Privacy Policy

DRAFT pending legal review. Not legal advice.

Effective date: not yet in force Last updated: 16 July 2026

1. Who we are

This Privacy Policy explains how the operating company (registration pending) ("Elevenio," "we," "us," or "our"), the operator of the Elevenio platform (the "Platform"), collects, uses, stores, shares, and protects personal data. Our registered address is the registered address (pending).

For the first year of operation, the operating company (registration pending) is registered in the United Arab Emirates and this Policy is issued primarily under the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL"). In year two, operations are planned to transition to a Saudi Arabia entity, a Saudi entity to be established, and this Policy will be updated at that time to reflect obligations under the Saudi Personal Data Protection Law (the "Saudi PDPL"), enforced by the Saudi Data and Artificial Intelligence Authority ("SDAIA"). If any part of our operations is instead established in a UAE financial free zone (DIFC or ADGM), the applicable free zone data protection regulation will govern that entity instead, and this Policy will be revised accordingly.

Elevenio is a bilingual (English and Arabic) platform offering three products:

1. A two-sided learning marketplace where teachers sell recorded courses and live classes to students, and the Platform takes a 20% commission on sales.
2. An AI CV generator that processes uploaded CVs and related personal data to produce a formatted CV and application materials.
3. An AI voice interviewer that records a user's audio (and, if the user opts in, video), transcribes the recording, and generates interview feedback using third-party AI providers.

This Policy applies to all three products, our website, and our mobile applications, in both English and Arabic. Where there is any conflict between language versions, the version specified in the applicable user agreement controls, subject to any mandatory local language requirements.

2. Data we collect

2.1 Account and identity data

Name, email address, phone number, country of residence, date of birth (to verify age eligibility), password (stored as a salted hash), profile photo, and, for teachers, tax or business registration details needed for payout and invoicing.

2.2 Marketplace data

For students: courses purchased, enrollment history, progress data, quiz and assignment results, messages sent to teachers, reviews and ratings. For teachers: course content uploaded (video, audio, slides, documents), pricing, payout bank or wallet details, sales history, payout history, tax identifiers, and any certifications or qualifications submitted for verification.

2.3 AI CV generator data

The CV file you upload (PDF, Word, or similar), and any personal data contained in it: work history, education, skills, certifications, contact details, and any other information you choose to include. We do not ask you to remove sensitive details before upload, but we recommend you avoid including data such as religion, health information, or national ID numbers unless the target employer specifically requires it, because we cannot control what a downstream employer does with it once you submit your CV to them.

2.4 AI voice interviewer data

Audio recordings of your voice, and, only if you separately opt in, video recordings. Transcripts generated from those recordings. AI-generated scoring, feedback notes, and any answers you type or select during the session. See our separate Recording Consent Notice for the specific consent flow that applies before any recording starts.

2.5 Payment data

We do not store full card numbers. Payments are processed by Tap Payments and, where selected, Apple Pay. We receive confirmation of payment status, a masked card reference, transaction amount, currency, and transaction ID. Tap Payments and Apple Pay handle cardholder data under their own PCI DSS obligations.

2.6 Technical and usage data

IP address, device type, browser type, operating system, language preference, pages visited, session duration, referring URL, and approximate location derived from IP address. See our Cookie Policy for details on cookies and similar technologies.

2.7 Communications data

Support tickets, emails, chat messages, and call recordings if you contact our support team and are notified that the call may be recorded.

3. Why we process your data and our legal basis

Under the UAE PDPL, we rely on one or more of the following legal bases for each processing activity:

• Consent: for AI voice interviewer recordings, marketing communications, and any processing of sensitive categories of data. You can withdraw consent at any time without affecting processing carried out before withdrawal.
• Contract necessity: to create your account, process a course purchase, pay a teacher, generate your CV, or run an AI interview session you requested.
• Legal obligation: to comply with tax, accounting, anti-money-laundering, or regulator requests.
• Legitimate interest: for fraud prevention, platform security, service improvement, and aggregated analytics, balanced against your rights and only where it would reasonably be expected.

Where Saudi PDPL applies to KSA-resident users or the KSA entity, the equivalent legal bases under that law apply, and we will update this section once the KSA entity is operational.

4. How we use artificial intelligence and third-party AI providers

To deliver the AI CV generator and AI voice interviewer, we send parts of your data to third-party AI service providers that process data outside the UAE and KSA. As of the date of this Policy, these providers include:

Some of the processors below are not yet engaged. Payment processing, AI providers and speech-to-text are configured but not connected, so no personal data is being sent to them today. They are listed here because they are the processors we will use, and this Policy is published in the form it will take at launch rather than being rewritten each time one is connected.

• OpenAI (language model processing for CV analysis, content generation, and interview feedback), based in the United States.
• Anthropic (language model processing for CV analysis, content generation, and interview feedback), based in the United States.
• Google (language model and cloud infrastructure processing), based in the United States, with data centers in multiple countries.
• Deepgram (speech-to-text transcription of interview audio), based in the United States.
• ElevenLabs (voice processing and, where used, synthetic voice features), based in the United States and the European Union.

