Skip to content
Gradly

Privacy Policy

Version 2026-10-30Published

Preliminary edition, pending legal review. The operator's details and the values marked in the text will be published before registration opens.

1. Who we are

Gradly (gradly.uz; the Platform) helps students and graduates find jobs and internships, and helps employers find candidates.

The owner and operator of the Platform's personal data database (the Operator, "we"): the operator's details will be published before registration opens.

We process personal data in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (ZRU-547), as amended, and this Policy. Registration number of the database in the State Register of Personal Data Databases: to be published before registration opens.

2. What data we process

  • Account: first and last name, email address, password (stored only as a hash), role on the Platform (student or employer), interface language, date of the last sign-in.
  • Employer data: the organization's name, description, registration details and public page (logo, tagline, size, founding year, links to the website and social networks); the names and contact details of its representatives; the roles of its team members.
  • Education: institution, field of study, degree, years of study, graduation year.
  • Profile and CV: phone number, city, personal summary, work experience (organization, position, period, responsibilities), projects, certificates and achievements, languages and proficiency, skills, links, interests, job preferences ("What I'm looking for": fields, employment type, format, regions), uploaded CV file.
  • CV photo — only if you upload one. The photo is redrawn without metadata (location, device), used only in your CV and never shown in candidate lists or cards.
  • Applications: the vacancies you applied to, cover letters, the selection stages and their history, interview invitations and your answers, the employer's decision (including the rejection template), invitations to apply.
  • Messages: messages between you and the employer inside an application, and reports of messages.
  • Activity on the Platform: favorite vacancies, saved searches and their alert frequency, the career readiness score and its weekly values, assistant tips you hid.
  • Appearances and views: which organizations found you in search and suggestions, and opened your profile, contact details and CV, and when.
  • Consents: which consents you gave or withdrew, the document version, the date, and your IP address and browser details at that moment.
  • Technical data: IP address, browser and device type, session data, security log entries about sign-ins and about access to personal data, anonymized error reports.
  • Telegram (only if you turn on Telegram notifications): chat ID and username.
  • Demo requests and support requests: in a demo request — the organization, name, position, work email, phone (if you give one), message and language; in a support request — its kind, the description, the page address without its parameters, brief browser details, a screenshot (if you attach one), an email for the reply (if you are not signed in) and the support team's reply.

We do not ask for special categories of personal data (health, racial or ethnic origin, religious or political views) or genetic data, and we do not use photos for biometric identification. Please do not include such information in your CV, in "About me", in messages or in support requests. Never send passport details or passwords in messages. Do not attach screenshots that show other people's data to a support request.

3. Why we process data

  1. To create and maintain your account, let you sign in, verify your email address, and protect staff sign-in with two-factor authentication.
  2. To fill in your profile, build your CV and suggest improvements to its text.
  3. To apply for vacancies: the employer whose vacancy you apply to, and its team members, receive your profile, CV and cover letter and move the application through their selection stages.
  4. To let you and the employer exchange messages about an application, and to handle reports of messages.
  5. To give recommendations: matching vacancies with explanations, the career readiness score and "what to do today" tips, a draft cover letter. All of this is computed by algorithms on the Platform's servers, without external artificial intelligence services.
  6. To show your profile to verified employers in candidate search and in their suggested candidates for a vacancy, and to let them invite you to apply — only with your separate consent.
  7. To send notifications about application status, messages, interviews, invitations, new vacancies for your saved searches, deadlines and account security — on the Platform and by email, and in Telegram only with your separate consent.
  8. To let you exercise your rights: downloading your data, deleting your account, the "Who viewed my profile" page and its daily summary.
  9. To keep the Platform secure: antivirus scanning of uploaded files, protection against break-ins and abuse, request rate limits, records of access to personal data, error reports, backups.
  10. To prepare anonymized statistics, for example on graduate employment by field of study.
  11. To comply with the legislation of the Republic of Uzbekistan.
  12. Demo requests for companies, universities and government bodies, and support requests: replying, fixing errors, keeping track of requests.

