Privacy Policy

1. Who we are

Prostaff Partners Pvt Ltd (prostaff.app), based in Malé, Republic of Maldives, is responsible for the personal information described here. Questions and requests: [email protected].

2. What we collect

• Account details — email address, password (stored only as a one-way hash), account type, and, if you use it, your two-factor sign-in secret (stored encrypted).
• Profile information — name or business name, headline, bio, skills, industries, location, experience, work links, photo or logo, and for businesses team size and website.
• Contact details you add — phone and WhatsApp numbers.
• Documents — résumés, identity or business verification documents, and payment slips. These are stored in private storage and opened only through short-lived links.
• Activity on the platform — listings, applications, bids, candidate submissions, placements, invoices and payments, ratings, reports, follows, and contact unlocks.
• Messages you exchange with other users.
• Candidate information uploaded by agencies about people who may not have an account (see section 6).
• Technical information — IP address, browser and device information, and security logs, collected when you use the platform, including by Cloudflare's bot and abuse protection.

3. Why we use it

• To provide the platform: run your account, show your profile to the people allowed to see it, deliver applications, bids, messages and notifications. (Necessary to perform our agreement with you.)
• To verify accounts and badges, review payment slips, issue invoices and keep financial records. (Our agreement, and legal obligations.)
• To keep the platform safe: prevent fraud, spam, scraping and account takeover, investigate reports, and enforce our terms. (Our legitimate interest in a trustworthy marketplace.)
• To match vacancies and candidates and improve how search works. (Legitimate interest; a job seeker can turn off "open to work" in their profile.)
• To send service emails — confirmations, password resets, security notices, invoices and, if you leave them on, activity notifications. We do not send marketing email without your consent.

We do not sell personal information, and we do not use it for advertising.

4. Who can see your information

• Job seeker profiles: employer accounts and our staff only. Not other job seekers, not agencies, not the public, and never search engines.
• Your résumé: employers you apply to, and our staff.
• Business profiles (employers, agencies, firms) and open vacancies: public.
• Phone and WhatsApp numbers: only an eligible account that unlocks them. Every unlock is logged with who unlocked it and when.
• Messages: the people in the conversation. Our staff can see a message only if it is reported to them.
• Ratings: shown on the profile of the person rated; the rater is named only to people allowed to see the rater's profile.
• Verification documents and payment slips: our staff only.

5. Service providers and where data is stored

We use a small number of providers who process data on our behalf, under contract, only to run the platform:

• DigitalOcean — hosting, database and private file storage, in its Singapore data centre.
• Cloudflare — network security, bot protection (Turnstile) and content delivery.
• Resend — sending email.
• Google — only if you choose to sign in with Google.

Because our servers are in Singapore, your information is transferred outside the Maldives. We choose providers that protect it with appropriate security. We may also disclose information when the law requires it, to protect people from harm or fraud, or as part of a sale or reorganisation of the business (you would be told).

6. Candidates added by agencies

An agency may add someone to its candidate pool and submit them to employers. The agency must have that person's consent first and confirms it each time; it is responsible for the information it uploads. Candidate information is visible to that agency, to employers it is submitted to, and to our staff. If an agency has added you and you want it removed, contact the agency or write to us and we will act on it.

7. Cookies and similar technology

• A sign-in cookie that keeps you signed in, and security cookies that protect forms from forgery. These are essential.
• Cloudflare security cookies and the Turnstile check, which tell people from bots.
• Your light or dark theme choice, stored in your browser.

We do not use advertising or cross-site tracking cookies.

8. How long we keep it

• Account, profile and activity data: while your account is open.
• When you ask us to close your account: we delete or anonymise your profile, documents and messages within 30 days, except what we must keep.
• Financial records — payments, slips, invoices, placements and the payment ledger: for as long as tax and accounting law requires, even after an account is closed.
• Audit and security logs, reports and moderation records: as long as needed to investigate misuse and resolve disputes.
• Sign-in and password-reset links expire (a password reset link after one hour) and are single-use.

9. Security

Connections are encrypted (HTTPS). Documents are kept in private storage and opened only through links that expire. Passwords are hashed; two-factor secrets are encrypted. Staff accounts must use two-factor sign-in, and sensitive actions — contact unlocks, verification decisions, payment and billing changes — are recorded in an audit log. No system is perfectly secure; if a breach affects you, we will tell you promptly.

10. Your choices and rights

You can view and edit your profile, contact details and notification settings in your dashboard at any time. You can also ask us to:

• give you a copy of the personal information we hold about you;
• correct information that is wrong;
• delete your account and information (subject to what we must keep, above);
• stop using your information for a purpose you object to.

Write to [email protected] from your account's email address. We will reply within 30 days. We may need to confirm it is really you first.

11. Children

The platform is for people aged 18 and over. We do not knowingly collect information from anyone younger; if we learn we have, we delete it.

12. Changes

We will update this policy when what we do changes, and tell you by email or in the platform about significant changes before they apply. The date at the top shows the latest version.