Privacy Policy

1. Information we collect

We collect the following, and nothing else:

• Account details — your name, email address and profile image, received from Google when you sign in.
• Phone number — collected when you make an M-Pesa payment, so the payment can be initiated and matched to your account.
• Payment records — amount, M-Pesa receipt number, status and timestamp. We never see or store your M-Pesa PIN, and we do not store card details.
• CV content — where you use the CV optimisation service, the document you upload and the information in it, including employment history, education and contact details.
• Subscription status — what you have purchased and when it expires.

2. How we use it

We use your data to operate the service: to authenticate you, to take and reconcile payments, to control access to paid listings, to produce your optimised CV, and to respond to support requests. We do not sell your personal data, and we do not share it with employers unless you choose to apply to a role.

3. Third parties who process your data

• Google — sign-in and identity verification.
• Safaricom (M-Pesa Daraja) — payment processing.
• Neon — database hosting. Your data is stored on servers located in [REGION].
• Vercel — application hosting and request logs.
• Anthropic— where you use CV optimisation, your CV content is sent to Anthropic's API to generate the optimised version.

Some of these providers store data outside Kenya. Where that happens we rely on their contractual data-protection commitments.

4. How long we keep it

Account and payment records are kept for [N] years to meet tax and accounting obligations. CV documents are kept for [N] months after the order is completed, unless you ask us to delete them sooner.

5. Your rights

Under the Data Protection Act 2019 you have the right to access the personal data we hold about you, to have inaccurate data corrected, to request deletion, to object to processing, and to receive your data in a portable format. To exercise any of these, email us at [CONTACT EMAIL]. We will respond within the period required by law.

If you believe we have mishandled your data, you may lodge a complaint with the Office of the Data Protection Commissioner (ODPC).

6. Security

Access to paid content and to your account is protected by authenticated sessions. Data is transmitted over TLS and stored in an access-controlled database. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.

7. Cookies

We use cookies that are strictly necessary for the service to work: a session cookie to keep you signed in, and a preference cookie storing your light/dark theme choice. We do not use advertising cookies.

8. Contact

[REGISTERED BUSINESS NAME], [PHYSICAL ADDRESS], Kenya. Email: [CONTACT EMAIL].