Mulyra is a job aggregator and salary intelligence platform built by Aevora Labs LLC. We are committed to your privacy and to being transparent about the data we collect. You can browse job listings without creating an account. Some features (salary insights, AI matching, application tracking) require a free account.

Depending on how you use Mulyra, we may collect the following: Without an account: • Anonymous, aggregated usage analytics (pages visited, search terms, clicks) • General country/region derived from IP address (not stored) With a free account: • Email address (for authentication via Supabase) • Resume/background text (if you choose to add it) • Bookmarked jobs and application tracking data • Push notification tokens (if you opt in to alerts) Optional submissions: • Salary data you voluntarily submit through our "Contribute Your Salary" feature • Email address if you subscribe to our salary digest newsletter

When you create an account, your email address is stored securely by Supabase (supabase.com), our authentication provider. Your resume/background text, push notification preferences, and application tracking data are stored in our database hosted on Cloudflare D1. We use this data solely to provide you with personalized features such as AI resume matching, salary negotiation scripts, cover letter generation, and job alerts. We do not share your account data with employers or third parties.

If you subscribe to our weekly salary digest, we store your email address and preferred role interest. This data is used only to send you relevant salary updates. • You may unsubscribe at any time via the unsubscribe link in each email • We will never sell, rent, or share your email address with third parties • We comply with the CAN-SPAM Act and applicable anti-spam regulations

If you submit salary data through our "Contribute Your Salary" feature, the information (job title, company, salary, location, years of experience) is stored and aggregated with other submissions to improve our salary benchmarks. Your identity is never publicly visible. Submissions are associated with your user ID for deduplication only and are never displayed alongside your name or email.

We use PostHog (posthog.com) for product analytics. PostHog stores anonymous event data using your browser's localStorage. No advertising cookies are used. PostHog is SOC 2 certified and does not sell your data. You can review PostHog's privacy policy at: posthog.com/privacy

Mulyra uses Google's Gemini AI to generate resume match scores, negotiation scripts, and cover letters. When you use these features, relevant portions of your resume and the job description are sent to Google's Gemini API for processing. We do not store your data on Google's servers beyond the API request. Generated results are cached in our database to avoid repeated API calls and improve performance.

If you subscribe to Mulyra Pro, payment processing is handled by: • Stripe (stripe.com) for web subscriptions • RevenueCat (revenuecat.com) + Apple App Store / Google Play for mobile subscriptions We do not receive or store your full credit card number. Stripe and RevenueCat handle all card data and are PCI-DSS compliant. We only receive subscription status, last-4 digits, and the subscription identifier needed to grant you Pro access.

We send transactional emails (account confirmations, password resets, digest subscriptions, job alerts) via Resend (resend.com). Resend processes your email address solely to deliver messages on our behalf and does not use it for any other purpose. Resend is SOC 2 Type II certified.

Job listings on Mulyra are sourced from publicly available employer hiring portals. Salary information is extracted from job postings using AI and may be estimated. We are not affiliated with any employer listed on this platform. Always verify compensation details directly with the employer before accepting any offer. While we refresh our data regularly, listings may be outdated. A job appearing on Mulyra does not guarantee the position is currently open.

You may request deletion of your account and all associated data (resume text, application history, salary submissions, push tokens, digest subscriptions, and saved jobs) directly from your profile page or by contacting us at the email below. You may also download a copy of your personal data from the profile page using the "Download My Data" control. We will process deletion requests within 30 days. Aggregated, anonymized salary data may be retained for statistical purposes even after account deletion.

Analytics: Clear site data for mulyra.com / mulyra in your browser settings. Email digest: Click "Unsubscribe" in any digest email, or email us directly. Push notifications: Disable notifications for Mulyra in your device settings. Account deletion: Use the "Delete My Account" control on your profile page or email us at the address below.

If you are located in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) grants you the following rights: Right of Access (Article 15): Request a copy of your personal data. Use the "Download My Data" button on your profile page. Right to Rectification (Article 16): Correct inaccurate personal data. Edit your profile directly, or contact [email protected]. Right to Erasure (Article 17): Request deletion of your personal data. Use the "Delete My Account" button on your profile page. Right to Restriction (Article 18): Request that we limit processing of your data. Contact [email protected]. Right to Data Portability (Article 20): Receive your data in a machine-readable format (JSON). Use "Download My Data". Right to Object (Article 21): Object to processing based on legitimate interests or for direct marketing. Contact [email protected]. Right to Lodge a Complaint: You may file a complaint with your local data protection authority. For EU residents, find yours at edpb.europa.eu. French residents may contact the CNIL (Commission Nationale de l'Informatique et des Libertés) at cnil.fr. German residents may contact the BfDI (Bundesbeauftragte fur den Datenschutz und die Informationsfreiheit) at bfdi.bund.de. Our lawful basis for processing is consent (analytics, marketing emails) and contract performance (providing the Service you signed up for). We do not engage in automated decision-making that produces legal effects. International data transfers (Article 46): Aevora Labs LLC is based in the United States. When we transfer personal data from the EEA or UK to the US, we rely on the EU Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) as the lawful transfer mechanism under GDPR Article 46(2)(c). Our key sub-processors that process EEA/UK personal data also rely on SCCs or, where applicable, an EU adequacy decision or the UK International Data Transfer Agreement (IDTA). You may request a copy of our SCC documentation by contacting [email protected].

