Privacy Policy

Last updated: 15 September 2026

Howeyah helps you get a .cv domain in your name and a personal website built from your CV. To do that we handle personal data about you and about people who visit your page. This policy explains what we collect, why, who we share it with, and the choices you have.

Howeyah is the controller of this data under Egypt's Personal Data Protection Law (Law No. 151 of 2020). If you have a question or request, email help@howeyah.cv.

1. What we collect

Account details: your name, email address and password (stored by our authentication provider, never in plain text). If you sign in with Google, we receive your name, email and profile picture from Google.
Your page content: everything you add to your page or that we extract from your CV, such as your headline, experience, education, skills, links, photo, phone number and email. Your uploaded CV file is stored so it can be processed.
Registration details: the name, email, phone number and postal address required to register a domain in your name.
Payment details: the order amount, status and transaction reference. Card and wallet details are entered on Paymob's secure page; we never see or store full card numbers.
Visitor statistics for your page: the day of the visit, the referring website, and an approximate city and country. Visitors are counted with a one-way code made from their IP address, browser and date, which we can't turn back into an IP address.
Contact requests: when a visitor asks to see a page owner's contact details, we collect the phone number or email they verify with, and send them a one-time code.
Technical data: sign-in session tokens, your language choice, names you save while searching, and a random visitor ID used to test different versions of our home page. These are stored in cookies or your browser's local storage.
Messages: emails and WhatsApp messages we send you, such as verification codes, receipts and renewal reminders.

2. How we use it

To provide the service: create your account, build and publish your page, register and renew your domain, and process payments. (Contract)
To turn your CV into page content and suggest better wording, using an AI model. (Contract, at your request)
To send service messages: verification codes, receipts, domain status and renewal reminders. (Contract)
To show you visitor statistics and who asked for your contact details. (Contract)
To keep Howeyah secure: rate limits, fraud and abuse prevention, and fixing errors. (Legitimate interest)
To improve the website, including measuring which version of the home page works better. (Legitimate interest)
To meet legal, tax and accounting obligations, and to respond to lawful requests. (Legal obligation)
To send product news, only if you turn it on in your account settings. You can turn it off at any time. (Consent)

We don't sell your personal data, and we don't use it for advertising.

3. What's public

Your published page is public: anyone with the link, and search engines and AI assistants, can see and index the content you publish there. We also publish a plain-text version of your page so AI assistants can read it accurately. Unpublished drafts are private.

Your phone number and email are not shown on your page unless you choose to show them. If you allow contact requests, a visitor must first verify their own phone number or email with a one-time code.

Domain registries may publish or disclose registrant contact details (WHOIS/RDAP) according to their policies. See the .cv registry's policies at pages.ola.cv.

4. Who we share it with

We share personal data only with service providers that help us run Howeyah, and only as much as each one needs:

ola.cv, the .cv domain registry and registrar: your registration details, to register and renew your domain.
Paymob: order and billing details, to process payments and refunds.
Supabase: our database, sign-in and file storage (hosted in the European Union).
Google Cloud: hosting for our API (European Union), and the Gemini AI model that reads CVs and suggests wording.
Google: sign-in, if you choose to continue with Google.
Vercel: hosting for our website and your page, and connecting your domain.
Resend: sending emails.
Meta (WhatsApp Business): sending WhatsApp messages, once enabled.

We may also disclose data when the law requires it, to protect people's rights and safety, or as part of a merger or sale of the business (in which case this policy continues to apply).

5. International transfers

Some of these providers store or process data outside Egypt, including in the European Union and the United States. When data leaves Egypt we rely on providers with strong security and contractual protections, and on the permissions available under Egyptian law. By using Howeyah you acknowledge these transfers are needed to provide the service.

6. How long we keep it

Account and page data: while your account is active. When you delete your account we remove your page, CV records and contact details straight away.
Orders and payment records: kept after account deletion for as long as tax and accounting law requires.
One-time codes and unpaid orders: deleted or cancelled within 2 days.
Visitor statistics: kept while the page exists and deleted with it.
Backups: may hold deleted data for a limited time until they're overwritten.

7. Your rights

Under Egyptian law you can:

Know what personal data we hold about you and get a copy. You can download your data from your account settings.
Correct inaccurate data, most of which you can edit yourself.
Ask us to delete your data. You can delete your account from your account settings.
Object to or restrict certain uses, and withdraw consent you've given.
Complain to Egypt's Personal Data Protection Center.

To use any of these rights, email help@howeyah.cv. We may need to confirm your identity first. Deleting your account doesn't cancel a domain that's already registered in your name; it stays registered until it expires.

8. Security

We use encryption in transit (HTTPS), access controls, hashed passwords and one-time codes, rate limits, and security headers, and we limit staff access to what's needed. No system is perfectly secure; if a breach affects your personal data we'll notify you and the authorities as the law requires.

9. Children

Howeyah is meant for people aged 18 and over. Younger users may only use it with the involvement and consent of a parent or guardian, who is responsible for the account.

10. Changes

We'll update this policy when our service or the law changes, and change the date at the top. If a change is significant, we'll tell you by email or in your account before it takes effect.