We do not sell personal data and do not use it for third-party advertising.

4. Legal basis

The basis for processing is your consent. When you sign up, you accept the Terms of Use and give your consent to personal data processing for purposes 1–5 and 7–11.

Showing your profile to employers, suggestions and invitations (consent) and Telegram notifications (consent) require separate consents. They are optional: you can use the Platform without them.

A demo request or a support request (purpose 12) can be sent with or without an account; the basis for processing its data is the consent its sender gives by sending the form after being told its purpose and retention period.

When a new version of a required document is published, the Platform asks you to accept it at your next sign-in; your account stays closed until you do.

Without consent we process data only where the law expressly provides for it, for example at the request of authorized state bodies.

5. Who can see your data

  • You — all of your data in your account. Only you see your career readiness score.
  • Employers. Only organizations verified on the Platform can access student data, and only the members of their team (owner, administrators, recruiters, observers):
    • the employer whose vacancy you applied to sees your profile, contact details, CV and cover letter while your application is active; the team's notes on your application are visible to the team only;
    • for applications, the employer sees how you match the vacancy (skills, languages, education, experience, region) — the same facts you see on the vacancy page;
    • other verified employers can find you in candidate search and among the suggested candidates for their vacancies and invite you to apply — only if you consent to showing your profile. A card shows your first name and the initial of your last name, education, region and skills; contact details and the CV are opened by a separate action;
    • messages about an application are visible to you and to the employer's team.
  • Universities and government bodies receive only anonymized aggregate statistics that cannot identify a specific person.
  • Platform administrators — to the extent needed for user support, moderation and security, through the Platform's console, where every read is logged. An administrator sees a message only when it is reported, and only that message. The Platform's support staff see support requests, the screenshots attached to them and demo requests; every download of a screenshot is logged.
  • Processors acting on our instructions and bound by confidentiality: hosting provider — to be published before registration opens (servers in the Republic of Uzbekistan) and the email service for service emails — name and country to be published before service emails are switched on.
  • Government bodies — upon requests made in accordance with the law.

Every time an employer views your profile, contact details or CV, every appearance in search and suggestions, and every action an administrator takes with your data in the Platform's interface is recorded in a log that cannot be altered afterwards; you see them on the "Who viewed my profile" page. Direct technical access to the servers and databases is not recorded in this log. Only a limited number of the Operator's staff have such access, only to the extent needed for maintenance, security and incident response, and it is governed by the Operator's internal personal data protection rules.

6. Where data is stored

The Platform's databases, files and backups are hosted on servers in the Republic of Uzbekistan. A backup copy of the database is made every day and kept on the same server; only the Operator's staff who maintain the server have access to it. Uploaded files (CVs, photos, logos, screenshots) are not included in the backup.

7. Cross-border transfer

We do not transfer personal data outside the Republic of Uzbekistan, except when you turn on Telegram notifications yourself and give a separate consent to cross-border transfer. Telegram's servers are located outside Uzbekistan; only your chat ID and short generic notification texts are sent to Telegram — never the text of messages, vacancy titles or names. You can withdraw this consent at any time by disconnecting Telegram in your settings or sending /stop to the bot.

8. Retention

We keep data no longer than needed for the purposes of processing. The periods below are the Operator's proposal, to be approved by counsel; until then the Platform deletes nothing automatically and only counts what would be deleted. Backup copies of the database and web server logs are the exception: they are deleted automatically when their period below ends.

  • account, profile, CV, applications and messages — while the account exists; after a deletion request, a 30-day grace period, then deletion (section 9);
  • the record of a deleted account without personal data (a "tombstone") — 3 years after deletion, together with the withdrawn consents as proof that processing was lawful;
  • withdrawn consents of active accounts — 3 years after withdrawal;
  • sign-in log — 90 days; log of access to personal data and messages — 12 months; log of staff, consent, organization and account actions — 3 years;
  • search appearances — 12 months; read notifications — 12 months;
  • demo requests and support requests with their screenshots — 12 months after the last change;
  • accounts without a sign-in for 24 months — an email warning, then a deletion request 30 days later;
  • backup copies of the database — 14 days; after a restore, deletions made after the backup are applied again;
  • technical rate-limit records — no longer than one day;
  • web server logs (IP address, browser details, the requested address and the time) — no longer than 15 days;
  • Telegram data — until you disconnect Telegram or withdraw consent;
  • messages — to be published before registration opens.