If you are located in the United Kingdom, your personal information is protected under the UK GDPR (retained EU GDPR, incorporated by the European Union (Withdrawal) Act 2018 and amended by the Data Protection Act 2018). Applicability: UK GDPR (retained EU GDPR, incorporated by the European Union (Withdrawal) Act 2018 and amended by the Data Protection Act 2018) applies to users in the United Kingdom. Supervisory Authority: The UK Information Commissioner's Office (ICO) is your supervisory authority. Website: ico.org.uk. You may lodge a complaint with the ICO if you believe your data protection rights have been violated. Lawful Basis for Processing: (a) Consent: analytics and marketing emails. (b) Contract performance: providing the Service you signed up for. (c) Legitimate interests: aggregating publicly available job and salary data to provide market insights. International Data Transfers: Aevora Labs LLC is based in the United States. For personal data transferred from the UK to the US, we rely on the UK International Data Transfer Agreement (IDTA) as the lawful transfer mechanism under UK GDPR Article 46. Where applicable, we also rely on the UK Extension to the EU Standard Contractual Clauses. Our key sub-processors maintain their own compliant transfer mechanisms. Data Protection Act 2018 Specifics: The DPA 2018 supplements UK GDPR with additional provisions for law enforcement processing (Part 3) and intelligence services processing (Part 4). Mulyra does not engage in processing covered by Parts 3 or 4. Part 2 provisions (general processing under UK GDPR) apply to our processing of your personal data. Salary Submission Consent (UK Users): When you submit salary data as a UK user, you consent to its collection, aggregation, and display in anonymised form on Mulyra under UK GDPR Article 6(1)(a) (consent). You may withdraw this consent at any time by deleting your submission from your account settings or by contacting [email protected]. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Employment Law Disclaimer: Mulyra is not an employer, recruiter, or employment agency. Job listings displayed on the Service are aggregated from third-party sources for informational purposes only. Salary data is crowd-sourced and does not constitute financial, career, or legal advice. Nothing on this Service creates an employment relationship or obligation under UK employment law.

Mulyra does not sell, rent, or trade your personal information to third parties for monetary or other valuable consideration. Under the California Consumer Privacy Act (CCPA/CPRA), you have the right to opt out of the "sale" of your personal information. Because we do not sell your data, there is nothing to opt out of. However, if you believe any of our data practices constitute a "sale" under CCPA, you may contact us at [email protected] to exercise your rights. Your CCPA rights include: • Right to know what personal data we collect and how it is used • Right to delete your personal data • Right to opt out of the sale of personal data • Right to non-discrimination for exercising your privacy rights

If you are located in Canada, your personal information is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. Aevora Labs LLC complies with PIPEDA's ten fair information principles, as described below. 1. Accountability Aevora Labs LLC is responsible for all personal information under its control. We have designated a privacy contact who is accountable for our compliance with these principles. You may reach our privacy contact at [email protected]. 2. Identifying Purposes We identify and document the purposes for which we collect personal information before or at the time of collection. The purposes for each category of data we collect are described in the "What We Collect" section of this policy. 3. Consent We obtain your meaningful consent before or at the time we collect your personal information, and we use or disclose it only for the purposes you have consented to. You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice, by adjusting your preferences in your account settings or by contacting us at [email protected]. Withdrawal of consent may limit your ability to use certain features of the Service. 4. Limiting Collection We collect only the personal information that is necessary for the purposes identified. We do not collect information indiscriminately. Our collection practices are described in the "What We Collect" section of this policy. 5. Limiting Use, Disclosure, and Retention We use and disclose your personal information only for the purposes for which it was collected, except with your consent or as required by law. We retain personal information only as long as necessary to fulfil those purposes. Retention windows are described in the "Data Retention & Deletion" section of this policy. 6. Accuracy We make reasonable efforts to ensure that the personal information we hold is accurate, complete, and up to date as required for the purposes for which it is used. You may request correction of inaccurate information through your account settings or by contacting us at [email protected]. 7. Safeguards We protect your personal information with security safeguards appropriate to the sensitivity of the information. These safeguards include encryption in transit (TLS) and at rest, role-based access controls, and regular security reviews. Our sub-processors — including Supabase, Cloudflare, Stripe, Resend, RevenueCat, PostHog, Sentry, and Google (Gemini AI) — maintain their own industry-standard security programmes. 8. Openness We make information about our policies and practices relating to the management of personal information readily available. This Privacy Policy describes our practices in full. If you have questions not addressed here, please contact us at [email protected]. 9. Individual Access Upon written request, we will inform you of the existence, use, and disclosure of your personal information and give you access to that information. You may submit an access request through your account's Privacy Dashboard ("Download My Data") or by emailing [email protected]. We will respond within 30 days of receiving a verifiable request. If we are unable to provide access to certain information, we will explain the reasons why. 10. Challenging Compliance You may direct any challenge concerning our compliance with PIPEDA to our privacy contact at [email protected]. We will investigate all complaints and respond in writing. If a complaint is not resolved to your satisfaction, you may escalate it to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca. Canada's Consumer Privacy Protection Act (Bill C-27 / CPPA) Canada's Consumer Privacy Protection Act (Bill C-27) is currently before Parliament. We monitor its progress and are prepared to comply with its requirements upon enactment. Our existing data rights infrastructure — including account-level access, correction, deletion, and portability controls — already satisfies the core individual rights proposed under the CPPA. Breach Notification (PIPEDA Breach of Security Safeguards Regulations) In the event of a breach of security safeguards involving your personal information that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as soon as reasonably practicable. Notification will describe the nature of the breach, the information involved, steps we have taken to reduce the risk of harm, and steps you can take to protect yourself. We maintain a record of every breach of security safeguards for a minimum of 24 months from the date we determine a breach has occurred, regardless of whether notification was required. Salary Submission Consent (Canadian Users) When you submit salary data as a Canadian user, you consent to its collection, aggregation, and display in anonymised form on Mulyra in accordance with PIPEDA Principle 3 (Consent). You may withdraw this consent at any time by deleting your submission from your account settings or by contacting [email protected].

