Terms & Conditions
1. Agreement to Terms
By accessing or using the SPAAN NOW platform ("Platform"), including our website, mobile applications, and all related services, you agree to be bound by these Terms of Service. If you do not agree, you may not use the Platform.
Your continued use of SPAAN NOW after any changes to these terms constitutes acceptance of those changes. We will notify registered users of material changes via email or in-app notification.
2. About SPAAN NOW
SPAAN NOW is a South African job application platform that helps job seekers find, match with, and apply for employment opportunities. We source job listings from across South Africa through multiple channels including public APIs, RSS feeds, company career portals, government vacancy bulletins, and manual research by our team. We do not guarantee the accuracy, completeness, or availability of any job listing, as these are sourced from third-party employers and recruitment agencies.
SPAAN NOW is not an employer, recruitment agency, or labour broker. We are a technology platform that connects job seekers with publicly available opportunities and assists with the application process.
3. Eligibility
You must be at least 16 years of age to create an account. Users under 18 must have parental or guardian consent. By registering, you confirm that the information you provide is accurate, current, and complete.
4. User Accounts
You are responsible for maintaining the confidentiality of your account credentials and for all activity that occurs under your account. You must notify us immediately at support@spaannow.co.za if you suspect unauthorised access.
We reserve the right to suspend or terminate accounts that violate these terms, engage in fraudulent activity, or misuse the Platform.
5. AI-Powered Services
SPAAN NOW uses artificial intelligence to enhance your experience. We use two types of AI processing:
On-server AI (local, no data leaves our server): We run a self-hosted AI model (DeepSeek R1 via Ollama) on our own VPS server. This local model is used to compose application email content, generate suggested replies to employer messages, and analyse employer responses for interview invitations and document requests. All processing of data obtained from Gmail or Outlook happens exclusively on this local model. No email data — no message content, thread data, email addresses, or tokens — is sent to any external AI provider or any third party for this processing. We do not use email data to train, retrain, fine-tune, or improve any AI model.
External AI services (for non-email features only): For features that are not connected to your email, we use Anthropic (Claude) for CV parsing and profile building, DeepSeek API for interview preparation, career coaching, and lesson content, and EasyVoice for generating lesson audio. These services process your CV text, profile data, and job descriptions — they never receive any data from your connected email account.
While we strive for accuracy, AI-generated content may contain errors. You are responsible for reviewing and approving all AI-generated documents before they are submitted on your behalf. SPAAN NOW is not liable for any consequences arising from AI-generated content.
6. Connected Email Accounts
SPAAN NOW allows you to connect your personal Gmail or Microsoft Outlook account so that job applications are sent directly from your own email address. By connecting an email account, you grant SPAAN NOW specific, limited permissions as described in full in the Email Accounts section of these policies.
Applications are never sent from a SPAAN NOW email address. A connected email account is required to send applications. You may disconnect your email account at any time, which immediately and permanently revokes all permissions.
7. Auto-Apply Feature
When enabled, the Auto-Apply feature allows SPAAN NOW to submit job applications on your behalf to positions that match your profile and preferences. Applications are sent from your connected email account. By enabling this feature, you authorise us to compose and send application emails containing your CV, cover letter, and supporting documents to employers.
Each automated application includes a short, AI-generated message body that is unique to the job and based on your profile. You control the match threshold, daily limit, and document requirements. You may disable Auto-Apply at any time from your settings. Applications already sent cannot be recalled.
8. Job Listings & Sourcing
Job listings on SPAAN NOW are sourced from publicly available sources across South Africa. Our sourcing methods include:
- Public APIs and RSS feeds from job boards
- Government department vacancy bulletins and career portals
- Company career pages and recruitment agency listings
- Manual research by our content team
We do not create job listings. All listings originate from third-party employers or agencies. We are not responsible for the accuracy of job descriptions, salary information, closing dates, or employer conduct. If you encounter a suspicious or fraudulent listing, please report it immediately.
9. User Content & Comments
You may post comments and participate in discussions on job listings. You retain ownership of your content but grant SPAAN NOW a non-exclusive, royalty-free licence to display, distribute, and moderate it on the Platform.
You agree not to post content that is fraudulent, misleading, defamatory, discriminatory, or that contains personal contact details intended to circumvent the Platform. We employ automated moderation and reserve the right to remove content and suspend accounts that violate these guidelines.
10. Payments & Subscriptions
Certain features of SPAAN NOW may require payment. Payments are processed securely through PayFast, a PCI DSS-compliant South African payment gateway. SPAAN NOW does not store your credit card or banking details directly.
