Privacy policy

1.Who we are

jobs.ly is a job portal for Libya, a product of Libyan Spider (شركة العنكبوت الليبي). Libyan Spider runs jobs.ly and is responsible for your information. In this policy, "we" means Libyan Spider. This policy explains what information we collect, why, and the choices you have. jobs.ly is for people aged 18 and over.

2.What we collect

• Error reports: we keep technical failure messages, stack traces, page categories and occurrence counts so staff can investigate. Sensitive links, contact details and form values are filtered before storage. Reports are restricted to staff and deleted 30 days after the last occurrence; resolving an error can remove it sooner.
• Account: your mobile number or email address, used to send you login codes.
• Job seekers: the CV you create or upload (name, contact details, experience, education, skills) and the jobs you apply to.
• Hiring records: the employer's private notes, team ratings of skills, experience and communication, interview time choices and answers, and offer-letter values the employer saves (start date, salary, probation, reply date, terms and signer details). These are kept with the application; saving a draft does not send it. Where sending offers is available, sending an offer saves its version and records the reply, any amendments and deadline changes.
• Employers: organization details and the jobs you post. If you buy a plan: its invoices (plan, amount, date, payment method and transfer reference). Online payments are handled by Plutu and your payment provider; we never receive your card or wallet details.
• Organization verification: the official identity document you send (seen only by your team and jobs.ly staff, and deleted once it has been checked) and, for recruitment agencies, the Ministry of Labour licence number (shown on your page once verified).
• Browser notifications, only if you turn them on: a technical address for that device from your browser's notification service. It is removed when you turn them off, sign out on that device, or sign out on every device.
• Basic technical data such as your IP address and browser, used to keep the site secure and working. The server's access log keeps it for at most 14 days, without cookies or sign-in details.
• Details of people who are not users, given to us by users: a phone number or email an organization invites to its team (deleted after 30 days if the invitation isn't accepted), and the contact person of a recruitment agency's client organization (kept until the agency deletes that client).

3.How we use it

• Names: we may send the name you enter to Google Gemini to suggest its Arabic or English spelling. You can review and edit the suggestion before saving it.
• To run the service: show jobs, send your applications to employers, and let employers contact you.
• To help with AI: we use AI services (Google Gemini) to write job posts and CVs, translate them, rank applicants, and, when you press “Does this job fit me?”, compare your CV with that job (the result is shown only to you and is not saved). When you press “Tailor my CV for this job”, AI rewrites your headline, summary and skills for that job: the result is saved with that application and shown only to that employer's team. Interview practice sends your CV, the job and the answer you write, to give you feedback; nothing is saved and the employer never sees it. An employer may also ask AI to draft a short note about applicants it sends to its manager or client, from their CVs; the employer reads it before sending. If you upload your CV as a PDF or a photo, the whole file (including the contact details in it) is sent to Gemini so it can read it (before a photo is stored, we remove the details your phone adds to it, such as where it was taken); from a Word file or typed answers, we take out emails and phone numbers before sending the text. The text you submit is sent to these services only for that purpose and is processed under Google's Gemini API terms. Whether Google uses this data to improve its products depends on the service's billing settings.
• To send you messages: job alerts you created, jobs that fit your CV (switched on when you save your CV; one tap stops them), invitations to apply, and updates about your applications or new applicants. You can stop these any time on your CV page, under My jobs → “Alerts”, or with the link in each email.
• To suggest jobs: we compare your CV with new jobs (by field, city, experience and, with AI, the content) to find ones that fit you.
• If search by meaning is switched on, the text of job posts and CVs (without your name, phone or email) and the words typed in job and CV searches are also sent to Voyage AI to build search data.
• To keep jobs.ly safe: detect scams and abuse. When you sign in to a jobs.ly team account, or change the phone or email you sign in with, we send a notice so a stranger can't use your account unnoticed.
• To improve what we offer: when a job search finds nothing, we keep the search words (never who searched, and never anything that looks like an email or phone number) for one year, to know which jobs people look for.
• To describe the job market: every month we count jobs, job seekers, applications and hires by city, field and experience level. These are anonymous totals that never include names or contact details. If you answer “Did you get this job?” on My applications, your answer is only counted in these totals; the employer doesn't see it. We may publish them or share them with public bodies and researchers.
• We do not sell your personal information.