If you are located in Singapore, your personal data is protected under the Personal Data Protection Act 2012 (PDPA), as amended in 2020. Aevora Labs LLC complies with the PDPA's data protection obligations when collecting, using, and disclosing personal data of individuals in Singapore. Data We Collect: The categories of personal data we collect are described in the "Information We Collect" section above. We collect and use this data for the purposes stated in this policy, which we consider appropriate for a reasonable person in the circumstances. Your Rights Under the PDPA: - Access: You may request a copy of the personal data we hold about you. - Correction: You may request correction of any inaccurate or incomplete personal data. - Withdrawal of Consent: You may withdraw your consent for us to collect, use, or disclose your personal data at any time by contacting [email protected]. Withdrawal may affect our ability to provide certain services to you. Data Transfers: Your personal data is stored on Cloudflare infrastructure in the United States. We ensure that recipients of your data outside Singapore provide a standard of protection comparable to the PDPA through contractual arrangements with our sub-processors. Data Breach Notification: In the event of a data breach that is likely to result in significant harm to you, we will notify the Personal Data Protection Commission (PDPC) within 3 calendar days of our assessment and notify affected individuals without undue delay. Salary Submission Consent (Singapore Users): When you submit salary data as a Singapore user, you consent to its collection, aggregation, and display in anonymised form on Mulyra. Anonymised salary data (stripped of all personal identifiers) is not considered personal data under the PDPA. You may withdraw consent for the collection of your identifiable submission data at any time by deleting your submission from your account settings or by contacting [email protected]. Contact: For questions about our PDPA compliance or to exercise your rights, contact our Data Protection Officer at [email protected].

If you are located in Israel, your personal information is protected under the Privacy Protection Law 5741-1981 (as amended) and the Privacy Protection Regulations (Data Security) 5777-2017. Aevora Labs LLC complies with these requirements when collecting, using, and disclosing personal data of individuals in Israel. Database Registration: We maintain records of our data processing activities as required under Israeli law. Our databases containing personal data are managed in accordance with the Privacy Protection Authority (PPA) guidelines. Your Rights: - Access: You may request to review the personal data we hold about you. - Correction: You may request correction of inaccurate personal data. - Deletion: You may request deletion of your personal data, subject to our legal retention obligations. - Objection: You may object to the use of your personal data for direct marketing purposes. Data Transfers: Your personal data is stored on Cloudflare infrastructure in the United States. Israel is recognised by the European Commission as providing an adequate level of data protection. For transfers from Israel to the US, we rely on contractual safeguards with our sub-processors that ensure a comparable level of protection. Data Security: We implement technical and organisational security measures as required by the Privacy Protection Regulations (Data Security) 5777-2017, including access controls, encryption in transit and at rest, and regular security assessments. Salary Submission Consent (Israel Users): When you submit salary data as an Israeli user, you consent to its collection, aggregation, and display in anonymised form on Mulyra. Anonymised salary data (stripped of all personal identifiers) is used for statistical purposes only. You may withdraw consent at any time by deleting your submission from your account settings or by contacting [email protected]. Contact: For questions about our compliance with Israeli privacy law or to exercise your rights, contact us at [email protected]. You may also file a complaint with the Privacy Protection Authority (PPA) of Israel.

