HSE HUB
← Back to site
Legal

Privacy Policy

Effective date: 20 July 2026  ·  Applies to https://freeresources.usmanjamilcsp.com/ and our mobile app HSE HUB (the “App”)

1Overview

This Privacy Policy explains how the Free Resources platform (freeresources.usmanjamilcsp.com, the “Platform”) and our related mobile application handle your information. The Platform provides free ASP/CSP exam-practice questions, study resources, and related tools. Downloadable resources are free and open. No registration or email is required to access them. The practice/exam portal asks for a few details so it can save your progress; this policy describes exactly what is collected and why.

2Information we collect

Signing in

You can use the practice portal, exams, toolbox talks, the library and the calculators without any account at all. Signing in is only required for Career Preparation; everywhere else it is optional and simply keeps your progress between sessions.

There are three ways to sign in, and you choose:

  • Sign in with Google. Google confirms your identity to us and passes on your name, email address and profile picture URL. We store only your name and email address.
  • Sign in with Apple. Apple confirms your identity and passes on your name and email address. If you choose Hide My Email, Apple gives us a private relay address instead of your real one, and that is all we ever see. We support this deliberately.
  • An access code. You enter a name, an email address and the public code.

We never receive your password. Signing in with Google or Apple happens on their systems, not ours; we only receive a signed confirmation of who you are, which our server verifies against Google's and Apple's published keys. We do not receive access to your Google or Apple account, your contacts, your files or your mail.

If you sign in with both Google and Apple using the same verified email address, they are treated as one account so your practice history is not split in two.

Practice portal (exam.html)

If you sign in with an access code instead, you enter your name, email address, and the code. We use these to identify your practice history so your progress dashboard works across sessions. The portal does not use passwords, and we never ask for one.

Practice activity

  • The practice and exam sessions you take: questions attempted, your answers, scores, per-domain performance, and missed questions.
  • This history powers your score trend, domain-mastery view, and personalised study plan.

Career Preparation (CV audit and interview practice)

Career Preparation requires you to be signed in. This is the only part of the platform that does. Two honest reasons: each run costs us money to produce, and the daily allowance is per person. When it was counted per network address, everyone in one site office or training centre unknowingly shared a single allowance between them.

Because you are signed in, a Career Preparation request is associated with your account while it is being answered. What that means in practice is set out below: the request is linked to you, the contents of it are not kept.

If you use it, you provide the following, and only for as long as it takes to answer you:

  • Your CV, as text you paste in.
  • A job description, target role, industry, seniority and, optionally, a company name, if you choose to give them.
  • Your answers during a practice interview.

We do not store any of it. Your CV, the job description and your interview answers are held in memory only for the moment it takes to produce your result. They are never written to our disk, never saved in our database, and never kept after the response is returned. Nothing you paste is retained by us.

The only record we keep of Career Preparation is a usage counter used to enforce the daily limit and control costs: a timestamp, which feature was used, your account id, and how many words the AI processed. That counter is linked to your account, and it contains no part of your CV, job description or interview answers. Deleting your account deletes it.

That counter also holds a one-way salted hash of your IP address. We cannot reverse it to your address, and it is never stored next to anything you typed. It exists for one reason: AI features cost us real money per use, and without it somebody could create unlimited accounts on one machine to bypass the daily limit. It is used only to detect that pattern, and it is deleted with your account.

A CV often contains far more personal data than a job needs. A passport number, date of birth, photograph, nationality or marital status. We recommend removing these before pasting. If you leave them in, the audit will flag them and the revised CV we generate removes them for you.

The revised CV and its PDF are produced on your device. That document is never uploaded to us and never leaves your phone unless you choose to share it.

Server logs

Like virtually all websites, our hosting provider keeps standard server logs (IP address, browser type, pages requested, timestamps) for security and reliability. We do not run any analytics or tracking scripts on the Platform.

Telegram bot

If you interact with our Telegram bot(s) (for eligibility checks or the resource hub), Telegram provides limited information such as your Telegram user ID and username so the bot can respond to you. Your use of Telegram is also subject to Telegram’s own privacy policy.

Mobile app notifications

If you use the HSE HUB app and allow notifications, a device registration token is issued and held by Google so that messages can be delivered to your device. This is a device identifier, not a name or email. See section 6 for the full explanation.

3How we use information

  • To recognise you in the practice portal and save your practice history and progress.
  • To display your progress dashboard (score trend, domain mastery, study plan).
  • To respond when you contact us for support or tuition.
  • To secure the Platform and prevent abuse (e.g. enforcing access-code limits).

We do not sell your personal information, and we do not use your email address for marketing or newsletters. Your email is used only to identify your practice history and to reply if you write to us.