4.Who can see your information

• Holdings / groups: when you apply to a group’s job for a subsidiary, the group may share your CV with that subsidiary through an expiring private review link, without your phone number or email. Separate permission to contact you about other group jobs lets the group keep you among its saved candidates. You can withdraw that permission from the application. A subsidiary contact receives monthly reports only after agreeing; those reports contain totals, not candidate identities.
• Your CV, phone number and uploaded file are visible only to you, to the employer's team working on the job you apply to, and to jobs.ly admins when needed to keep the site safe (for example, checking a report). 12 months after that job closes, the employer no longer sees your phone number, email or uploaded file (your CV stays with the application). Before hiring, you can withdraw under My jobs → Applied. That attempt closes and stops granting access to your CV and contact details; the team retains a restricted, read-only hiring record.
• Blind first review is an exception: on jobs marked “Fair review”, the employer's team and its review links initially show an anonymous applicant without name, contact details, city, uploaded file, school names or dates. Your identity is revealed when you are shortlisted or moved to a later hiring step, and stays revealed if moved back. If rejected before that, you stay anonymous. AI ranking uses the anonymous CV while this review applies.
• If you turn on a public CV link, anyone with that link can see your CV (without your phone number or email).
• Only if you turn on “Let organizations suggest me”, employers with a matching job, and employers on a paid plan who search the CV database, see an anonymous summary: your professional title, city, field, experience level and skills, never your name, phone, email or CV file. They can invite you to apply; they see your full CV only if you apply. It is off by default and you can change it any time.
• Where client review pages are available, each authorized client contact has a private link with Review and/or Billing access. Reviewers see only applications shared with them or deliberately shared with all reviewers at that client. Their replies and suggested times are kept separately with history; permitted colleagues can see replies attributed to the contact link. Possessing a link grants its authority, so forwarding shares access. Billing permission grants access to that client’s invoices only.
• Recruitment agencies: when you apply to a job an agency posts for a client organization, the agency may send your CV to that client through a private link that expires, without your phone number or email. If you tick “The agency may contact me about other jobs”, the agency may keep you among its saved candidates and invite you to its other jobs; you can stop this at any time under My jobs → Applied.
• Organizations ask the same when you apply: if you tick “Keep me in mind for other jobs at this organization”, the organization may keep you among its saved candidates and invite you to its other jobs; you can stop this the same way. Nobody gets more than one invitation a day through jobs.ly.
• Inside the organization you apply to: its hiring team may show your CV, without your phone number or email, to the person who decides (for example a manager) through a private link that expires, to ask their opinion. The link is never shared outside that organization. An organization may also add a hiring manager to a job: they see the CVs of that job's applicants (without phone number, email or uploaded file) to give their opinion, and no other jobs.
• The account owner and recruiters can see the team's ratings and saved offer letters for their applications. Hiring managers can add ratings only on their assigned jobs and see only their own ratings. These records are not part of a public CV and are not shown to other applicants or through public candidate-review links.
• Interviews: when an employer schedules an interview with you, we send you the time and place with a calendar invite, and a reminder the day before. If you answer it (“I'll attend” or “I need another time”, with an optional note), that employer's team sees your answer and note and is told about it.
• Employers you applied to see your answers to their screening questions, and may keep a private note about your application that only their team sees. They can also write to you about that job: you get it by email and see it under My jobs → Applied. If you reply to that email, the employer sees your email address.
• Jobs and organization pages are public unless hidden by a privacy setting. For a confidential job, the organization's name is hidden from visitors and is revealed to an applicant when the organization first messages them through the site or books an interview. A recruitment agency may keep a client's name and page private while managing its jobs internally; the agency itself remains named.