If you are located in India, your personal data is protected under the Digital Personal Data Protection Act 2023 (DPDP Act). Aevora Labs LLC acts as a Data Fiduciary under the DPDP Act when collecting, using, and disclosing personal data of Indian users. Consent and Purpose: We collect your personal data only for the purposes described in this Privacy Policy (salary benchmarking and job search transparency). We will not use your data for any purpose beyond what you have consented to. You may withdraw consent at any time by deleting your account or contacting us at [email protected]. Your Rights Under the DPDP Act: - Access: You may request a summary of the personal data we hold about you (Section 12). - Correction and Completion: You may request correction of inaccurate or incomplete personal data (Section 13). - Erasure: You may request deletion of your personal data, subject to our legal retention obligations (Section 13). - Grievance Redressal: You may file a grievance with our designated Grievance Officer (Section 8(10)) at the contact below. We will respond within a reasonable time. Grievance Officer (India): In accordance with Section 8(10) of the DPDP Act, our Grievance Officer for Indian users may be reached at: [email protected]. We aim to acknowledge grievances within 72 hours and resolve them within 30 days. Cross-Border Data Transfers: Your personal data is stored on Cloudflare infrastructure in the United States. Transfers are made under Section 17 of the DPDP Act. We will update this section if India restricts transfers to specific countries. We implement contractual safeguards with our sub-processors to protect transferred data. Data Security: We implement reasonable security safeguards as required by Section 8(5) of the DPDP Act, including access controls, encryption in transit and at rest, and regular security assessments. Salary Submission Consent (India Users): When you submit salary data as an Indian user, you consent to its collection, aggregation, and display in anonymised form on Mulyra under the DPDP Act 2023. Anonymised salary data (stripped of all personal identifiers) is used for statistical purposes only. You may withdraw consent at any time by deleting your submission from your account settings or by contacting [email protected]. Data Protection Board: You may file a complaint with the Data Protection Board of India if you believe your rights under the DPDP Act have been violated.

If you are located in Australia, the collection and use of your information is also governed by the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Collection and purpose (APP 1, 3, 5): We collect salary and job market data to provide compensation benchmarking and job search services. We notify you of collection at the point of data submission. Use and disclosure (APP 6): Salary data submitted by Australian users is aggregated and used only for market benchmarking and transparency reporting. It is not sold to third parties or used for direct marketing. Data security (APP 11): We implement reasonable technical and organisational safeguards, including encryption in transit (TLS) and encryption at rest. Access and correction (APP 12, 13): Australian users may request access to, or correction of, personal information held about them by contacting [email protected]. Notifiable Data Breaches (NDB scheme): In the event of a data breach likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with the NDB scheme. Privacy officer contact: [email protected]

If you are located in the United Arab Emirates, your personal data is protected under the UAE Personal Data Protection Law (PDPL), Federal Decree-Law No. 45 of 2021. Aevora Labs LLC processes personal data of UAE users in accordance with the PDPL's requirements. Lawful Bases for Processing (PDPL Article 5): We process your personal data on the following bases: - Consent: when you create an account, submit salary data, or opt in to communications. - Legitimate interest: to provide salary benchmarking and job search services in the public interest. Data We Collect: The categories of personal data we collect are described in the "Information We Collect" section above. We do not collect UAE national identity information (Emirates ID numbers). Your Rights Under the PDPL (Articles 6, 7, 9): - Access: You may request a copy of the personal data we hold about you. - Correction: You may request correction of inaccurate or incomplete personal data. - Deletion: You may request erasure of your personal data where processing is no longer necessary or where you withdraw consent, subject to legal retention requirements. - Objection: You may object to processing of your personal data in certain circumstances. Cross-Border Data Transfers (PDPL Article 22): Your personal data is stored on Cloudflare infrastructure. Cloudflare operates in countries that have been assessed as providing adequate data protection. We ensure our sub-processors meet the PDPL's transfer requirements through contractual safeguards. Salary Submission Consent (UAE Users): When you submit salary data as a UAE user, you consent to its collection, aggregation, and display in anonymised form on Mulyra. The UAE PDPL does not require separate explicit consent for each salary submission where you have already consented to the overall service; however, you may withdraw consent at any time by contacting [email protected]. Data Retention (PDPL Article 13): We retain personal data for no longer than necessary for the purposes outlined in this policy, or as required by applicable UAE law. Account data is retained while your account is active and for up to 2 years after deletion to satisfy legal obligations. Contact: To exercise your PDPL rights or raise a data protection concern, contact us at [email protected]. You may also contact the UAE Data Office (uaedataoffice.ae) if you believe your rights have been violated.

