Privacy Policy

1. Information We Collect

We collect the following categories of data:

• Account information — your full name, email address, phone number (optional), and password (stored as a one-way hash). If you sign in via Google, we receive your name and email from Google.
• Onboarding profile — when you sign up as a 30-Day Plan user, the answers you give to build your personalised plan: your chosen income stream, profession, skills, professional summary, website / LinkedIn / GitHub links, WhatsApp number (optional), work experience, education, languages, certifications, projects, achievements, interests, online-earning experience, available hours per week, and monthly income target (PKR). Older accounts may also hold job title, company name, primary skill, and risk tolerance from our previous onboarding. This data is used to generate your personalised plan, recommendations, and daily tasks.
• Professional / CV profile — headline, summary, website, LinkedIn, GitHub, work experience, education, skills, languages, certifications, projects, achievements, and interests, which you enter voluntarily. This powers your AI-generated plans and, only if you claim a username, the public content shown on your Digital Visiting Card (see below).
• Resume — a PDF or Word document you upload to your profile, up to 200KB. It's used to power AI-drafted job application emails and, if you use the Chrome extension, is attached automatically when you apply to a Job Board listing. You can remove it from your profile at any time.
• Job Board activity — which admin-posted job listings you view, your AI-drafted application email and any edits you make to it, and whether you've marked an application as sent. Sending the application itself (available via the Chrome extension) happens through your own connected Gmail account — see section 3 and our Extension Privacy Policy.
• Income logs — amounts (PKR), source descriptions, client names, and dates that you voluntarily enter when logging earned income.
• Task activity — which tasks you have completed, completion timestamps, and points earned.
• Notes & sticky notes — the private notes and sticky notes you write on your dashboard. These are visible only to you — never to other users — and the same sticky notes also appear in the ZiadaKamao Chrome extension if you use it, since both read and write the same account data.
• Community content — posts, comments, and likes you submit to the community feed.
• Ideas Wall posts — business ideas or platform-improvement suggestions you post, plus the likes and comments you and others leave on them.
• Usage data — pages visited, features used, and session timestamps, collected on the website and, separately, within the Chrome extension, to improve the platform and for analytics purposes.
• Feedback and contact messages — star ratings, comments, and messages you send via the feedback form or contact section.
• Collaboration Board activity — job posts, bids (price, timeline, pitch message), and the messages you send in an in-app chat once a bid is accepted. Your phone number is shared with the other matched user (poster or bidder) only after a bid is accepted, so you can coordinate the work directly.
• Sell Your Services activity — the Gigs (services) you list, the bids you place on other sellers' Gigs, the messages you send once a bid is accepted, and the ratings and written reviews left after a Gig is completed.
• Service inquiries — the name, email, phone number, and message you submit when requesting a paid Expert Service (e.g. freelancing consultation, gig or profile optimization).
• Career Growth roadmap requests — if you submit the public Career Growth request form (no account required), we collect your name, contact details, and the career context you provide — which can include your current and target role, salary, and circumstances such as a layoff or upcoming promotion review — used solely to generate and deliver your roadmap. Requests submitted through our earlier public Personalised Plan form are held the same way.
• Digital Visiting Card — if you claim a username, the account and professional profile information listed above (subject to what you choose to show) is published at your public card link, visible to anyone with that link.
• Waitlist signups — your name and a contact method if you join the waitlist for a feature that isn't live yet.
• Billing data — ZiadaKamao is currently free, so we do not collect payment details to use the platform. If you previously bought a subscription, records of that purchase (processed by our former billing partner RevenueCat, or verified manually by our team) are kept for our financial records.

2. How We Use Your Information

• To generate and personalise your AI income stream recommendations, 28-day action plan, career growth plan, daily tasks, tips, skill lessons, and quiz questions.
• To track your income progress, streaks, points, and milestones and display them on your dashboard.
• To send WhatsApp task reminders and email notifications about your account.
• To power the community feed, leaderboard, Ideas Wall, and public share card features.
• To sync your notes and sticky notes between the web dashboard and the Chrome extension.
• To let you apply to Job Board listings — drafting a personalised application email via AI and, if you use the Chrome extension and choose to send it, attaching your uploaded resume and sending it through your own connected Gmail account.
• To analyse platform-wide and extension usage trends and improve our product.
• To respond to your support requests, feedback, and contact messages.
• To operate the Collaboration Board and Sell Your Services marketplaces — matching posts with bids, enabling in-app chat, and revealing contact details between matched users once a bid is accepted.
• To route your Expert Service inquiry to the relevant team member so they can reach out to confirm scope and pricing.
• To build your personalised 28-day plan from your onboarding answers, and to generate and deliver a Career Growth roadmap you've requested — creating an account for you if you don't already have one.
• To publish your Digital Visiting Card at your chosen username, only once you claim one.
• To review Ideas Wall posts for payout eligibility and coordinate a reward with you if your post qualifies.
• To apply fair-use limits to free AI features so the platform stays available to everyone.
• To detect and prevent fraudulent or abusive behaviour.