5.Counting visits

• Our own visitor statistics help us improve jobs.ly: which pages are visited, in which language, and which website sent the visitor (for example Google or Facebook). For a job applied for outside jobs.ly (by WhatsApp, phone, email or on the employer's website), we also count presses on its apply button; the employer and our staff see only how many people pressed it. We don't use cookies for this and we don't store your network address. Addresses of private pages are saved without names, account numbers or private link codes. The code that tells visits apart is made with a random value that we replace and delete every day, so nobody can follow you from one day to the next. Visit records are deleted after 13 months. If your browser sends "Do Not Track", you aren't counted at all.
• To improve usability, we measure whether a search leads to a vacancy and whether CV saves, applications on jobs.ly and job submissions finish. A random code for each task is kept in this tab and expires after 24 hours; it is not an account identifier. We also measure loading, responsiveness and layout stability using only a page category, language and screen-size group. We collect no form content, search terms, contact details or full page addresses in these measurements. Records are deleted after 30 days. The analytics opt-out below, Do Not Track and Global Privacy Control disable these measurements.
• We use Google Analytics and its cookies by default on public pages to understand visits and improve the website. Google receives public page addresses without query strings, browser/device information and cookie identifiers, and processes your network address to derive approximate location. We exclude login, account, CV and application pages from this integration, and disable advertising features. You can turn it off or back on using the analytics preferences on this Privacy page. We keep any opt-out you previously saved and respect Do Not Track and Global Privacy Control.
• When you apply for a job, we note with the application where that visit came from (for example a WhatsApp or Facebook link), so the employer learns which channels bring applicants. Nothing is noted if your browser sends “Do Not Track”.

6.Services we use

• Cloudflare protects the site and delivers its pages and files: everything sent to or from jobs.ly passes through it, including CVs, login codes and uploaded files.
• Google: Gemini for AI (as described above), and Google Drive, where our backup copies are stored encrypted so that Google can't read them.
• Voyage AI: search by meaning (as described above).
• Plutu and your payment provider: online payments. They receive the payer's mobile number and email for that payment.
• Our text message provider (iSend, or Twilio) and our email provider deliver login codes and messages, so they receive your phone number or email and the message.
• Your browser's notification service (for example Google or Apple), only if you turn browser notifications on.
• Some of these services process information outside Libya.

7.How long we keep it

• We keep your information while your account is open. After 18 months without account activity, we send you a message; if your account stays inactive, it may be deleted 24 months after its last activity (and at least 30 days after that message), in the same way as “Delete my account”, with a final notice at least 14 days before deletion. Recent session activity and activity by an employer’s team count as account activity. Staff accounts, suspended accounts and owners of organizations with an active paid plan are excluded from automatic inactivity deletion. Because phone numbers are sometimes given to new people, a phone-only account with a CV that returns using a phone code after 12 months or more must first confirm the name or email on its CV.
• Applications: you can withdraw before hiring. The closed attempt no longer grants CV or contact access. Existing authorized team members retain their private notes, ratings and past interview records read-only. An attempt withdrawn while anonymous remains anonymous. Where reapplication is available, a fresh attempt is allowed from the next Libya day, up to 3 attempts per job, except after rejection or declining an offer. After 12 months from job closure, the employer loses phone, email and uploaded-file access.
• When you delete your account, your CV, applications, alerts and uploaded files are deleted at once. A few records stay for a limited time: employers' messages to applicants (1 year), the admin activity log, which may name you if our staff acted on your account (about 13 months), anonymous visit records (13 months), and counters that limit sign-in attempts (up to 90 days). If a recruitment agency hired you for one of its client organizations through jobs.ly, your name stays on that agency's fee record and invoice, which it keeps for its accounting.
• Team invitations that nobody accepts are deleted after 30 days, and an organization verification document that nobody has reviewed after 90 days.
• Messages you send us from the site (the Contact page, a walkthrough request or a feature suggestion) reach our team's email inbox; a copy is kept on our server for 90 days so that none is lost.
• Encrypted backup copies may retain deleted information until those copies are removed. Copies on our server are removed after 14 days (uploaded files after 7 days). Off-site backups currently have no automatic deletion deadline.
• Invoice numbers, amounts, payment references and payment status are retained separately for seven years for accounting and reconciliation; deleted accounts are no longer linked to them.
• Copies outside jobs.ly are not in our control: emails already sent to you, and applicant lists an employer downloaded. Employers must delete those when they no longer need them for hiring.

8.Your choices

You can edit your CV at any time, turn the public link, job-fit alerts and organization suggestions on or off, turn browser notifications off per device (My jobs → Alerts, or organization settings → Notifications), withdraw an application (My jobs → Applied), and delete your account from your CV page or organization settings. To get a copy of your data, use “Download my data” under “Your account” on your CV page or under “Account” in organization settings (an agency's owner also gets its recorded fees), or ask us at privacy@jobs.ly.

9.Contact

For privacy questions, contact us at privacy@jobs.ly.