Privacy Policy

1. Information We Collect

We collect information that you provide directly and information generated through your use of the Platform:

Information you provide

Account details: name, email address, phone number
Identity information: SA ID number, date of birth, gender (optional, used for employment equity matching)
Profile data: professional headline, location, education history, work experience, skills, professional summary
Documents: CVs, ID copies, certificates, qualifications, reference letters, and other supporting documents you upload
Preferences: preferred job types, work arrangements, salary expectations, job categories
Communications: comments on job listings, support messages
Connected email accounts: OAuth credentials for Gmail and/or Outlook accounts you choose to connect

Information collected automatically

Device and browser information
IP address and approximate location
Pages visited, features used, and time spent on the Platform
Referral source

2. How We Use Your Information

To create and manage your account
To build your profile and generate CVs using AI
To match you with relevant job opportunities
To submit job applications on your behalf through your connected email account (when authorised)
To send platform notifications about job matches, application updates, and security alerts
To improve our services and develop new features
To detect and prevent fraud, spam, and misuse
To comply with legal obligations

3. AI Processing

We use AI in two ways, and they are kept separate:

On-server (local): We run a self-hosted AI model on our own VPS to compose application emails, generate suggested replies to employer messages, and analyse employer responses for interviews and document requests. All data from your connected email (Gmail or Outlook) is processed exclusively on our server. No email data is sent to any external AI provider. We do not use email data to train, retrain, or improve any model.

External API services: For features unrelated to email, we use Anthropic Claude (CV parsing, profile building) and DeepSeek API (interview prep, career coaching, lessons). These services receive your CV text, profile data, and job descriptions only. They never receive any data obtained from your Gmail or Outlook account. We share only the minimum data necessary for each specific task. We do not share your ID number, banking details, passwords, or email credentials with any AI provider.

AI-processed data is used solely to provide our services. We do not sell your data to AI providers or any other third party.

3.1 Google API Services — AI Model Disclosure

In accordance with the Google API Services User Data Policy, we disclose the following about the AI model used to process data obtained from Google APIs (Gmail):

Model name: DeepSeek-R1
Deployment: Self-hosted and offline. The model runs locally on our own VPS server via Ollama. It is not accessed through any external API, cloud service, or third-party provider.
Data handling: All Google user data (including Gmail message content, threads, and metadata) is processed exclusively on our own server. No Google user data is transmitted to DeepSeek, Ollama, or any external AI provider at any time.
Training: We do not use Google user data to train, retrain, fine-tune, or improve the DeepSeek-R1 model or any other machine learning model. The model is used strictly for inference (generating output) in direct service of the user's request.
Purpose: The self-hosted DeepSeek-R1 model is used solely to compose application email content, generate suggested replies to employer messages, and analyse employer responses for interview invitations and document requests — all features directly visible to the user.

No other AI model processes data obtained from Google APIs. External AI services (Anthropic Claude API, DeepSeek API) are used only for features unrelated to Gmail and never receive any data obtained from Google APIs.

4. Third-Party Services

We use the following third-party services that may process your data:

Cloudflare — content delivery, security, and DNS services. Cloudflare R2 is used for secure document storage.
Google — Google Analytics for usage tracking, Google AdSense for displaying advertisements, and Gmail API for sending applications from your connected Google account.
Microsoft — Microsoft Graph API for sending applications from your connected Outlook account.
Meta (WhatsApp Business API) — used to send important notifications such as job match alerts, application updates, and weekly digests to users who have opted in to WhatsApp notifications. We send messages only to users who have explicitly connected their WhatsApp number and enabled the WhatsApp channel in their settings. We do not share any personal data with Meta beyond the recipient phone number and the message content.
PayFast — payment processing for premium features.
Anthropic (Claude) — AI processing for CV parsing and content generation.
DeepSeek (self-hosted) — a self-hosted model running on our own server, used to compose application emails, generate reply suggestions, and analyse employer responses. No data leaves our server for this processing.
DeepSeek API — used for interview preparation, career coaching, and lesson content only. Does not receive any email or Gmail data.

5. Data Sharing

We share your information only in the following circumstances:

With employers — when you apply for a job, your CV, cover letter, and selected documents are sent to the employer from your connected email account.
With AI providers — limited data for processing as described above.
With Google / Microsoft — your OAuth credentials are exchanged directly with these providers during the connection process. We store the resulting tokens (encrypted) to send emails on your behalf. We do not share these tokens with any other party.
With payment processors — transaction data for payment processing.
As required by law — when compelled by South African law, court order, or regulatory authority.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Communications & Notifications

We may contact you via email, WhatsApp (opt-in only), and in-app notifications. You can control non-essential notifications from your settings. Security alerts and important account notifications are mandatory while your account is active.

7. Your Rights Under POPIA

Under the Protection of Personal Information Act (POPIA), you have the right to access, correct, delete, or object to the processing of your personal information. You may withdraw consent and lodge complaints with the Information Regulator.

To exercise any of these rights, email legal@spaannow.co.za. We will respond within 30 days.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data is permanently removed within 30 days, including all stored email credentials and OAuth tokens. Anonymised, aggregated data may be retained indefinitely.