3. AI Processing

ZiadaKamao uses Anthropic's Claude AI models to generate personalised content. When generating recommendations, action plans, personalised plans, career growth plans, or quiz questions, relevant parts of your profile (your onboarding answers such as skills, experience, education, available hours, and income target, or — for roadmap requests — the career context you submitted) are sent to Anthropic's API as part of a prompt. Your name may be included so the plan can be written for you. This also applies to Career Growth roadmap requests submitted before an account exists. Anthropic processes this data solely to return AI-generated text and does not use it to train their models under their standard API terms. We do not send your email address, phone number, income logs, or payment information to Anthropic.

4. Sending Job Applications via Google (Gmail)

If you apply to a Job Board listing using the ZiadaKamao Chrome extension, you can connect your own Gmail account so the application email is sent from you, as yourself. This requests Google's narrow gmail.send permission — enough to send the one email you review and explicitly click "Send" on, nothing more. We never read, search, or modify your inbox, and never access your Drive, Contacts, or Calendar. Full detail on exactly what this can and cannot do is in our Extension Privacy Policy.

ZiadaKamao's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements.

5. Data Sharing

We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:

• Service providers — trusted third-party services we use to operate the platform, including Anthropic (AI processing), Cloudflare R2 (resume and file storage), Google's Gmail API (only for job application emails you send via the extension, see section 4), database hosting providers, and email delivery services. These providers process data only on our behalf and under confidentiality obligations.
• Analytics — we use Google Analytics to understand how the platform is used. Google Analytics collects anonymised usage data via cookies. You can opt out using Google's opt-out tools.
• Legal requirements — if required by Pakistani law, court order, or regulatory authority, we may disclose your data to comply with legal obligations.
• Public profile features — if you enable your public share card or participate in the leaderboard, your display name, income milestones, and streak data are visible to other users. You can disable this in Settings at any time.
• Digital Visiting Card — claiming a username publishes your card at a public link, reachable by anyone without logging in. This only happens if you actively claim a username; it is entirely your choice, and you can disable or delete the card at any time.
• Collaboration Board & Sell Your Services matches — when you post a job or Gig, your name, city, and (once a bid is accepted) phone number are visible to the accepted bidder, and vice versa. Before a bid is accepted, other users see only your name, city, and post/bid details — never your phone number. This is a direct, peer-to-peer disclosure between matched users to let them coordinate work; it is not a sale or third-party share of your data. A Gig review you write or receive (rating and comment) is shown publicly on that Gig's listing.

6. Data Storage & Security

Your data is stored in a PostgreSQL database hosted on secured cloud infrastructure. Passwords are hashed using bcrypt and are never stored in plain text. Refresh tokens are also stored as bcrypt hashes. Access tokens exist only in memory (your browser) and are never persisted to disk. Uploaded resumes are stored separately via Cloudflare R2 object storage and are private by default — retrieved only through short-lived, authenticated links generated when you or the extension needs to view or attach one, never a permanent public URL.

We implement industry-standard security measures including encryption in transit (TLS), secure API authentication (JWT), and rate limiting. Our own internal admin panel additionally requires a one-time code emailed to a fixed, tightly controlled inbox on every login, on top of a password, before any staff access to the systems that manage your data is granted. No system is completely secure, however — if you become aware of any security vulnerability, please notify us immediately at support@ziadakamao.com.

7. Cookies

ZiadaKamao uses a minimal number of cookies:

• Session cookie (zk-logged-in) — a boolean cookie used by our Edge middleware to determine whether to protect authenticated routes. It contains no personal data.
• localStorage — we store your user profile and refresh token in your browser's localStorage to maintain your session across page reloads. You can clear this at any time by logging out.
• Google Analytics cookies — used for anonymised usage analytics. You can opt out via your browser settings or Google's opt-out tools.

8. Your Rights

You have the following rights over your data:

• Access — you can view your profile, income logs, and activity data within the platform at any time.
• Correction — you can update your profile and onboarding information from your profile and settings pages.
• Deletion — you can permanently delete your account and all associated data from the Settings page, including your job posts, bids, Gigs, reviews, chat messages, Digital Visiting Card, resume, notes, and sticky notes. Deletion is irreversible. Note that Service inquiries and Career Growth roadmap requests you submit before an account exists are not tied to an account (they only require your contact details) — to have one deleted, contact us directly.
• Data portability — to request a copy of your data in a portable format, contact us at support@ziadakamao.com.
• Opt-out of communications — you can disable WhatsApp reminders and email notifications from your Settings page.

9. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, your personal data (name, email, profile, income logs, tasks) is permanently deleted within 30 days. Anonymised, aggregated platform statistics (e.g., total income logged by all users) may be retained indefinitely as they contain no personal information. Records of a paid Ideas Wall reward may be retained for as long as reasonably needed for our financial and audit records.

10. Children's Privacy

ZiadaKamao is not intended for use by anyone under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us and we will delete it promptly.

11. Chrome Extension

The ZiadaKamao Chrome extension mirrors parts of your dashboard — tasks, opportunities, services, blogs, sticky notes, and the Job Board — inside your browser's new-tab page, using the same account data described throughout this policy. It requires an existing ZiadaKamao account and never creates a separate one. What the extension itself can access, store, and how sign-in and Gmail sending work inside it is covered in full in our separate Extension Privacy Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. For significant changes, we will notify you via email or an in-app notification. We encourage you to review this page periodically. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

13. Contact Us

For any privacy-related questions, data requests, or concerns, please reach us at: support@ziadakamao.com