Privacy Policy

1. Data Controller

SabiX Technologies Ltd. is the data controller responsible for your personal data collected through the Platform. Our registered address is 8 The Green, Suite R, Dover, Delaware 19901, USA. Our Data Protection Officer ("DPO") can be contacted at dpo@sabix.dev. For general privacy enquiries, contact privacy@sabix.dev.

2. Personal Data We Collect

We collect the following categories of personal data:

Data We Do Not Collect: We do not intentionally collect special categories of personal data (sensitive data) such as racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation. You must not submit such data to the Platform.

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• Providing the Platform: Creating and managing your account, processing payments, delivering features and coaching content, and providing customer support.
• Personalisation: Tailoring coaching recommendations, interview preparation materials, and career insights to your profile and usage history.
• Platform Improvement: Analysing usage patterns, diagnosing technical issues, and improving Platform features and performance.
• Security and Fraud Prevention: Detecting and preventing unauthorised access, account sharing, fraud, and other security threats.
• Legal Compliance: Complying with applicable laws, regulations, court orders, and legal processes.
• Communications: Sending transactional emails (account confirmations, password resets, billing receipts) and, with your consent, product updates and marketing communications.
• Aggregated Analytics: Generating anonymised, aggregated statistics about Platform usage that cannot identify individual users.

4. Automated Processing and Intelligence Engine

The Platform uses automated processing, including natural language processing and machine learning algorithms, to analyse your Content Data and generate coaching feedback, interview suggestions, and other Intelligence Output. This automated processing is necessary for the performance of the contract between you and the Company.

No Automated Decision-Making with Legal Effects: We do not use automated decision-making that produces legal effects or similarly significant effects on you without human review. Intelligence Output is advisory only and does not constitute a binding decision about your employment, creditworthiness, or any other legally significant matter.

Model Training: We do not use your personal Content Data to train third-party machine learning models without your explicit consent. Aggregated, anonymised, and de-identified data may be used to improve our own Platform intelligence systems.

5. Data Sharing and Disclosure

We do not sell your personal data. We share your data only in the following circumstances:

• Service Providers: We engage trusted third-party service providers who process data on our behalf under strict data processing agreements, including cloud infrastructure providers, payment processors (Stripe), email delivery services, and analytics providers.
• OAuth Providers: When you use social login, we receive data from Google, GitHub, or Microsoft as authorised by you. We do not share your Platform data back to these providers beyond what is required for authentication.
• Legal Requirements: We may disclose your data when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your data may be transferred as part of that transaction. We will notify you of any such change and the choices available to you.
• With Your Consent: We may share your data for any other purpose with your explicit consent.

5A. Google User Data

When you connect a Google account, SabiX asks only for the access each feature needs, and only when you choose to use it:

• Google sign-in (name, email address, profile picture): used to create and sign in to your SabiX account.
• Google Drive (only files you choose, and files SabiX creates for you): files you pick in the Google file chooser are imported into your SabiX knowledge base so the Platform can use them when helping you; SabiX Meetings saves your own meeting recordings to a "SabiX Meetings" folder in your Drive. SabiX cannot see any other file in your Drive.

We use Google user data only to provide and improve the features you use and that are visible to you. We do not sell it, we do not use it for advertising, and we do not let people read it, except with your consent for a specific item, for security purposes, to comply with the law, or where it has been aggregated and anonymised for internal operations. We do not use Google user data to develop, improve or train generalised machine-learning models. We transfer it to service providers only as needed to provide those features, under agreements that protect it.

SabiX's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Drive at any time in SabiX Settings, or remove SabiX's access at myaccount.google.com/permissions. Deleting your SabiX account deletes the Google data we hold; files already saved in your own Drive stay yours.

6. Data Retention

7. Security Measures

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• TLS 1.3 encryption for all data in transit;
• AES-256 encryption for sensitive data at rest;
• Bcrypt password hashing with adaptive cost factors;
• HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options);
• Rate limiting and brute-force protection on all authentication endpoints;
• CSRF protection on all state-changing operations;
• Comprehensive audit logging of security-relevant events;
• Role-based access controls limiting employee access to personal data;
• Regular security reviews and vulnerability assessments.

While we take reasonable precautions, no security system is impenetrable. We cannot guarantee the absolute security of your data. In the event of a data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and applicable regulatory authorities as required by law.

8. International Data Transfers

Your personal data may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your jurisdiction. Where we transfer data internationally, we implement appropriate safeguards, including Standard Contractual Clauses approved by relevant data protection authorities, to ensure your data receives an adequate level of protection.

9. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

To exercise any of these rights, please contact our DPO at dpo@sabix.dev. We will respond within 30 days. We may need to verify your identity before processing your request.

10. Additional Rights for California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you specific rights regarding your personal information, in addition to the rights described in Section 9.

How to submit a CCPA request: Contact our DPO at dpo@sabix.dev with the subject line "CCPA Rights Request." We will verify your identity and respond within 45 days (extendable by a further 45 days with notice where reasonably necessary).

Authorised agents: You may designate an authorised agent to submit requests on your behalf by providing written authorisation. We may require direct verification from you to confirm the agent's authority.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate the Platform. Essential cookies are required for the Platform to function and cannot be disabled. These include session cookies that maintain your authenticated state. We do not use third-party advertising cookies or cross-site tracking technologies.

You can control cookie settings through your browser. Disabling essential cookies will prevent you from using the Platform. For more information about managing cookies, visit allaboutcookies.org.

12. Children's Privacy

The Platform is not directed to children under the age of 18. We do not knowingly collect personal data from children under 18. If you believe we have inadvertently collected personal data from a child under 18, please contact us immediately at privacy@sabix.dev and we will take steps to delete such data promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date and, where appropriate, by sending an email notification. Your continued use of the Platform after any change constitutes acceptance of the updated Privacy Policy.

14. Contact Us