If you are located in Brazil, your personal data is protected under the Lei Geral de Protecao de Dados Pessoais (LGPD), Federal Law No. 13,709/2018, as amended. Aevora Labs LLC acts as the Data Controller (Controlador) for personal data of Brazilian users and processes it in accordance with the LGPD's requirements. Legal Bases for Processing (LGPD Article 7): We process your personal data on the following bases: - Consent (Art. 7, I): when you create an account, submit salary data via the "Contribute Your Salary" feature, or opt in to communications. For salary data, we obtain your explicit consent at the point of submission via an LGPD consent checkbox. - Contract performance (Art. 7, V): to provide the job search and salary benchmarking services you have requested. - Legitimate interest (Art. 7, IX): to aggregate publicly available salary and job market data for the purpose of providing compensation transparency services, which is proportionate and does not override your fundamental rights. Your Rights Under the LGPD (Article 18): - Confirmation of processing (Art. 18, I): you may request confirmation that we process your data. - Access (Art. 18, II): you may request access to the personal data we hold about you. Use the "Download My Data" function on your profile page or contact us at [email protected]. - Correction (Art. 18, III): you may request correction of inaccurate, incomplete, or outdated personal data. Edit your profile directly or contact us. - Anonymisation, blocking, or deletion (Art. 18, IV): you may request that unnecessary, excessive, or non-compliant data be anonymised, blocked, or deleted. - Portability (Art. 18, V): you may request transfer of your personal data to another service or product provider in a common machine-readable format. Use "Download My Data" or contact us. - Deletion of consented data (Art. 18, VI): you may request deletion of personal data processed on the basis of your consent, except where retention is required by law. - Information about sharing (Art. 18, VII): you may request information about third parties with whom we share your data. Our sub-processors are listed in the "Analytics", "AI-Generated Content", "Payments & Subscriptions", and "Transactional Email" sections of this policy. - Information about refusal of consent (Art. 18, VIII): you may request information about the consequences of refusing to provide consent. - Withdrawal of consent (Art. 18, IX): you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. To withdraw consent, delete your account from your profile page or contact [email protected]. - Complaint to the ANPD (Art. 18, X and Art. 55-J): you may lodge a complaint with the Autoridade Nacional de Protecao de Dados (ANPD) at gov.br/anpd. Salary Submission Consent (Brazilian Users): When you submit salary data as a Brazilian user, we obtain your explicit consent under LGPD Art. 7, I via a dedicated checkbox at the point of submission. The consent text reads: "I consent to the collection and anonymised aggregation of my salary data in accordance with Brazil's LGPD (Federal Law 13,709/2018)." You may withdraw this consent at any time by deleting your submission from your account settings or by contacting [email protected]. Data Protection Officer (Encarregado): In accordance with LGPD Article 41, our Data Protection Officer (Encarregado) may be reached at [email protected]. We will acknowledge data rights requests within 15 days and respond within 30 days. Cross-Border Data Transfers (LGPD Article 33): Your personal data is stored on Cloudflare infrastructure in the United States. Transfers from Brazil to the US are made pursuant to LGPD Art. 33, II (contractual clauses providing adequate protection) and Art. 33, V (legitimate interest and consent). We maintain data processing agreements with our sub-processors that ensure a level of protection equivalent to the LGPD. Data Security (LGPD Article 46): We implement technical and administrative security measures, including encryption in transit (TLS) and at rest, role-based access controls, and regular security reviews. In the event of a security incident that may cause harm to Brazilian data subjects, we will notify the ANPD and affected individuals as required by LGPD Art. 48. Employment Disclaimer (Brazilian Users): Mulyra is not an employer, recruiter, or employment agency under Brazilian law (Consolidacao das Leis do Trabalho, CLT, and Lei n. 6,019/1974). Job listings on Mulyra are sourced from third-party employer career pages and do not constitute an offer of employment or create any employment relationship between Mulyra, Aevora Labs LLC, and any user.

If you are located in South Africa, your personal information is protected under the Protection of Personal Information Act 4 of 2013 (POPIA), as administered by the Information Regulator (South Africa). Aevora Labs LLC acts as the Responsible Party for personal information of South African data subjects and processes it in accordance with POPIA's eight Conditions for Lawful Processing. Conditions for Lawful Processing (POPIA Chapter 3): - Accountability (s 8): Aevora Labs LLC is responsible for ensuring compliance with POPIA in respect of all personal information in our possession or under our control. - Processing limitation (s 9-12): We collect personal information only for the purposes described in this policy and only to the extent necessary for those purposes. - Purpose specification (s 13-14): Personal information is collected for specific, explicitly defined, and lawful purposes. We will not retain your information longer than necessary. - Further processing limitation (s 15): We will not process your personal information in a manner that is incompatible with the purposes for which it was collected. - Information quality (s 16): We take reasonable steps to ensure that personal information we hold is complete, accurate, and up to date. - Openness (s 17-18): We maintain this Privacy Policy to ensure transparency about how we collect, use, and store your personal information. - Security safeguards (s 19-22): We implement appropriate technical and organisational measures to secure personal information against loss, damage, or unauthorised access. - Data subject participation (s 23-25): You may request access to, correction of, or deletion of your personal information as described below. Your Rights Under POPIA (Section 23): - Access (s 23(1)(a)): you may request a record or description of the personal information we hold about you. Use "Download My Data" on your profile page or contact us. - Correction or deletion (s 24): you may request correction, destruction, or deletion of inaccurate personal information. We will respond within 30 days. - Objection to processing (s 11(3)): you may object, on reasonable grounds, to processing of your personal information for purposes of direct marketing. - Complaint to the Information Regulator (s 74): you may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za if you believe POPIA has been violated. Salary Submission Consent (South African Users): When you submit salary data as a South African user, we obtain your explicit consent under POPIA s 11(1)(a) via a dedicated checkbox at the point of submission. The consent text reads: "I consent to the collection and anonymised aggregation of my salary data in accordance with South Africa's Protection of Personal Information Act 4 of 2013 (POPIA)." You may withdraw this consent at any time by deleting your submission from your account settings or by contacting [email protected]. Information Officer: In accordance with POPIA s 1 and s 17, our Information Officer may be reached at [email protected]. We will acknowledge data access requests within 30 days and respond within the period prescribed by POPIA. Cross-Border Transfers (POPIA Section 72): Your personal information is stored on Cloudflare infrastructure in the United States. Transfers from South Africa to the US are made in accordance with POPIA s 72, which requires that the recipient country has substantially similar laws protecting personal information, or the data subject consents. We ensure that contractual safeguards with our sub-processors provide a level of protection substantially similar to POPIA. Security Safeguards (POPIA Section 19): We implement appropriate, reasonable technical and organisational measures to prevent loss of, damage to, or unauthorised destruction or access to personal information. These measures include encryption in transit (TLS) and at rest, role-based access controls, and regular security assessments. In the event of a security compromise, we will notify the Information Regulator and affected data subjects as required by POPIA s 22. Employment Disclaimer (South African Users): Mulyra is not an employer, recruiter, or employment agency under South African law (Labour Relations Act 66 of 1995, Basic Conditions of Employment Act 75 of 1997, or the Employment Services Act 4 of 2014). Job listings on Mulyra are sourced from third-party employer career pages and do not constitute an offer of employment or create any employment relationship between Mulyra, Aevora Labs LLC, and any user.