When the period ends, data is deleted or anonymized.

9. Your rights

You have the right to:

  • know what data about you is processed, why, on what basis and to whom it was disclosed. The "Who viewed my profile" page shows which organizations opened your profile, contact details and CV, and found you in search, over the last 90 days; when that happened, you get a summary the next morning (numbers only, no staff names);
  • get your data: in your settings you can download an archive with all of your data once a day (after entering your password);
  • correct or complete inaccurate or incomplete data — most of it can be changed in your account;
  • withdraw consent at any time. Optional consents can be turned off in your settings. Withdrawal does not affect the lawfulness of processing before it. Withdrawing consent to personal data processing means deleting your account;
  • delete your account in your settings. Your applications are withdrawn and your profile is hidden from employers at once; for 30 days you can cancel the deletion (withdrawn applications and the hidden profile are not restored), after that your data is deleted;
  • object to a match assessment: in the messages of an application you may write to the employer first to dispute the assessment or add information about yourself;
  • request deletion (destruction) of data that is no longer needed for the purposes of processing or is processed unlawfully;
  • lodge a complaint with the authorized state body for personal data (to be published before registration opens) or a court.

For other questions about your data, email privacy@gradly.uz from the address registered in your account. Reply time: to be published before registration opens. If you sent a demo request or a support request without an account, write from the email address you gave in it.

10. How we protect data

  • encrypted connections (HTTPS) and a content security policy on every page;
  • passwords stored only as hashes; mandatory two-factor authentication and sessions of at most 12 hours for staff;
  • role-based access control and verification of employer organizations;
  • an antivirus check of uploaded files before anyone other than the person who uploaded them can open them: until the check has run, nobody else can open a file, and infected files are not kept;
  • a log of access to personal data that cannot be altered; IP addresses are masked in the staff console, and revealing one is logged;
  • pseudonymized technical identifiers in rate-limit records;
  • request rate limits and protection against bulk copying of data;
  • the demo and support forms are protected against automated submissions without a CAPTCHA (a hidden field, a minimum time to fill in, rate limits); screenshots are re-encoded without metadata;
  • error reports without personal data (no addresses, cookies or request contents);
  • daily backups of the database (section 6).

11. Automated decisions

The Platform does not make decisions that have legal effects for you based solely on automated processing. Matching vacancies, the match assessment, sorting applications by match, the employer's checklist, suggested candidates, the readiness score and the draft cover letter are explanations and recommendations computed by transparent rules. The Platform never rejects or hides applications automatically; the decision to hire or reject is made by a person — the employer's representative. The career readiness score is never shown to employers. If you disagree with an assessment, write to the employer in the application's messages (section 9).

12. Cookies

We use only strictly necessary cookies: to keep you signed in, to remember your language and the collapsed cabinet menu, the notice about a new version of this Policy that you closed, and the assistant tips you hid. Your colour theme is stored only in your browser. We do not use third-party advertising or analytics cookies.

13. Age

The Platform is intended for students and graduates, including persons under 18 (for example, first-year students). How the consent of a minor's legal representative is obtained is being clarified with counsel and will be described in the next version of this Policy.

14. Changes to this Policy

The version (a date) is shown at the top of the page. A new version is published on this page, and previous versions are kept. If a change affects the purposes of processing or the data we collect, we will ask for your consent again.

15. Contacts

  • Operator: to be published before registration opens
  • TIN (STIR): to be published before registration opens
  • Address: to be published before registration opens
  • Personal data questions: privacy@gradly.uz
  • Person responsible for organizing personal data processing: to be published before registration opens