Privacy notice

This notice explains how [Company legal name] ("KaziMatch", "we") collects and uses your personal data when you use KaziMatch, and your rights under the Data Protection Act, 2019 of Kenya. We are the data controller. Contact: [privacy contact email], [postal address]. [Data Protection Commissioner registration details to be added.]

What we collect

• Account details: your name, email address, phone number and password (stored as a secure hash).
• Career information: the CV you upload or paste and the profile extracted from it: work history, education, skills, certifications, languages, and referee details you include.
• Job postings you paste or link, and the documents, scores and notes KaziMatch produces for each application.
• Payment records: the pack bought, amount, phone number, M-Pesa confirmation code and status. We do not receive your M-Pesa PIN.
• Technical data: sign-in records and basic logs needed to keep the service secure.

Please do not upload sensitive personal data we do not need, such as health information, your ID number or details about your religion or ethnicity. KaziMatch is designed to leave these out of the documents it writes.

Why we use it, and on what basis

• To provide the service you asked for: assess jobs, write and store your documents, and process payments (performance of a contract).
• To keep the service secure, prevent abuse and fix problems (legitimate interests).
• To keep financial records as the law requires (legal obligation).
• To send you service messages, such as payment confirmations. We will ask for your consent before sending marketing.

Artificial intelligence

To read your CV, assess postings and write documents, we send the relevant text to Anthropic, which provides the Claude AI models, acting as our processor. Anthropic processes this data to return results to us, under contractual terms that restrict its use. We do not use your data to train AI models. Your documents are drafts for you to review: you decide what to send to employers.

Who else receives your data

• Safaricom PLC, to process M-Pesa payments.
• Hosting and database providers that store the service's data on our behalf. [Provider names and locations to be listed.]
• Authorities, where the law requires it.

We do not sell your personal data and we do not share your CV with employers. Some of our processors operate outside Kenya; where data is transferred abroad we rely on the safeguards the Act requires. [Transfer safeguards to be confirmed.]

How long we keep it

We keep your account data while your account is open. When you delete your account, your profile, CV files, applications and documents are deleted. Payment records are kept for as long as tax and accounting law requires. [Exact periods to be confirmed.]

Security

Data is encrypted in transit. Access to your records is restricted to your account by database-level controls, and your uploaded CV files are stored privately. No system is perfectly secure; if a breach affects your data, we will notify you and the Data Protection Commissioner as the law requires.

Your rights

Under the Data Protection Act, 2019 you may ask to access your data, correct it, delete it, object to or restrict certain processing, and receive a copy in a portable form. You can correct your profile and delete your account yourself from Settings. For anything else, contact [privacy contact email]. You may also complain to the Office of the Data Protection Commissioner.

Changes

We will update this notice when our practices change and tell you about significant changes.