Terms, Privacy & Data Protection

Part A — Terms of Service

1. The Agreement

These Terms, together with any Order Form, quotation, or Service Schedule between the parties (the "Agreement"), govern your access to and use of the CreaVilla Horizon platform and all related software, reports, dashboards and deliverables (the "Service").

By signing an Order Form, clicking to accept, paying an invoice, or submitting any CVs, résumés or candidate files ("Candidate Data") for processing, you agree to be bound by the Agreement, and you confirm you are authorised to bind your organisation. Where an Order Form conflicts with these Terms, the Order Form prevails for the matter it addresses. The Agreement is the entire agreement between the parties and supersedes prior discussions.

2. Definitions

"AI Output" means any score, rank, shortlist, narrative, flag, verification signal, classification, recommendation or report generated by the Service using AI and rule-based models. "Verification Signals" means the Service's indicative outputs concerning possible AI-generated content, timeline gaps, skill–evidence mismatches, title inflation, or internal inconsistencies in a CV. "Candidate" means an individual whose data is submitted; "Candidate Data" means personal data relating to a Candidate. "Controller" and "Processor" have their meanings under applicable data-protection law: the Client is the Controller of Candidate Data and CreaVilla Horizon acts as Processor. "Applicable Law" means all laws that apply to a party, including data-protection, anti-discrimination, labour and employment law in the jurisdictions where the Client recruits or operates.

3. Nature of AI Outputs — Decision-Support Only

3.1 Decision-support, not decision-making

The Service is a decision-support tool. All AI Output is advisory and indicative only. It is not a factual finding, a determination of a Candidate's suitability, honesty or character, or a hiring or rejection decision. The Client alone makes all recruitment and employment decisions.

3.2 Probabilistic outputs

The Service relies on large language models and statistical methods that are inherently probabilistic. AI Output may contain errors, omissions, mis-classifications or "hallucinations", and may be incomplete or out of date. We do not warrant that any AI Output is accurate, complete, reliable or fit for a particular purpose.

3.3 Verification Signals are indicative

Verification Signals are probabilistic indicators from automated analysis. They are not allegations of fraud, dishonesty or misconduct and do not establish that any statement by a Candidate is false. A Verification Signal is a prompt for your own further enquiry and human judgement — nothing more.

3.4 Mandatory human review

You must ensure a qualified human reviewer independently assesses each Candidate before any decision that produces a legal or similarly significant effect on that Candidate (including selection, rejection or non-progression). You must not use AI Output as the sole or automatic basis for any such decision.

3.5 No guaranteed outcomes

We make no representation that use of the Service will produce any particular hire, quality of hire, time-to-hire, cost saving or other commercial outcome.

4. Client Responsibilities & Acceptable Use

4.1 Lawful basis and notice

You warrant that, for all Candidate Data you submit, you have a valid lawful basis to collect and share it and to have it processed by us, and that you have given Candidates all notices and obtained all consents required by Applicable Law — including notice that automated tools may be used to assist screening.

4.2 Non-discrimination

You are solely responsible for ensuring your use of the Service and any resulting decisions comply with all anti-discrimination, equal-opportunity, labour and employment laws applicable to you. You must not use the Service to discriminate unlawfully on the basis of any protected characteristic.

4.3 Human-in-the-loop

You will maintain meaningful human oversight of the Service as required by Section 3.4 and Applicable Law, including any rights relating to automated decision-making.

4.4 Prohibited uses

You must not, and must not permit any third party to:

• submit Candidate Data you are not lawfully entitled to submit, or sensitive/special-category data not necessary for screening;
• use AI Output as the sole basis for any adverse decision affecting a Candidate, or to make automated decisions prohibited by Applicable Law;
• represent any Verification Signal to a Candidate or third party as a proven finding of fraud or dishonesty;
• reverse-engineer, scrape, resell, sub-license, or build a competing product from the Service or its outputs;
• use the Service unlawfully or in any way that could expose us to liability or regulatory action.

