Privacy Policy

This Privacy Policy for Misbau LLC ("Company", "we", "us", or "our") describes how and why we collect, store, use, and share your information when you use rightqs.com (the "Services"). RightQS is a matching platform for Quantity Surveyors ("Candidates") and the organisations that hire them ("Employers"). Reading this policy will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use the Services. Questions or concerns: contact us at legal@misbau.com.

Summary of key points

We collect the professional information you choose to give us: your account details, professional profile, CV, preferences, and, for Employers, organisation and role details.
If you upload a CV, it is processed by an AI service to draft your profile. You review and confirm everything before your profile goes live, and you can build your profile manually instead.
Your identity is hidden from Employers until you and an Employer both express interest in a match. At that point your name and contact email are shared with that Employer, and their organisation details are shared with you.
We do not sell your personal information, and we do not use it for third-party advertising.
Our database is hosted in the European Union. CV extraction is processed in the United States.
You can access, correct, or delete your information at any time, in the app or by emailing us.

1. What information do we collect?

Information you provide

Account data: name, email address, and password (your password is stored only in hashed form by our authentication provider).
Candidate profile data: your CV document (if you upload one), employment history, capabilities and proficiency, sector and regional experience, qualifications, professional memberships, software skills, seniority, compensation expectations, location and mobility preferences, notice period, and availability.
Employer data: organisation name, type, size, location, verification details, contact details, and the requirements of the roles you post.
Messages: messages you exchange with a matched party through the Platform, and reports you submit about other users.

Information collected automatically

Like most services, we automatically receive technical data needed to operate securely: IP address, browser type, and access logs. We use essential cookies, which keep you signed in, and the first-party campaign-attribution cookie described below. We do not run third-party advertising or tracking cookies, and we do not use advertising pixels or tags.

Campaign attribution

When you first arrive at RightQS through certain marketing links, we may store a first-party attribution cookie containing limited campaign labels: the campaign source (for example, a social network), the marketing channel, the campaign name, the advertisement variant you arrived from, and the date of that first visit. We use this information to understand which campaigns lead to registrations and completed RightQS profiles. Only the first campaign that brought you to RightQS is recorded; later visits do not change it. The cookie does not contain your CV, your profile information, or any identifier assigned to you by an advertising platform, and it expires after 90 days. If you register, we keep the same campaign labels with your account for reporting; they are deleted with your account.

2. How do we process your information?

To create and administer your account and authenticate you.
To build your professional profile, including AI-assisted CV extraction if you choose to upload a CV (see section 4).
To compute compatibility between Candidates and roles using a deterministic scoring method, and to show each side anonymised information about the other before a mutual match.
To release identities and open a conversation when both sides of a match express interest (see section 5).
To send you service emails, such as email confirmation and notifications about your matches. You can control non-essential notifications.
To verify Employer organisations, keep the Platform safe, prevent fraud and misuse, and enforce our Terms of Use.
To comply with our legal obligations.

We process your information with your consent (which you may withdraw at any time), to perform our contract with you (matching is the service you signed up for), to comply with law, and for our legitimate interests in operating a safe and trustworthy platform.

With other users, as the product is designed to do:

Before a mutual match, Employers whose roles are compatible with your profile see an anonymised card (for example seniority, years of experience, and location), never your name, contact details, or CV. Candidates see role cards which may be confidential (employer type shown, name withheld).
On a mutual match, your name and contact email (for Candidates) or organisation name and contact details (for Employers) are shared with the other party of that match.
Your CV document itself is never shown to Employers unless you choose to share it with them yourself.

With service providers acting on our instructions: our database and file storage provider (Supabase, hosted in the European Union), our web hosting provider (Vercel), our email delivery provider (Resend, European region), and, for CV extraction only, our AI provider (Anthropic, processed in the United States). These providers process your data only to provide their services to us.

Otherwise: we may disclose information where required by law, to protect the rights, property, or safety of RightQS, our users, or others, or in connection with a merger, sale, or reorganisation of our business. We do not sell your personal information and we do not share it with third parties for their own marketing.

4. How is AI used on your CV?

If you upload a CV, the document is sent to our AI provider to read it and propose structured profile entries: employment history, capabilities, qualifications, and similar professional facts. The extraction is instructed to ignore protected personal characteristics such as nationality, age, gender, religion, marital status, or photographs. Everything it proposes is shown to you for review and correction before your profile can go live, and rows you have not confirmed carry less weight in matching. Match scoring itself is deterministic and does not use AI. You can skip CV upload entirely and type your profile by hand; the result is treated identically.

5. Is your information transferred internationally?

Our database and storage are hosted in the European Union (Frankfurt, Germany). Web pages are served by our hosting provider's global network. Transactional email is sent from the European Union (Ireland). CV extraction is processed in the United States. If you access the Services from the United Arab Emirates or elsewhere, you are transferring your data to these locations, and by using the Services you consent to that transfer. We choose providers that maintain recognised security and data protection standards.

6. How long do we keep your information?

We keep your information for as long as your account exists. If you delete your account, or ask us to delete it, we delete or anonymise your personal information within thirty (30) days, except where we are legally required to retain it, or where limited records (such as audit logs of safety-relevant actions) must be kept for legitimate purposes, in which case they are retained only as long as necessary. Information already released to a matched party before deletion may remain with that party, subject to their own legal obligations.

7. How do we keep your information safe?

We have implemented appropriate technical and organisational security measures, including encrypted connections (HTTPS), hashed passwords, database-level access rules that isolate each account's data, private (non-public) CV storage, and audit logging of sensitive actions. However, no electronic transmission or storage technology can be guaranteed to be 100% secure, so we cannot promise that unauthorised third parties will never defeat our security. You use the Services at your own risk and should keep your password confidential.

8. Do we collect information from minors?

We do not knowingly collect data from or market to anyone under 18 years of age. By using the Services, you represent that you are at least 18. If we learn that information from a person under 18 has been collected, we will deactivate the account and delete the data. If you become aware of any data we may have collected from anyone under age 18, please contact us at legal@misbau.com.

9. What are your privacy rights?

Depending on where you live, you may have rights to access, correct, update, port, restrict the processing of, or delete your personal information, and to withdraw consent you have given. On RightQS you can exercise most of these directly: your profile is viewable and editable in the app at any time, your profile status controls whether you are matched at all, and you can ask us to delete your account and data by emailing legal@misbau.com. We will respond to any request within a reasonable time and in accordance with applicable law. If you believe we are processing your information unlawfully, you also have the right to complain to your local data protection authority.

10. Controls for do-not-track features

Most web browsers include a Do-Not-Track ("DNT") feature. Because we do not track our users across third-party websites, we respond to DNT signals by default: there is no cross-site tracking to switch off.

11. Do we make updates to this notice?

Yes, we will update this notice as necessary to stay compliant with relevant laws. The updated version will be indicated by an updated "Last updated" date at the top of this page. If we make material changes, we will notify you by prominent notice on the Platform or by email.

12. How can you contact us about this notice?

If you have questions or comments about this notice, you may email us at legal@misbau.com or contact us by post at:

Misbau LLC
Sharjah Media City
P O Box 130130
Sharjah, United Arab Emirates

To review, update, or delete the data we collect from you: sign in and open your profile, or email us at the address above and we will act on your request.