4Cookies & local storage

The practice portal stores a short-lived session (valid for 8 hours), any in-progress exam (so a crash or reload doesn’t lose your answers), and your display preference (dark/light mode) in your browser’s local storage. This data stays on your device, is essential for the Platform to function, and is not used for advertising or tracking. We do not set advertising or analytics cookies.

5Sharing & third parties

We share information only with the providers needed to operate the Platform, or where required by law:

  • Hosting provider. The servers that run the Platform and store portal data.
  • Cloudflare, content delivery and security; the portal also loads the jsPDF library from Cloudflare’s cdnjs to generate your study-sheet PDF.
  • Google Fonts. The Platform loads its typefaces from Google Fonts; your browser contacts Google’s servers (disclosing your IP address) to fetch them.
  • Telegram, only if you use our Telegram bots.
  • Google and Apple, only if you choose to sign in with them. They tell us who you are; we do not tell them anything about what you do here. We do not send them your practice results, your CV, or any part of Career Preparation. Their handling of the sign-in itself is governed by their own privacy policies.
  • A third-party AI provider, used only if you choose to use Career Preparation. The text you submit (your CV, any job description, and your interview answers) is sent to that provider to generate your result, and a company name you supply may be used to search publicly available web pages. We use a paid, business-tier service under terms that do not permit your content to be used to train their models. The provider processes the text to return a response and we do not authorise them to retain it for any other purpose. If you do not use Career Preparation, nothing is ever sent to them.
  • Google (Firebase Cloud Messaging), delivers push notifications to the HSE HUB app, and holds the device registration token described in section 6. Google acts as our service provider for message delivery only.

We do not share your data with advertisers, data brokers, or ad networks.

6Mobile application (HSE HUB)

When you use our App, the same practice-portal data described above applies (name, email, access code, and practice activity). The App does not show third-party advertising and does not use tracking SDKs.

Push notifications

If you allow notifications, the App registers with Firebase Cloud Messaging (FCM), a Google service, so we can send occasional announcements, for example when new study resources are published. To make delivery possible, Google issues and stores a device registration token (a random identifier for that installation of the App), along with a Firebase installation ID, basic device and operating-system details, and, on iPhone and iPad. An Apple push token. Your IP address is visible to Google when your device contacts its servers.

We send every announcement to a single broadcast “topic” that all installations subscribe to. Because of this, our own servers never receive or store your device token, and we cannot target, identify, profile or track an individual device or person. Notifications are identical for everyone, are never personalised, and are never used for advertising.

The App includes only Firebase Cloud Messaging. It does not include Firebase Analytics, Google Analytics, any advertising SDK, or any tracking framework.

You can turn notifications off at any time, on iPhone/iPad: Settings → Notifications → HSE HUB; on Android: Settings → Apps → HSE HUB → Notifications. Declining or disabling notifications does not affect any other feature of the App. Google’s handling of this data is governed by the Firebase privacy documentation and Google’s Privacy Policy.

The App is currently free. If optional in-app purchases are introduced in the future, payments will be processed entirely by Apple (App Store) or Google (Google Play) under their own terms and privacy policies. We never receive or store your payment-card details. We will update this policy before any purchases are introduced.

7Data security

We take reasonable technical measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8Data retention

Career Preparation retains nothing. Your CV, job description and interview answers are discarded as soon as your result is returned. Only the usage counter described in section 2 remains. It records that a run happened, not what was in it, and it is deleted with your account.

We keep portal and practice data while your access is active and as needed for legitimate operational and legal purposes. You can request deletion of your data at any time (see “Your rights”).

9Your rights & data deletion

You may request access to, correction of, or deletion of your personal data, including your name, email address, and full practice history, at any time.

Delete it yourself, instantly.

  • Signed in with Google or Apple: in the app, go to Profile → Delete my account. On the website, use freeresources.usmanjamilcsp.com/delete.html and sign in with the same Google or Apple account. Those accounts have no access code, so signing in is how we confirm the account is yours. Either way your account, both linked sign-ins, your full practice history and your Career Preparation usage record are permanently removed straight away, and you do not need to contact us first.
  • Signed in with an access code: use our self-service page at freeresources.usmanjamilcsp.com/delete.html and enter the email and access code you used on the portal.

Deleting your account here does not affect your Google or Apple account in any way, and it does not tell them anything. Alternatively, contact us using the details below and we will action your request promptly.

10Children

The Platform and App are intended for users aged 16 and over (typically working professionals and candidates preparing for certification). We do not knowingly collect data from children.

11Third-party links

Resources may link to external standards bodies and references. We are not responsible for the privacy practices of those sites.

12Changes

We may update this policy. The “Effective date” above reflects the current version.

13Contact

Questions, data requests, or data-deletion requests can be sent to hse_usman@outlook.com, or via the contact channels on usmanjamilcsp.com / WhatsApp +971 56 669 8759.