If you are located in Japan, your personal data is protected under Japan's Act on the Protection of Personal Information (APPI), most recently amended in 2022 (Reiwa 4). The supervisory authority is the Personal Information Protection Commission (PPC). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (APPI Article 20-2). Anonymous, aggregated job market data is processed under legitimate interest as it does not constitute "personal information" under APPI Article 2. Your Rights Under APPI: - Disclosure of retained personal data (APPI Article 33) - Correction, addition, or deletion of retained personal data (APPI Article 34) - Suspension of use or erasure of retained personal data (APPI Article 35) - Opt-out of third-party provision (APPI Article 37) To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. Cross-Border Transfers (APPI Article 24): Your data may be transferred to the United States, where Aevora Labs LLC operates. We ensure such transfers are conducted with appropriate safeguards as required by APPI Article 24, including contractual protections with our sub-processors. Consent at Submission: When you submit salary data from a Japan-based location, you will be shown a dedicated consent checkbox referencing APPI. Salary submissions will not be accepted without your affirmative consent.

If you are located in South Korea, your personal data is protected under South Korea's Personal Information Protection Act (K-PIPA)(Act No. 10142, as amended). The supervisory authority is the Personal Information Protection Commission (PIPC). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (K-PIPA Article 15(1)(1)). Anonymous, aggregated job market data is processed under legitimate interest as it does not constitute personal information under K-PIPA Article 2. Your Rights Under K-PIPA: - Right to access your personal information (K-PIPA Article 35) - Right to rectification and erasure (K-PIPA Article 36) - Right to suspend processing of your personal information (K-PIPA Article 37) - Right to withdraw consent at any time (K-PIPA Article 37(2)) To exercise any of these rights, contact us at [email protected]. We will respond within 10 business days. Cross-Border Transfers (K-PIPA Article 17): Your data may be transferred to the United States. We ensure such transfers are conducted in compliance with K-PIPA Article 17, including notification to data subjects about the destination country and purposes of transfer. Contractual protections are in place with all sub-processors receiving Korean personal data. Consent at Submission: When you submit salary data from a South Korea-based location, you will be shown a dedicated consent checkbox referencing K-PIPA. Salary submissions will not be accepted without your affirmative consent.

If you are located in Colombia, Argentina, or Chile, your personal data is protected under the applicable national data protection frameworks: - Colombia: Ley 1581 de 2012 (Ley de Proteccion de Datos Personales) and Decreto 1377 de 2013. The Superintendencia de Industria y Comercio (SIC) is the supervisory authority. - Argentina: Ley de Proteccion de Datos Personales (Law 25.326, PDPA) and its regulatory decree (Decreto 1558/2001). The Agencia de Acceso a la Informacion Publica (AAIP) is the supervisory authority. - Chile: Ley 19.628 sobre Proteccion de la Vida Privada (Protection of Private Life Act). Chile is currently modernizing its framework with the pending Data Protection Bill. Under these frameworks you have the right to access, rectify, update, and delete your personal data. We process your data on the basis of consent (for salary submissions) and legitimate interest (for publicly available job market data aggregation). To exercise any of these rights, contact [email protected]. We will respond within the timeframes prescribed by applicable law (typically 10-15 business days).

