1. Who we are
Not Just Salary is a product operated by Orchestra Ventures LLC-FZ. In this policy, “Not Just Salary”, “NJS”, “we”, “us” and “our” mean the service operated by Orchestra Ventures LLC-FZ. We are responsible for deciding how the personal information described here is used.
Our registered address is:
Meydan Grandstand6th FloorMeydan RoadNad Al ShebaDubaiUnited Arab EmiratesLicence / registration number: 2529740.01. Issuing authority: Meydan Freezone. VAT TRN: 105082217800001.
2. Who this policy applies to
This policy applies to visitors, account holders and customers who use NJS. NJS is for people aged 18 or over. We ask users to confirm this when creating an account; we do not independently verify age or identity.
3. Information we collect
Depending on how you use NJS, we may collect:
- account and contact information, including your email address and authentication identifiers;
- answers about your current role, offers, priorities, household or personal context, working preferences and decision;
- offer facts entered manually or extracted from a document, including compensation, benefits, working arrangements and evidence snippets;
- Decision Reviews, scores where enough evidence exists, negotiation choices and saved service state;
- purchase, entitlement, consent, refund and limited transaction records;
- support, privacy or legal correspondence; and
- limited technical, security and operational information needed to run and protect the service.
We do not ask for special-category or otherwise sensitive personal information unless genuinely necessary. Please do not include unnecessary sensitive information in free text or uploads. The service does not technically prevent you from doing so.
4. How we collect information
We collect information directly from you when you answer questions, type offer details, upload a document, create an account, buy a product or contact us. We also receive account information from Google if you choose Google sign-in, payment and transaction information from Stripe, and service data from our infrastructure providers.
5. Why we use information and our legal bases
Where UK data protection law applies, we use personal information on the following bases:
| Purpose | Typical information | UK lawful basis |
|---|---|---|
| Provide accounts, comparisons, Decision Reviews, document extraction and purchased features | Account, answers, offer facts, uploaded document content, saved outputs | Necessary to take steps at your request and perform our contract with you |
| Process payment, activate access and handle refunds | Account, transaction, consent and entitlement records | Contract; legal obligation for required financial records |
| Protect the service, prevent abuse and resolve faults or disputes | Limited technical, security, usage and correspondence records | Our legitimate interests in operating a safe, reliable service and establishing or defending legal claims |
| Meet tax, accounting, consumer, regulatory or court requirements | Relevant transaction and account records | Legal obligation |
We do not use consent as a blanket basis for ordinary service processing. Where consent is specifically required, we will ask separately. Under UAE law, processing may also be permitted where necessary to perform a contract, establish or defend legal rights, comply with law, or in other circumstances provided by applicable law. The basis that applies depends on the purpose and jurisdiction.
6. Uploaded offer documents and AI-assisted extraction
Uploading is optional; you can enter offer information manually instead. If you choose upload, NJS normalises the PDF or text file server-side, gives it a generic filename and sends it to OpenAI so structured offer facts can be extracted. AI helps us read your offer. It does not make the decision for you.
NJS does not permanently store the raw uploaded file. The OpenAI file is created for user data, NJS attempts to delete it after extraction, and a one-hour expiry is configured as a fallback. The response request uses store: false. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. Its default abuse-monitoring logs may retain customer content for up to 30 days; NJS does not claim that its OpenAI organisation has Zero Data Retention. Extracted facts, confidence information and short supporting evidence may be saved in your NJS Decision Review.
Offer documents can include details about recruiters, hiring managers, signatories or other people. Avoid uploading unnecessary third-party information and, where practical, redact irrelevant personal phone numbers, signatures and contact details.
7. Decision Reviews, negotiation data and automated analysis
NJS uses the answers and offer facts you provide. Your selected priorities influence the personalised analysis. The core Decision Engine, negotiation email and Call Prep are currently generated using deterministic rules in the product, not by an AI model.
A fit score appears only where enough evidence exists; missing information may mean no score is shown. Scores and recommendations are decision-support outputs, not objective truths, legal decisions or decisions made about your employment. They do not produce legal or similarly significant effects by themselves. You make the final decision.
8. Accounts, authentication, payments and service email
Supabase provides authentication and stores account and Decision Review data. Resend delivers account and transactional service emails and processes the recipient address, message content and limited delivery metadata for that purpose. If you use Google sign-in, Google processes information needed to authenticate you under its own terms and privacy notice. Stripe hosts Checkout and processes payment details. NJS does not receive or store your full card number. Stripe may act as our processor for some activities and as an independent controller for functions such as fraud prevention, regulatory compliance and payment-network operations.
9. Cookies and browser storage
We use Supabase authentication cookies, local storage for temporary recovery snapshots and session storage for short-lived interface and comparison state. Google and Stripe may use their own cookies or storage when you choose their services. NJS currently has no external analytics SDK, advertising cookies or analytics destination. See our Cookie & Storage Notice.
10. Service providers and international transfers
We use service providers needed to operate NJS, principally Supabase for authentication and database services, Resend for account and transactional service email, OpenAI for optional document extraction, Stripe for hosted payment processing, Google when you choose Google sign-in, and application hosting providers for limited request and operational data. These providers use their own affiliates and subprocessors.
Information may be processed outside the UAE and, for UK users, outside the UK. Resend states that its primary processing operations take place in the United States. Where UK transfer rules apply, we rely on provider contractual safeguards made available for the service, which may include the UK International Data Transfer Addendum, standard contractual clauses or another lawful mechanism. Provider locations and subprocessors can change.
11. How long we keep information
| Information | Retention approach |
|---|---|
| Account | While your account exists, except for limited records we must or are entitled to retain |
| Decision Reviews and associated customer content | While the review and account exist |
| Browser recovery snapshots | Up to 30 days under the current cleanup system; stored on your device |
| Raw NJS upload | Not permanently stored by NJS |
| OpenAI temporary file | Deletion is attempted after extraction; a one-hour expiry is the fallback. Separate default abuse-monitoring logs may be held by OpenAI for up to 30 days |
| Generated negotiation email | Session-only unless you copy or save it elsewhere |
| Call Prep | Session-only except for a copy you download or print |
| Payment and consent records | As necessary for accounting, tax, refunds, fraud prevention, disputes and legal obligations |
Provider backups and logs may persist for limited periods under provider-controlled schedules before deletion cycles complete.
12. Security
We use measures designed to protect personal information, including access controls, server-side secret handling, row-level database controls, bounded document processing, limited logging and signed payment webhooks. No online service can promise absolute security. You are responsible for keeping access to your email account and devices secure.
13. Your rights and deletion controls
Depending on the law that applies and the circumstances, you may have rights to access, correct, erase or receive a copy of your information; restrict or object to processing; withdraw consent where processing relies on it; and complain to a regulator. These rights are not identical in every jurisdiction and may be subject to exemptions.
Your Privacy & Data area includes Delete Decision Review and Delete my account and data. Deleting an account or review removes the related customer content from the active service, but limited records may remain where required or justified for tax, accounting, fraud/security, disputes or legal obligations. Provider backup deletion may complete on its own cycle.
To make a privacy request, email admin@notjustsalary.com. We may need reasonable information to verify your request.
14. Changes, contact and complaints
We may update this policy as the product, providers or law changes. We will change the effective date and, where appropriate, give prominent notice or ask you to acknowledge a new version.
Questions and complaints can be sent to admin@notjustsalary.com. If UK data protection law applies, you may also complain to the UK Information Commissioner’s Office. UAE complaints may be made to the competent data protection authority once applicable procedures are available. We would appreciate the chance to address your concern first.