What Shortlist does with your CV

Who holds your information

Gear Box Integrated Solutions Co. Ltd, a company registered in Sudan under commercial registration 44619, trading as Shortlist.

Elberier Extension, Nasir Extension Street, property 321, block 2, first floor, Khartoum, Sudan.

When you apply for a job, the organization you applied to decides what happens to your application. We hold it for them and we run the platform. When you put your profile into the shared pool, that is your own decision, and the pool is ours.

We have not appointed a data protection officer. Your requests reach the address above, and a person on our team answers them.

What we collect

• Your account: your name and your email address, and your password, which we never store in a readable form.
• Your CV and anything you attach to it. We read the text out of it so that it can be searched and ranked, which is why we ask for a text PDF or a Word file rather than a photograph or a scan. Whatever you put in your CV, we hold.
• Your applications: which job you applied to, what you answered, and the messages between you and the organization through the platform.
• Technical information: when you signed in, the pages you used, and basic device information. We use Umami, analytics software running on our own servers, and we send this to nobody. We run no advertising, no third party tracking and no behavioural targeting.

We do not ask you for your religion, your ethnicity, your health, your political opinions or anything similar, and no organization may use Shortlist to ask you for them. If you put such information in your CV yourself, we hold it because it is in your CV.

Who sees it

The organization you applied to sees your application, your CV, and how the platform ranked you.

Other organizations see nothing, unless you switch on the shared pool yourself.

Our staff see your information when they run and support the platform. They are in Sudan.

Our suppliers see it only to do a specific job for us, and they may not use it for anything else.

• Hostinger hosts our servers and your data in the European Union. It also sends our email and receives the CVs people send us by email.
• Our AI model provider runs the model behind two features. One drafts a job advertisement and never sees a CV. The other checks a CV against a requirement, and an organization has to switch it on. It processes outside the European Union today.

We do not name the model provider here, because we may change it. Ask us and we will tell you who it is today. If we change it, we change this page.

No supplier may train a model on your information.

We do not sell your information to anyone. Not to an advertiser, not to a recruiter, not to anyone.

Where it is kept

Our servers are in the European Union. Our own staff read your information from Sudan, because that is where we work.

How long we keep it

An account you never confirmed

We remind you on three days running, send one final notice on the fourth day, and delete the account and the CV attached to it seven days after that notice. This deletion is built and is not switched on yet, so nothing is deleted automatically today. We will not switch it on without saying so here first.

Your profile and your CV, held by you

We keep them while your account exists. You can delete them yourself at any time, and that deletion is immediate.

The CV an organization received from your application

The organization may keep it for up to 24 months after that job closes, and its contract with us says so. It may choose a shorter period, and it may not choose a longer one. The organization deletes it. We do not delete it for them.

The organization's record of its decision

Longer, because a donor may audit how they hired. That period is theirs to set.

We are telling you what our machinery does, not what we would like it to do. Two of these are promises a person keeps rather than a program. Where you want something gone now, delete it yourself in your settings, or write to us.

If you delete your account, the organizations you applied to keep their own record that you applied to them. That record is theirs, not ours.

What you can ask us to do

Four of these you do yourself, in your account, without asking us and without waiting for us.

• Download everything we hold about you, as one file, from your settings. Your uploaded CV downloads separately, from your profile page.
• Correct your profile where it is wrong.
• Delete your account and your CV. It happens when you press the button, not when we get round to it.
• Leave the pool, with one switch in your settings, at any time, without giving a reason.

And these you ask us for.

• Ask for a listing to be taken down, without having an account.
• Object to how we use your information, or ask us to restrict it.
• Ask us anything the four above do not cover.

Write to privacy@shortlistsd.com. Asking is free, and we answer within 30 days. Where a request is about an application you sent to a particular organization, we pass it to that organization, because that record is theirs, and we tell you that we have done so.

If you are not satisfied

Write to us first at privacy@shortlistsd.com, and we answer within 30 days. If we cannot resolve it, you keep every right to complain that the law gives you, and we will name the authority here as soon as we can name it with certainty.

How the platform decides who is shortlisted

A person decides who gets hired. The platform does not.

We read your CV, score it against what the job asked for, and rank you. The scoring is explainable: an organization can see why you scored what you scored, and the evidence in your CV that produced it. There are no hidden weights.

An organization may also switch on a feature that uses an AI model to check whether your experience matches a requirement in a way a keyword search would miss. Those are signals for a person to review. They do not change your score or your rank.

Every organization has to review the result itself, and the platform rejects nobody on its own.

Every CV sent to a job is read and ranked, and none is dropped before a person sees it.

Whether you hear back is the organization's decision, not ours. When you apply through the public board, we confirm at once that your application arrived. The platform then gives the organization ready written rejection messages in Arabic and English that it can send to everyone at once. We give them the tool. We do not send it for them, and we will not promise you a reply that somebody else has to write.

You can see where you stand without waiting for a letter. Your applications page shows each application and the stage it has reached.

Changes to this notice

Where we change something that matters to you, we will say so on this page and, where we can, tell you directly. The date at the top is the date this version took effect.