4.5 Accuracy of inputs

AI Output depends on the quality and authenticity of the Candidate Data you submit. You are responsible for the lawfulness and integrity of your inputs.

5. Data Protection & Privacy

5.1 Roles

As between the parties, you are the Controller and CreaVilla Horizon is the Processor of Candidate Data. We process Candidate Data only to provide the Service and on your documented instructions, as set out in the Agreement and any Data Processing Addendum ("DPA").

5.2 Applicable regimes

Each party will comply with the data-protection laws applicable to it. Depending on where you and your Candidates are located, these may include the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), the Saudi Personal Data Protection Law (overseen by SDAIA), applicable Pakistani data-protection law, and, where EU/UK personal data is involved, the GDPR / UK GDPR.

5.3 Data Processing Addendum

On request, the parties will enter into a DPA forming part of the Agreement, addressing processing scope, security measures, sub-processing, breach notification, data-subject requests, audit, and cross-border transfer mechanisms.

5.4 Sub-processors and AI providers

You authorise our use of sub-processors to deliver the Service, including our cloud hosting provider and our third-party AI model provider. We impose data-protection obligations on sub-processors no less protective than those in the DPA and remain responsible for their performance.

5.5 Security

We implement appropriate technical and organisational measures designed to protect Candidate Data against unauthorised access, loss or disclosure — including per-client account isolation, encrypted storage, and signed, time-limited access links. See our Data Protection page for detail.

5.6 Breach notification

We will notify you without undue delay after becoming aware of a personal-data breach affecting your Candidate Data, so you can meet your own notification obligations (which under some regimes require regulator notification within short, fixed timeframes).

5.7 Retention and deletion

We retain Candidate Data only as long as needed to provide the Service or as required by law, and delete or return it on your reasonable request or on termination, subject to legal retention requirements. Only aggregate, non-identifying operational metrics (such as counts, processing times and accuracy statistics) may be retained to monitor and improve the Service.

6. Intellectual Property

6.1 Our IP

We own and retain all intellectual-property rights in the Service, including its software, models, scoring methodology, verification engine, rule pipeline, templates and documentation. No rights are granted except the limited right to use the Service under the Agreement.

6.2 Your data and deliverables

You retain all rights in your Candidate Data. We grant you a non-exclusive licence to use the reports, shortlists and deliverables generated for you for your recruitment business — including providing them to your own clients and customers as part of the recruitment services you offer them.

6.3 Feedback

We may use suggestions or feedback you give us to improve the Service without restriction or obligation.

7. Fees, Plans & Trials

7.1 Plans

The Service is offered on (a) monthly subscription plans with a monthly CV allowance that resets each billing cycle, and (b) annual or fixed-term plans under which you purchase a pool of CV-processing credits drawn down over the term. The plan, allowance, daily cap, price, currency and payment terms are set out in your Order Form.

7.2 Fair-use and processing caps

Each plan is subject to the CV allowance and daily processing cap in your Order Form. We may queue, throttle or decline processing that exceeds those limits, or invite you to upgrade or buy additional credits.

7.3 Payment

Fees are payable in the currency and on the schedule in your Order Form. Unless stated otherwise, fees are exclusive of any applicable taxes, withholding or bank charges, which are your responsibility.

7.4 Credits and allowances

Unused monthly allowance does not roll over unless your Order Form says so. Prepaid credits are valid for the term and are non-refundable once consumed.

7.5 Pricing changes and rate-locks

We may change standard pricing on renewal with reasonable prior notice. Any "founding partner" or rate-lock terms apply only as expressly stated in your Order Form, and for as long as the conditions stated there are met.

7.6 Free trials

Any free trial or pilot batch is provided "as is", without warranty, for evaluation only, and may be limited, suspended or withdrawn at any time. Trial outputs are subject to Sections 3 and 8.

8. Service Availability & Disclaimer of Warranties

We use commercially reasonable efforts to make the Service available, but do not guarantee uninterrupted or error-free operation, and the Service relies on third-party infrastructure and AI providers whose availability is outside our control. To the maximum extent permitted by Applicable Law, the Service and all AI Output are provided "as is" and "as available", and we disclaim all warranties — express, implied or statutory — including merchantability, fitness for a particular purpose, accuracy and non-infringement.

