operating our Services, including account notifications, security alerts, and billing notices. These are transactional and cannot be opted out of while you maintain an active account.

14.2 Marketing Communications

Marketing communications are sent only with your explicit prior consent. You may opt out at any time by clicking “unsubscribe” in any marketing email or contacting privacy@heyamara.com.

14.3 Compliance

Users are solely responsible for compliance with all applicable laws, including communications and recording consent laws, when using Platform features.

15. Data Breach Notification

If we become aware of a data breach involving personal data, we will promptly investigate, take steps to contain it, and notify relevant regulatory authorities and affected individuals in accordance with applicable law.

16. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least thirty (30) days’ advance notice by posting a notice on the Website and, for registered users, by email. Non-material changes are effective when posted. Your continued use of our Services after changes take effect constitutes acceptance.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact us at:

  • Privacy enquiries: privacy@heyamara.com
  • Legal enquiries: legal@heyamara.com
  • Data Protection Officer: privacy@heyamara.com (Attn: DPO)
  • Entity: HJ Vision FZ-LLC, United Arab Emirates

Complaints: - Australia: Office of the Australian Information Commissioner — www.oaic.gov.au - New Zealand: Office of the Privacy Commissioner — www.privacy.org.nz - UAE: Emirates Data Office

18. Jurisdiction-Specific Provisions

18.1 Australia

The Privacy Act 1988 (Cth) applies to our handling of personal information of individuals in Australia. We comply with the Australian Privacy Principles (APPs).

The countries to which we may disclose personal information include Australia, the United States, and Canada.

Automated decision-making (effective 10 December 2026): From that date, the Privacy and Other Legislation Amendment Act 2024 (Cth) will require additional transparency about automated decision-making that could significantly affect individuals’ rights or interests. We will update this policy accordingly.

18.2 New Zealand

The New Zealand Privacy Act 2020 applies to our handling of personal information of individuals in New Zealand. We comply with the Information Privacy Principles (IPPs).

Indirect collection (IPP 3A, effective 1 May 2026): Where personal information is collected about an individual from a source other than the individual, we will take reasonable steps to ensure the individual is notified, as required by the new IPP 3A obligation.

18.3 UAE

The UAE PDPL applies to our processing of personal data. We have appointed a Data Protection Officer, contactable at privacy@heyamara.com.

Our primary lawful basis for processing is consent, obtained at the point of collection or through agreement to our terms. For AI model improvement, the lawful basis is performance of contract under Article 4 of the UAE PDPL.

We comply with cross-border transfer requirements under Articles 22 and 23 of the UAE PDPL through contractual safeguards with all overseas recipients.

18.4 United States

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA). We do not sell personal information. To exercise your rights, contact privacy@heyamara.com.

Last updated: 31 August 2026