We may add, remove, or change providers as our AI stack evolves. We will keep an up-to-date list of active sub-processors available on request and will notify users of material changes through the Platform or by email.

Each provider processes your data under a data processing agreement that includes confidentiality obligations, security requirements, and a restriction on using your data to train their general-purpose models, to the extent we are able to negotiate that term with each provider. Some providers may retain limited data for abuse monitoring or safety review for a short period under their own policies; we require providers to disclose this and we pass that information to you on request.

AI outputs are generated automatically and may contain errors. See our separate AI Disclaimer for the limits of these features.

5. Cross-border data transfer

Because our AI providers, cloud infrastructure, and some support tools operate outside the UAE and KSA, we transfer personal data internationally. We do this only where at least one of the following applies, consistent with the UAE PDPL and, where relevant, the Saudi PDPL:

• You have given express consent to the transfer, which we obtain at account creation and again at the point you use the AI CV generator or AI voice interviewer.
• The transfer is necessary to perform our contract with you, for example generating your CV or your interview feedback.
• The transfer is made under contractual safeguards equivalent to standard contractual clauses, requiring the recipient to protect your data to a standard consistent with UAE PDPL and Saudi PDPL requirements.

Where required by law, we conduct and document an assessment of whether the recipient country offers adequate protection and effective remedies before transferring data there, and we keep that assessment on file. If we later establish a Saudi entity, we will separately assess cross-border transfers against SDAIA's Regulation on Personal Data Transfer Outside the Kingdom and its 2025 Risk Assessment Guideline, which may require additional safeguards or, for certain sensitive or large-scale data sets, local storage within the Kingdom.

6. Sensitive and biometric data

Your voice recording, and any video you choose to submit to the AI voice interviewer, can constitute biometric or sensitive data under applicable law. We only process this data:

• After you give separate, explicit, informed consent through the Recording Consent Notice, distinct from your general acceptance of these Terms.
• For the specific purpose of transcription, AI-generated interview feedback, and, if you choose to save the session, storage for your own later reference.
• With the retention limits described in Section 8 below.

You can withdraw this consent at any time, including mid-session, which stops the recording and prevents further processing of that session's audio or video. Withdrawal does not affect processing already completed.

7. Who we share your data with

• Teachers and students, limited to the data needed to run a course transaction (for example, a teacher sees a student's name, email, and course progress; a student sees a teacher's public profile and course content).
• Tap Payments and, where used, Apple Pay, to process payments and payouts.
• The AI providers listed in Section 4, limited to the data needed to generate the requested output.
• Cloud hosting and infrastructure providers that store platform data.
• Employers or recruiters, only if you affirmatively choose to submit or share your CV, interview recording, transcript, or AI feedback with them through the Platform.
• Regulators, courts, or law enforcement, where required by law.
• A successor entity, if we undergo a merger, acquisition, or asset transfer, subject to the same or stronger data protection commitments.

We do not sell personal data.

8. Retention periods

If you delete your account, we delete or anonymize personal data within the periods above, except where we are legally required to retain specific records for longer (for example, financial and tax records).

9. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request erasure of your data, subject to our retention obligations above.
• Restrict or object to certain processing, including direct marketing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, without affecting past processing.
• Lodge a complaint with the UAE Data Office or, once applicable, SDAIA.

To exercise these rights, contact us at privacy@elevenio.com. We respond within 30 days, consistent with UAE PDPL expectations. We may need to verify your identity before acting on a request.

10. Children and minors

Elevenio is intended for users aged 18 and older. Consistent with the UAE PDPL's age of consent and the UAE Child Digital Safety Law, we do not knowingly collect personal data from children under 13 without verifiable parental consent, and we restrict independent account creation to users who confirm they are 18 or older. If a course is designed for younger learners, enrollment must go through a parent or guardian account, and the guardian provides consent on the minor's behalf. The AI voice interviewer and AI CV generator are not intended for use by anyone under 18. If we learn that a minor has provided personal data without the required consent, we will delete it. This section reflects a draft policy position; confirm against the platform's actual target age groups before publication.

11. Security

We apply technical and organizational measures appropriate to the sensitivity of the data, including encryption in transit and at rest for sensitive data such as voice recordings and CVs, access controls limiting staff access on a need-to-know basis, and monitoring for unauthorized access. No system is completely secure, and we cannot guarantee absolute security.

12. Cookies and tracking

We use cookies and similar technologies as described in our Cookie Policy, including for essential platform functions, analytics, and, where you consent, marketing.

13. International visitors, including EU users

If you access Elevenio from the European Economic Area or the United Kingdom, we apply GDPR-equivalent standards to your data where our processing falls within its scope, including the consent standards described in our Cookie Policy and the transfer safeguards described in Section 5.

14. Changes to this Policy

We may update this Policy as our products, providers, or legal obligations change. We will post the updated version with a new "Last updated" date and, for material changes, notify you by email or platform notice.

15. Contact us

the operating company (registration pending) the registered address (pending) Email: privacy@elevenio.com