If you are located in Portugal, Finland, or Austria, your personal data is protected under the General Data Protection Regulation (EU) 2016/679 (GDPR). Your national supervisory authority is: - Portugal: Comissao Nacional de Protecao de Dados (CNPD) - Finland: Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) - Austria: Austrian Data Protection Authority (Datenschutzbehorde, DSB) Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (GDPR Article 6(1)(a)). Anonymous, aggregated job market data is processed under legitimate interest (GDPR Article 6(1)(f)) as it does not constitute personal data once identifiers are removed. Your Rights Under the GDPR: You have the right to access, rectify, erase, restrict, or port your personal data, and to withdraw consent at any time (GDPR Articles 15-21). You may also lodge a complaint with your national supervisory authority listed above. Consent at Submission: When you submit salary data from Portugal, Finland, or Austria, you will be shown a GDPR consent checkbox. Submissions will not be accepted without your affirmative consent. To exercise any of these rights, contact us at [email protected].

If you are located in Poland, your personal data is protected under the GDPR and the Polish Act on Personal Data Protection (Ustawa o ochronie danych osobowych, UODO)of 10 May 2018. The supervisory authority is the Personal Data Protection Office (Urzad Ochrony Danych Osobowych, UODO). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (GDPR Article 6(1)(a) and UODO Article 4). Anonymous, aggregated job market data is processed under legitimate interest. Your Rights Under GDPR and UODO: - Right of access (GDPR Article 15) - Right to rectification (GDPR Article 16) - Right to erasure (GDPR Article 17) - Right to restrict processing (GDPR Article 18) - Right to data portability (GDPR Article 20) - Right to object (GDPR Article 21) - Right to lodge a complaint with the UODO Consent at Submission: When you submit salary data from Poland, you will be shown a dedicated consent checkbox referencing the GDPR and UODO. Submissions will not be accepted without your affirmative consent. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are located in Ukraine, your personal data is protected under Ukraine's Law on Personal Data Protection (Law No. 2297-VI of 1 June 2010, as amended). The supervisory authority is the Commissioner for Human Rights of the Verkhovna Rada of Ukraine(Ombudsperson). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (Article 6 of the Law). Anonymous, aggregated job market data is processed as statistical information that does not constitute personal data once identifiers are removed. Your Rights: - Right to know about the composition and content of your personal data - Right to access your personal data - Right to rectification of inaccurate data - Right to object to processing - Right to erasure of personal data Consent at Submission: When you submit salary data from Ukraine, you will be shown a dedicated consent checkbox. Submissions will not be accepted without your affirmative consent. To exercise any of these rights, contact us at [email protected].

If you are located in Switzerland, your personal data is protected under the revised Swiss Federal Act on Data Protection (nDSG / revDSG), which entered into force on 1 September 2023. The supervisory authority is the Federal Data Protection and Information Commissioner (FDPIC). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (nDSG Article 6(6)). The nDSG is substantially equivalent to the GDPR in its privacy protections. Anonymous, aggregated salary data is processed under legitimate interest as it no longer constitutes personal data. Your Rights Under the nDSG: - Right of access to your personal data (nDSG Article 25) - Right to rectification of inaccurate data (nDSG Article 32) - Right to erasure or restriction of processing (nDSG Article 32) - Right to data portability (nDSG Article 28) - Right to lodge a complaint with the FDPIC Cross-Border Transfers: Your data is stored on Cloudflare infrastructure in the United States. Switzerland has not issued an adequacy decision for the US; we rely on contractual safeguards with our sub-processors to ensure an equivalent level of protection as required by nDSG Article 16. Consent at Submission: When you submit salary data from Switzerland, you will be shown a dedicated consent checkbox referencing the nDSG. Submissions will not be accepted without your affirmative consent. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are located in Belgium, Czech Republic, Norway, Romania, or Hungary, your personal data is protected under the General Data Protection Regulation (EU) 2016/679 (GDPR)(Norway via the EEA Agreement). Your national supervisory authority is: - Belgium: Autoriteit Persoonsgegevens / Autorite de protection des donnees (APD/GBA) - Czech Republic: Office for Personal Data Protection (Urad pro ochranu osobnich udaju, UOOU) - Norway: Norwegian Data Protection Authority (Datatilsynet) - Romania: National Supervisory Authority for Personal Data Processing (ANSPDCP) - Hungary: National Authority for Data Protection and Freedom of Information (NAIH) Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (GDPR Article 6(1)(a)). Anonymous, aggregated job market data is processed under legitimate interest (GDPR Article 6(1)(f)). Your Rights Under the GDPR: You have the right to access, rectify, erase, restrict, or port your personal data, and to withdraw consent at any time (GDPR Articles 15-21). You may also lodge a complaint with your national supervisory authority listed above. Consent at Submission: When you submit salary data from any of these countries, you will be shown a GDPR consent checkbox. Submissions will not be accepted without your affirmative consent. To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