9. Limitation of Liability

To the maximum extent permitted by Applicable Law: (a) neither party is liable for indirect, incidental, special, consequential or punitive loss, or loss of profit, revenue, goodwill, anticipated savings or data; (b) we are not liable for any recruitment or employment decision you make, for reliance on AI Output, or for any claim by a Candidate or third party arising from your use of the Service; and (c) our total aggregate liability in connection with the Agreement is limited to the fees you paid us in the 6 months before the event giving rise to the claim. Nothing excludes liability that cannot be excluded under Applicable Law (such as for death or personal injury caused by negligence, fraud, or wilful misconduct).

10. Indemnification

You will indemnify and hold harmless CreaVilla Horizon and its personnel against losses, liabilities, claims, fines and reasonable costs (including legal fees) arising from (a) your breach of the Agreement; (b) your use of the Service or AI Output, including any recruitment or employment decision; (c) any claim by a Candidate or regulator relating to your processing of Candidate Data or your hiring practices; or (d) your breach of Applicable Law. We will defend you against any third-party claim that the Service itself, used as permitted, infringes that third party's intellectual-property rights, and pay damages finally awarded for such a claim.

11. Confidentiality

Each party will keep confidential the other's non-public information disclosed under the Agreement and use it only to perform the Agreement, except where disclosure is required by law or to professional advisers under equivalent duties of confidence.

12. Term & Termination

The Agreement runs for the term in your Order Form. Either party may terminate for the other's material breach not remedied within 30 days of written notice, or immediately on the other's insolvency. On termination your right to use the Service ends, accrued fees remain payable, and the data-handling provisions of Section 5 apply. Sections that by their nature should survive (including 3, 6, 9, 10, 11 and 13) survive termination.

13. General

13.1 Governing law and disputes

The Agreement is governed by the laws of the Islamic Republic of Pakistan, and the parties submit to the courts of Punjab, Pakistan. For cross-border contracts, arbitration may be specified in the Order Form.

13.2 Changes, force majeure, assignment

We may update these Terms with reasonable notice; material changes take effect on renewal or as required by law. Neither party is liable for delay or failure caused by events beyond its reasonable control. You may not assign the Agreement without our consent; we may assign to a successor of our business.

13.3 Severability and waiver

If any provision is unenforceable, the rest remains in effect. A failure to enforce a right is not a waiver of it.

14. Contact

CreaVilla Horizon
Website: creavillahorizon.com
Legal & privacy: legal@creavillahorizon.com
Registered address: Punjab, Pakistan

Adapted from a drafting template — not legal advice. Have a licensed lawyer review and localise this before any client relies on it.

Part B — Privacy Policy

1. Who we are

CreaVilla Horizon (an AI product studio based in Punjab, Pakistan) operates the platform at creavillahorizon.com. For privacy questions, contact privacy@creavillahorizon.com.

2. The two kinds of data we handle

Client account data (we are the controller)

When you create an account or contact us, we process your name, work email, phone/WhatsApp number, company, and account activity. We use it to provide and secure the Service, bill you, and respond to enquiries.

Candidate Data (you are the controller; we are your processor)

When you upload CVs, those documents contain candidates' personal data. We process it only to produce your screening results, on your instructions, under our Terms and any Data Processing Addendum. We do not decide whom you hire, contact candidates, or use candidate content for any purpose of our own.

3. How we use data, and our lawful basis

We use client account data to perform our contract with you and for our legitimate interest in running and securing the Service. We process Candidate Data solely on your documented instructions as your processor. You are responsible for having a lawful basis to upload each CV and for telling candidates that automated tools may assist screening (see Terms §4.1).

4. Who we share it with (sub-processors)

We use a small number of trusted infrastructure and AI providers to run the Service:

• our cloud hosting provider — hosting, database and file storage.
• our third-party AI model provider — reading and scoring CV documents.

