1Who is responsible for your data
HSE HUB is a NeuraSafe brand, operated by NeuraSafe FZC LLC. NeuraSafe FZC LLC is the data controller: the company that decides how your personal data is used and is responsible for it. In this policy, “we”, “us” and “our” mean NeuraSafe FZC LLC. This policy covers the website hsehub.org (also reachable at resources.usmanjamilcsp.com) and the HSE HUB apps for iOS and Android.
NeuraSafe FZC LLC, a free zone company licensed in Ajman, United Arab Emirates.
Licence / registration no. 262336646888
Registered address: BC-889514, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
Privacy requests: support@neurasafe.io
In short: we collect only what HSE HUB needs to work. We have no ads, no analytics, no tracking and no third-party cookies. We do not sell your data. We do not store your CV.
2What we collect
Without an account
You can read toolbox talks, posters, the library and Question of the Day, use the calculators, and answer 10 practice questions a day without signing in. To count those 10 questions we keep a daily counter tied to a secret-keyed hash of your network address (never the address itself).
Your account
An account is needed for HSE HUB Pro and Career Preparation, and keeps your progress across devices. You choose how to sign in:
- Sign in with Apple. Apple tells us your name and email address. If you choose Hide My Email, we only ever see Apple’s private relay address.
- Sign in with Google. Google tells us your name, email address and profile picture link. We store your name and email address only.
- Emailed code. You enter your email address and we send you a 6-digit code.
We store your name, your email address and the account ids Apple or Google give us. We never receive a password. We do not get access to your Apple or Google account, contacts, files or mail. If you sign in with Apple and Google using the same verified email address, they are treated as one account.
Referral and discount codes. If you enter one, we store the code with your account and, when you subscribe, record the sale against the HSE HUB team member the code belongs to, so we can credit them. Team members are not given your details.
Tuition calls (Pro). You book them on WhatsApp, so we see your WhatsApp number and what you send there, and WhatsApp (Meta) handles that conversation under its own privacy policy. We record the date of each call, and an optional note, against your account to keep track of your monthly call. The call itself is not recorded.
Practice activity
The practice sets and exams you take: the questions, your answers, scores, results by domain and the questions you missed. This powers your progress page and study plan.
HSE HUB Pro
To know whether you are subscribed we keep: your plan, when the current period ends, whether it renews, where you bought it (website, App Store or Google Play), the transaction or customer reference from Stripe, Apple or Google, and the renewal and cancellation notices they send us. We also record whether you have used the returning-subscriber offer. We never see your card details. For App Store and Google Play purchases we pass Apple and Google an anonymous account token, not your name or email.
Career Preparation
If you use Career Preparation, you give us your CV (as text or a PDF), and optionally a job description, target role, company name and your answers in a practice interview. These are sent to Google’s Gemini API to produce your result. We do not store any of it. It is held in memory only while your result is produced, and is never written to our database or disk.
We keep only a usage record: the time, which feature was used, your account id, the amount of text processed and a secret-keyed hash of your network address. This enforces the daily limit and stops one person creating many accounts to get around it. It contains nothing you typed.
A CV often contains more personal data than an employer needs, such as a passport number, date of birth, photo or marital status. Please remove these before you upload. The revised CV and its PDF are made on your device and are not uploaded to us.
Correction reports
If you report a mistake in a question or resource, we keep your message, the page it relates to, any contact details you choose to add and a secret-keyed hash of your network address (to limit spam).
Telegram bots
If you use our Telegram bots, for example the ASP/CSP eligibility checker, Telegram gives the bot your Telegram user id and username so it can reply. Telegram’s own privacy policy also applies.
Server logs
Our web host keeps standard server logs (network address, browser type, pages requested and times) for security and fault-finding. They are deleted on the host’s normal log rotation.
3Why we use it, and our legal basis
- To provide HSE HUB and your subscription (sign-in, saving progress, daily limits, Pro access, Career Preparation, account and service emails). Basis: performing our contract with you.
- To keep HSE HUB secure and fair (preventing abuse of daily limits, rate-limiting reports, server logs). Basis: our legitimate interests in running a safe, reliable service. We keep this to the minimum, using hashed network addresses.
- To answer you when you contact us or send a correction report. Basis: legitimate interests.
- To send news and offers by email. Basis: your consent, which you can withdraw at any time.
- To keep payment and tax records. Basis: legal obligation.
We do not sell your personal data, we do not use it for advertising, and we do not make decisions about you by automated means that have legal or similar effects.
4Emails
Account and service emails
These are always sent, because they are part of the service: sign-in codes, receipts, subscription confirmations, renewal reminders, payment problems and cancellation confirmations.
News and offers
We send news emails (new features, new tools, events and offers) only if you opt in. You can opt in when the app asks, with the switch in Profile, or on the website. Every news email has an unsubscribe link, and unsubscribing takes effect immediately. You can also switch news off in Profile at any time. We record when you gave or withdrew consent and where (app prompt, Profile or website).
Who sends them
Emails come from noreply@hsehub.org. Sign-in codes come from noreply@freeresources.usmanjamilcsp.com. They are sent by our own web host. We do not use a mailing-list provider and do not give your address to one. We keep a log of the emails we send (address, type and time) for 12 months.
5Push notifications
The apps can show notifications for Question of the Day, new toolbox talks and posters, and announcements. Every notification goes to one broadcast topic that all installations share, so every user gets the same message.
Delivery uses Firebase Cloud Messaging (Google), and on iPhone and iPad Apple’s push service. Google issues and holds a device token for your installation. Our server never receives or stores a device token, so we cannot target, identify or track an individual device.
