Privacy Policy

Effective date: March 2026 | Last updated: March 2026

1. Who We Are

This CV tool is operated by Abridged Knowledge 035, a product of Untrapped Holdings 035 (Pty) Ltd, registered in South Africa (Registration: 2022/608502/07). We are committed to protecting your personal information in accordance with the Protection of Personal Information Act 4 of 2013 (POPIA).

2. What Data We Collect

We collect only the minimum data necessary to provide our CV generation service. The tool is designed so that it works identically whether you provide personal information or not. Your data is never sold to third parties.

2.1 Data You Provide Directly

  • Full name, phone number, email, location, skills, work history, education: Used solely to generate your CV. This information is sent to our AI service provider for processing and is not permanently stored unless you explicitly consent (see Section 5).
  • Uploaded CV files: Temporary files (TXT, DOCX, PDF) are processed in server memory, extracted for text content, and immediately deleted from our servers. We do not retain copies of uploaded files.

2.2 Automatically Collected Data

  • Email hash: If you provide your email address, it is immediately converted to a one-way SHA-256 hash using a cryptographic salt. The original email address is never stored, logged, or transmitted in plain text after hashing. This hash is used solely to track daily usage limits per service mode.
  • IP address hash: If you consent to opportunity matching, your IP address is hashed and stored alongside your consent record for security auditing purposes.

3. How We Use Your Data

  • CV Generation: Your provided details and any uploaded CV content are sent to our AI service provider (OpenRouter) to generate an improved, created, reviewed, or tailored CV. This data is processed in a single API request and is not stored by us after the response is delivered to your browser.
  • Rate Limiting: Your hashed email address is used to enforce fair daily usage limits (1 request per day for Review, Improve, and Create modes; 3 requests per day for Tailor mode). These limits reset every day at midnight South African Standard Time.
  • Research Data (with consent): If you check the research consent box, anonymous, non-identifiable data about your usage (province, mode used, whether you uploaded a CV) is stored for employment research purposes. This data cannot be traced back to you.
  • Opportunity Matching (with consent): If you check the opportunity consent box, your contact details are encrypted using AES-256 encryption and stored securely for the purpose of matching you with verified job opportunities. Your data is never shared publicly or sold to recruiters.

4. Third-Party Services

4.1 OpenRouter (AI Processing)

Your CV data and personal details are sent to OpenRouter, our AI service provider, for the purpose of generating your CV. OpenRouter processes this data under their own privacy policy. We do not share your email address, IP address, or any identifying information with OpenRouter. The data sent to OpenRouter is limited to the content necessary for CV generation and is not used by OpenRouter for training purposes (as per their terms of service). OpenRouter's privacy policy is available at openrouter.ai/privacy.

4.2 Google AdSense (Advertising)

We use Google AdSense to display advertisements on the landing page and during the CV generation wait period. Google AdSense may use cookies and similar technologies to serve ads based on your prior visits to this or other websites. You can opt out of personalised advertising by visiting Google Ads Settings. For more information about how Google uses your data, please review Google's Privacy Policy.

5. Consent

Our tool uses two separate, independent consent checkboxes. Neither is pre-ticked. Neither is required for the tool to function. You may use the CV tool without providing any consent at all, and it will work identically.

  • Research consent: Allows us to store anonymous, non-identifiable usage data for employment research. This data includes your province, the service mode used, and whether you uploaded a CV. No personally identifiable information is stored under this consent. Because the data is anonymous, it cannot be deleted or traced back to you.
  • Opportunity consent: Allows us to store your encrypted contact details and generated CV for the purpose of contacting you about verified job opportunities. This consent can be withdrawn at any time by emailing us (see Section 8).

6. Your Rights Under POPIA

As a data subject under the Protection of Personal Information Act, you have the following rights regarding your personal information:

  • Right to access: You may request a copy of the personal information we hold about you.
  • Right to correction: You may request that we correct any inaccurate personal information.
  • Right to deletion: You may request that we delete your personal information. Upon receiving a verified deletion request, we will remove your data from the opportunity_consent and cv_data tables within 30 days. Rate limit records are automatically purged periodically and are not linked to your identity after the salt rotation period.
  • Right to withdraw consent: You may withdraw your opportunity consent at any time by emailing us. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
  • Right to object: You may object to the processing of your personal information.
  • Right to lodge a complaint: You may lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

7. Data Retention

  • Uploaded files: Deleted from our servers immediately after text extraction during processing. No copies are retained.
  • Rate limit records: Retained for a minimum of 30 days and deleted during periodic maintenance. These records contain only a hashed email address and cannot identify you.
  • Research data: Retained indefinitely as this data is anonymous and cannot be linked to any individual.
  • Opportunity matching data: Retained until you request deletion or withdraw consent.

8. Data Security

We implement multiple layers of security to protect your information. Configuration files containing database credentials and API keys are stored in a directory above the web root, making them inaccessible via the internet. All database queries use prepared statements to prevent SQL injection. Email addresses are hashed before any storage or query. Personal information for opportunity matching is encrypted using AES-256 encryption. The API directory is restricted to POST requests only, and all requests are validated server-side. We do not store uploaded files on disk; they are processed in memory and immediately deleted.

9. Cookies

This tool does not set its own cookies. However, Google AdSense (our advertising partner) may set cookies on your browser for ad delivery and personalisation purposes. These cookies are managed by Google and are subject to Google's privacy policy. You can manage cookie preferences through your browser settings or Google's Ad Settings page.

10. Children's Privacy

This tool is not directed at children under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately and we will take steps to delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected on this page with an updated "Last updated" date. We encourage you to review this policy periodically to stay informed about how we protect your information.

12. Contact Us

If you have any questions about this privacy policy, wish to exercise your data rights, or want to request deletion of your personal information, please contact us:

Deletion requests will be processed within 30 days of receipt. You will receive confirmation once your data has been removed.