These providers act under contract terms at least as protective as ours. We do not sell personal data or share it with advertisers. A current sub-processor list is available on request.

5. International transfers

Our infrastructure may process data in regions outside your own. Where personal data moves across borders, we rely on the transfer mechanisms required by the applicable regime (for example, standard contractual clauses where the GDPR/UK GDPR applies). Our cloud and AI providers may process data in data centres located in several regions; where data crosses borders we rely on the providers' standard contractual safeguards.

6. How long we keep it

We keep data only as long as needed. Specifically: raw uploaded CV files are automatically deleted after 30 days; deliverable links are signed and expire after 7 days; and account data is kept while your account is active and for a reasonable period afterwards, subject to any legal retention requirement. We can delete or return Candidate Data sooner on your reasonable request. Only aggregate, non-identifying metrics (counts, timings, accuracy) are retained to monitor the Service.

7. Security

Every client account is isolated with its own credentials, Candidate Data is stored encrypted, and delivery links are signed and time-limited. More detail is on our Data Protection page.

8. Your rights

Depending on where you and your candidates are located, individuals may have rights to access, correct, delete, or restrict use of their personal data, and to object to certain processing. Because candidates' data is uploaded by our clients, candidate requests are usually directed to the client (the controller); we will assist our clients in responding. To exercise rights regarding your own client-account data, or to raise a candidate request, email privacy@creavillahorizon.com.

9. Cookies & browser storage

We do not use advertising or tracking cookies. The Service uses essential browser storage (localStorage/sessionStorage) to keep you signed in and to operate the dashboard. This is required for the Service to function and is not used to track you across other sites.

10. Changes & contact

We may update this policy with reasonable notice; material changes take effect on posting or as required by law. Questions: privacy@creavillahorizon.com.

Starting template aligned to our Terms — not legal advice. Have a licensed lawyer review and localise before relying on it.

Part C — Data Protection

1. Processing roles

You decide why and how candidate data is processed (you are the controller). We process it only to deliver your screening results, on your documented instructions (we are the processor). On request we will enter a Data Processing Addendum that forms part of your contract.

2. What we do with candidate data

Uploaded CVs are read, scored, ranked and checked for authenticity signals, then returned to you as a shortlist, report and dashboard. We do not contact candidates, make hiring decisions, sell data, advertise.

3. Security measures

• Account isolation — every client account is separated with its own credentials; one client can never see another's data or results.
• Encrypted storage — candidate files and results are stored encrypted on our cloud infrastructure.
• Signed, expiring access — deliverable links are signed and expire after 7 days; nothing is exposed as a public file.
• Access control & auditing — administrative actions on accounts are authenticated and logged.

4. Retention & deletion

Raw uploaded CV files are automatically deleted after 30 days. Deliverable links expire after 7 days. We delete or return candidate data sooner on your reasonable request and on termination, subject to any legal retention requirement. Only aggregate, non-identifying operational metrics are retained to monitor the Service.

5. Sub-processors

We rely on our cloud hosting provider and our third-party AI model provider. They operate under contract terms at least as protective as ours. A current sub-processor list is available on request.

6. Personal-data breaches

If we become aware of a breach affecting your candidate data, we will notify you without undue delay with the information you need to meet your own regulatory obligations, which under some regimes must be met within short, fixed timeframes.

7. International transfers

Where data is processed in a region outside your own, we rely on the transfer mechanism required by the applicable law. Our cloud and AI providers may process data in data centres located in several regions; where data crosses borders we rely on the providers' standard contractual safeguards.

8. Candidate rights & the decision-support boundary

Candidate access, correction and deletion requests are normally handled by you as the controller, with our assistance. Importantly, our outputs are decision-support only: scores, flags and rankings are recommendations, and every hiring decision is made by you and your client — never automatically by the system. This human-in-the-loop requirement (Terms §3.4) is part of how the Service is designed to fit automated-decision rules.

9. Contact

Data-protection questions: privacy@creavillahorizon.com.

Starting template aligned to our Terms — not legal advice. Have a licensed lawyer review and localise before relying on it.