You control notifications with your device’s notification permission: on iPhone and iPad, Settings → Notifications → HSE HUB; on Android, Settings → Apps → HSE HUB → Notifications. Turning them off does not affect anything else. The apps include no analytics, advertising or tracking SDKs.
6Who we share data with
We share data only with the service providers below, who help us run HSE HUB, or where the law requires it.
| Provider | What they receive | Why | Where |
|---|---|---|---|
| Namecheap | Everything we store, server logs, and the emails we send | Web hosting and sending email | United States |
| Stripe | Your name, email address and billing address. Your payment details go straight to Stripe; we never see them | Website payments, receipts and tax calculation | United States and other Stripe locations |
| Apple | Sign-in, App Store purchases (with an anonymous account token) and push delivery to iPhone and iPad | Sign-in, in-app purchases, notifications | United States and other Apple locations |
| Sign-in, Google Play purchases (with an anonymous account token) and push delivery through Firebase Cloud Messaging | Sign-in, in-app purchases, notifications | United States and other Google locations | |
| Google (Gemini API) | Only if you use Career Preparation: your CV text or PDF, job description, role, company and interview answers. The company name may be looked up with Google Search | To analyse your CV and run practice interviews | Outside the UAE, on Google’s servers, including the United States |
| Telegram | Correction reports you submit, including any contact details you add | Forwarded to the owner’s Telegram for review | Telegram’s servers |
| cdnjs and unpkg | Your network address, when your browser loads a library from them | Public code libraries for PDFs and icons | Global networks |
On website pages that offer sign-in, Google’s sign-in script loads so that the “Sign in with Google” button can be shown. Like any web request, it lets Google see your network address and browser details, even if you do not use it. Google receives your account details only if you choose to sign in with Google. We do not tell Apple or Google anything about what you do in HSE HUB. We do not store your Career Preparation content, and we use Google’s paid API, under which Google does not use your content to improve its products. Google may keep it for a limited time to detect abuse, under its own terms.
We do not share your data with advertisers, data brokers or ad networks.
7International transfers
NeuraSafe FZC LLC is based in the UAE. Our servers are in the United States, and the providers above may process data in other countries. When your data leaves your country, we protect it by using established providers bound by contracts that require them to keep it secure and use it only to provide their service to us, and by sending them only the data they need.
8Cookies and storage on your device
We use only storage that HSE HUB needs to work. We have no advertising, analytics or tracking cookies and no third-party cookies, so there is no consent banner. On your device we keep:
- your sign-in session (up to 30 days);
- your theme (light or dark) and language for toolbox talks and posters;
- an exam in progress, so a reload does not lose your answers;
- whether you have seen the welcome screen;
- Career Preparation work in progress (
uj_career_work), so you do not lose it if the page reloads. It is deleted after 24 hours; - a cookie set only on browsers that our administrator marks for testing.
9How long we keep data
| Data | Kept for |
|---|---|
| Account (name, email, Apple or Google account ids) | Until you delete your account |
| Practice history | With your account, until you delete it |
| Sign-in sessions | Up to 30 days |
| Daily practice counter | 7 days (for guests, tied to a hashed network address) |
| Career Preparation content (CV, job description, answers) | Not stored |
| Career Preparation usage records | 12 months |
| Email send log | 12 months |
| Correction reports | 12 months |
| Subscription and payment records | As long as tax and accounting law requires after the subscription ends (in the UAE, 5 years) |
We store network (IP) addresses only as secret-keyed hashes (HMAC), never as plain addresses.
10Deleting your account
You can delete your account yourself, straight away:
- In the app: Profile → Delete my account.
- On the website: hsehub.org/delete.html. Sign in with Apple, Google or an emailed code.
Deleting removes your account, your sign-ins, your practice history, your Career Preparation usage records, your email preferences and email log entries, your offer records and your subscription records. A website subscription is cancelled and your Stripe customer record is deleted. App Store and Google Play subscriptions must be cancelled with Apple or Google, or they will keep renewing. Records we must keep for tax are kept in anonymised form where the law requires.
Deleting your HSE HUB account does not affect your Apple or Google account. If you cannot use the page, email support@neurasafe.io from the address on your account.
11Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you;
- correct it if it is wrong;
- have it deleted;
- receive it in a portable format;
- object to how we use it, or withdraw your consent (for example to news emails) at any time;
- complain to your local data protection authority, for example the Information Commissioner’s Office in the UK.
To use any of these rights, email support@neurasafe.io. We reply within 30 days. We may ask you to confirm your identity first, usually by writing from the email address on your account.
12Children
HSE HUB is for people aged 16 and over. We do not knowingly collect data from children under 16. If you think a child has given us data, contact us and we will delete it.
13Security
We use HTTPS everywhere, keep our database outside the public web folder, store network addresses only as secret-keyed hashes, never handle passwords or card numbers, and limit who can access the admin tools. No system is completely secure, but if a breach affects your data we will tell you and the relevant authorities where the law requires.
14Links to other sites
Resources may link to standards bodies and other websites. Their own privacy policies apply to them.
15Changes to this policy
We may update this policy. The effective date at the top shows the current version. If we make an important change, we will tell you in the app or by email.
16Contact
NeuraSafe FZC LLC
BC-889514, 26th Floor, Amber Gem Tower, Ajman, United Arab Emirates
Licence / registration no. 262336646888
Email: support@neurasafe.io
WhatsApp (optional): +971 56 669 8759