Privacy Policy

Last Updated: June 7, 2026

This Privacy Policy explains how we collect, uses, discloses, and protects personal information when you use the Contractly website at contract-ly.com and related services (the “Service”).

Contractly is a job-aggregation and recruitment platform. This policy applies to users who use the Service. By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Who We Are

The data controller responsible for your personal information is:

• Website: https://contract-ly.com
• Privacy contact email: 03jawad.ali@gmail.com

If you have any questions about this policy or your personal information, contact us using the details above.

2. Information We Collect

We collect the following categories of personal information, primarily provided directly by you when you create an account, build a profile, or use the Service.

Information you provide to us

• Account and identity data: name, email address, username, and password.
• Professional and employment data: resume/CV, work history, education, skills, certifications, job preferences, desired roles, location, and any other information you choose to add to your profile.
• Job-search activity: searches you run, jobs you save or apply to, and applications you submit through the Service.
• Communications: messages, support requests, and feedback you send to us.
• Billing data: if you purchase a paid plan, payment is processed by our payment provider (see Section 5). We do not store full payment card numbers on our systems; we may retain limited records such as plan type, billing status, and the last four digits of a card or a payment reference.

Information collected automatically

• Technical and usage data: IP address, browser type, device information, pages viewed, and timestamps.
• Essential cookies only: we use strictly necessary cookies required to operate the Service (for example, to keep you logged in and to maintain security). We do not use analytics, advertising, or other non-essential tracking cookies. See Section 6.

3. How We Use Your Information

We use personal information to:

• Create and manage your account and profile.
• Provide, operate, and improve the Service, including matching you with relevant job listings.
• Process applications you choose to submit.
• Process payments and manage subscriptions.
• Send transactional and service-related emails (for example, account notifications and password resets).
• Respond to your inquiries and provide support.
• Maintain the security and integrity of the Service and detect fraud or abuse.
• Comply with legal obligations and enforce our terms.

4. Legal Bases for Processing (GDPR / UK GDPR)

Where the EU GDPR or UK GDPR applies, we rely on the following legal bases:

• Performance of a contract — to provide the Service you sign up for, manage your account, and process payments.
• Consent — where you have given consent (for example, optional profile information you choose to share). You may withdraw consent at any time.
• Legitimate interests — to operate, secure, and improve the Service, where those interests are not overridden by your rights.
• Legal obligation — to comply with applicable laws and respond to lawful requests.

5. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined under the CCPA/CPRA). We disclose personal information only in the following circumstances:

Service providers (sub-processors)

We share information with vendors who process data on our behalf, under contractual confidentiality and data-protection obligations. These currently include:

• Supabase — database, authentication, and storage.
• DigitalOcean — infrastructure and hosting.
• Resend — transactional email delivery.
• Paddle — payment processing and Merchant of Record. Paddle acts as the seller/merchant of record for purchases and handles your payment details under its own privacy policy.
• Anthropic — AI processing used to power certain Service features.

Other disclosures

• Legal and safety: when required by law, regulation, legal process, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy.
• With your direction: when you choose to submit an application or share your information with a third party through the Service.

6. Cookies and Tracking

We use only strictly necessary (essential) cookies that are required for the Service to function — for example, maintaining your login session and protecting against security threats. Because these cookies are essential, they do not require consent under most frameworks. We do not use analytics, advertising, or marketing cookies, and we do not respond differently to “Do Not Track” signals because we do not track users across third-party sites.

7. Data Retention

We retain personal information for as long as your account is active and as needed to provide the Service. After account closure, we delete or anonymize personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, or enforce our agreements. You may request deletion as described in Section 8.

8. Your Privacy Rights

California residents (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know / Access — request the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it was disclosed.
• Delete — request deletion of your personal information, subject to legal exceptions.
• Correct — request correction of inaccurate personal information.
• Opt out of sale or sharing — although we do not sell or share personal information.
• Limit the use of sensitive personal information — we use sensitive personal information (such as account login credentials, and any sensitive details in your resume) only as necessary to provide the Service and for permitted business purposes.
• Non-discrimination — we will not discriminate against you for exercising your rights.

You may submit a request using the contact details in Section 1. We will verify your identity before fulfilling a request. You may use an authorized agent to submit a request on your behalf, with proof of authorization.

Categories of personal information collected (CCPA). In the past 12 months we have collected:

• Identifiers (name, email, IP address, account identifiers).
• Personal records (such as contact details and professional history).
• Professional or employment-related information (resume, work history, skills).
• Internet or network activity (usage and technical data).
• Commercial information (subscription and billing records).
• Sensitive personal information (account login credentials; any sensitive details you include in your profile or resume).

We collect this information from you directly and automatically through your use of the Service, and use and disclose it for the business purposes described in Sections 3 and 5.

EU / UK residents (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, you have the right to:

• Access a copy of your personal information.
• Rectification of inaccurate or incomplete data.
• Erasure (“right to be forgotten”), subject to legal exceptions.
• Restriction of processing in certain circumstances.
• Data portability — receive your data in a structured, machine-readable format.
• Object to processing based on legitimate interests.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any right, contact us at 03jawad.ali@gmail.com. We will respond within the timeframes required by applicable law.

9. International Data Transfers

We are based in the United States, and your information is processed in the United States and by the service providers listed above. Where personal information is transferred from the EU/UK, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required by law.

10. Data Security

We use reasonable technical and organizational measures to protect personal information against unauthorized access, loss, or misuse. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. Children's Privacy

The Service is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last Updated” date, and where required, notify you of material changes.

13. Contact Us

If you have questions or requests regarding this Privacy Policy or your personal information:

• Email: 03jawad.ali@gmail.com