If you are located in Turkey, your personal data is protected under the Personal Data Protection Law No. 6698 (KVKK)(Kisisel Verilerin Korunmasi Kanunu). The supervisory authority is the Personal Data Protection Authority (Kisisel Verileri Koruma Kurumu, KVKK). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent (KVKK Article 5(1)). Anonymous, aggregated job market data is processed under legitimate interest as it no longer constitutes personal data once identifiers are removed. Your Rights Under KVKK (Article 11): - Right to learn whether personal data has been processed - Right to request information about processing - Right to learn the purpose and whether data is used for that purpose - Right to know about third parties to whom data is transferred - Right to request rectification of incomplete or inaccurate data - Right to request deletion or destruction of personal data - Right to object to automated processing that results in a decision about you - Right to claim compensation for damages due to unlawful processing Cross-Border Transfers: Your data may be transferred to the United States. We ensure adequate safeguards are in place as required by KVKK Article 9, including contractual protections with our sub-processors. To exercise any of these rights, contact us at [email protected].

If you are located in Nigeria or Kenya, your personal data is protected under the applicable national data protection frameworks: - Nigeria: Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation 2019 (NDPR). The supervisory authority is the Nigeria Data Protection Commission (NDPC). - Kenya: Data Protection Act 2019 (DPA). The supervisory authority is the Office of the Data Protection Commissioner (ODPC). Legal Basis for Processing: Mulyra processes salary submission data on the basis of consent. Anonymous, aggregated job market data is processed under legitimate interest as it does not constitute personal data once identifiers are removed. Your Rights: Under both frameworks you have the right to access, rectify, erase, and port your personal data, to object to processing, and to withdraw consent at any time. Cross-Border Transfers: Your data is stored on Cloudflare infrastructure in the United States. We ensure contractual safeguards are in place with our sub-processors as required by NDPA Section 43 and Kenya DPA Section 48. To exercise any of these rights or lodge a complaint, contact us at [email protected]. We will respond within the timeframes prescribed by applicable law.

If you are located in Saudi Arabia, Qatar, Kuwait, or Bahrain, your personal data is protected under the applicable data protection regulations: - Saudi Arabia: Personal Data Protection Law (PDPL - Royal Decree No. M/19, 2021 as amended). The supervisory authority is the Saudi Data & AI Authority (SDAIA). - Qatar: Personal Data Privacy Protection Law (Law No. 13 of 2016). The supervisory authority is the Ministry of Communications and Information Technology (MCIT). - Bahrain: Personal Data Protection Law (Law No. 30 of 2018). The supervisory authority is the Bahrain Personal Data Protection Authority (PDPA). - Kuwait: Handled in accordance with the Electronic Transactions Law (Law No. 20 of 2014) and general privacy principles. Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent. Anonymous, aggregated job market data is processed under legitimate interest as it does not constitute personal data. Your Rights: Under these regulations, you have the right to access, rectify, destroy, or withdraw consent for your personal data, subject to local exceptions. Cross-Border Transfers: Your data is stored on Cloudflare infrastructure in the United States. We ensure contractual safeguards are in place with our sub-processors as required by local cross-border transfer requirements. To exercise any of these rights, contact us at [email protected].

If you are located in Thailand, Vietnam, Philippines, Indonesia, or Malaysia, your personal data is protected under the applicable national data protection acts: - Thailand: Personal Data Protection Act B.E. 2562 (PDPA). The supervisory authority is the Office of the Personal Data Protection Committee (PDPC). - Vietnam: Personal Data Protection Decree (PDPD - Decree 13/2023/ND-CP). The supervisory authority is the Ministry of Public Security (MPS). - Philippines: Data Privacy Act of 2012 (R.A. 10173). The supervisory authority is the National Privacy Commission (NPC). - Indonesia: Personal Data Protection Act 2022 (PDP Law). The supervisory authority is the designated data protection authority under the Indonesian government. - Malaysia: Personal Data Protection Act 2010 (PDPA). The supervisory authority is the Personal Data Protection Department (PDPD). Legal Basis for Processing: Mulyra processes salary submission data on the basis of your explicit consent. Anonymous, aggregated job market data is processed under legitimate interest. Your Rights: Under these frameworks, you have the right to access, rectify, delete, block, or withdraw consent for your personal data, and to lodge a complaint with your respective supervisory authority. Cross-Border Transfers: Your data is stored in the United States on Cloudflare infrastructure. We implement standard contractual safeguards with our sub-processors to protect your cross-border data transfers. To exercise any of these rights, contact us at [email protected].

Mulyra is intended for users who are 13 years of age or older (or 16 in the EEA/UK where required by applicable national law under GDPR Article 8). We do not knowingly collect personal information from children under 13. If we discover that a user under 13 has provided us with personal information, we will delete that information within 30 days and terminate the associated account. If you are a parent or guardian and believe your child under 13 has created a Mulyra account or submitted personal data, please contact us immediately at [email protected] and we will take prompt action.

We may update this Privacy Policy from time to time. Changes will be reflected by updating the "Last Updated" date at the top of this page. Material changes will be communicated via the app or email if you have an account.

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at: Privacy & data matters: [email protected] Product support: [email protected]