Refund policies for paid services will be communicated at the point of purchase. Free-tier services may be modified or discontinued at any time.
11. Account Deletion
You may delete your account at any time from your profile settings or by emailing support@spaannow.co.za. Upon deletion, your personal data, CV, documents, profile information, and all stored email credentials will be permanently removed from our systems within 30 days. Data that has already been submitted to employers as part of job applications cannot be recalled.
12. Limitation of Liability
SPAAN NOW is provided 'as is' without warranties of any kind. We do not guarantee that you will receive responses from employers, secure interviews, or obtain employment through the Platform. We are not liable for any direct, indirect, incidental, or consequential damages arising from your use of the Platform, including but not limited to emails sent through connected email accounts on your behalf.
13. Governing Law
These terms are governed by the laws of the Republic of South Africa, including the Consumer Protection Act (CPA), the Protection of Personal Information Act (POPIA), and the Electronic Communications and Transactions Act (ECTA). Any disputes shall be subject to the jurisdiction of the South African courts.
14. Contact
For legal matters: legal@spaannow.co.za
For general support: support@spaannow.co.za
Privacy Policy
1. Information We Collect
We collect information that you provide directly and information generated through your use of the Platform:
Information you provide
- Account details: name, email address, phone number
- Identity information: SA ID number, date of birth, gender (optional, used for employment equity matching)
- Profile data: professional headline, location, education history, work experience, skills, professional summary
- Documents: CVs, ID copies, certificates, qualifications, reference letters, and other supporting documents you upload
- Preferences: preferred job types, work arrangements, salary expectations, job categories
- Communications: comments on job listings, support messages
- Connected email accounts: OAuth credentials for Gmail and/or Outlook accounts you choose to connect
Information collected automatically
- Device and browser information
- IP address and approximate location
- Pages visited, features used, and time spent on the Platform
- Referral source
2. How We Use Your Information
- To create and manage your account
- To build your profile and generate CVs using AI
- To match you with relevant job opportunities
- To submit job applications on your behalf through your connected email account (when authorised)
- To send platform notifications about job matches, application updates, and security alerts
- To improve our services and develop new features
- To detect and prevent fraud, spam, and misuse
- To comply with legal obligations
3. AI Processing
We use AI in two ways, and they are kept separate:
On-server (local): We run a self-hosted AI model on our own VPS to compose application emails, generate suggested replies to employer messages, and analyse employer responses for interviews and document requests. All data from your connected email (Gmail or Outlook) is processed exclusively on our server. No email data is sent to any external AI provider. We do not use email data to train, retrain, or improve any model.
External API services: For features unrelated to email, we use Anthropic Claude (CV parsing, profile building) and DeepSeek API (interview prep, career coaching, lessons). These services receive your CV text, profile data, and job descriptions only. They never receive any data obtained from your Gmail or Outlook account. We share only the minimum data necessary for each specific task. We do not share your ID number, banking details, passwords, or email credentials with any AI provider.
AI-processed data is used solely to provide our services. We do not sell your data to AI providers or any other third party.
3.1 Google API Services — AI Model Disclosure
In accordance with the Google API Services User Data Policy, we disclose the following about the AI model used to process data obtained from Google APIs (Gmail):
- Model name: DeepSeek-R1
- Deployment: Self-hosted and offline. The model runs locally on our own VPS server via Ollama. It is not accessed through any external API, cloud service, or third-party provider.
- Data handling: All Google user data (including Gmail message content, threads, and metadata) is processed exclusively on our own server. No Google user data is transmitted to DeepSeek, Ollama, or any external AI provider at any time.
- Training: We do not use Google user data to train, retrain, fine-tune, or improve the DeepSeek-R1 model or any other machine learning model. The model is used strictly for inference (generating output) in direct service of the user's request.
- Purpose: The self-hosted DeepSeek-R1 model is used solely to compose application email content, generate suggested replies to employer messages, and analyse employer responses for interview invitations and document requests — all features directly visible to the user.
No other AI model processes data obtained from Google APIs. External AI services (Anthropic Claude API, DeepSeek API) are used only for features unrelated to Gmail and never receive any data obtained from Google APIs.
4. Third-Party Services
We use the following third-party services that may process your data:
- Cloudflare — content delivery, security, and DNS services. Cloudflare R2 is used for secure document storage.
- Google — Google Analytics for usage tracking, Google AdSense for displaying advertisements, and Gmail API for sending applications from your connected Google account.
- Microsoft — Microsoft Graph API for sending applications from your connected Outlook account.
- Meta (WhatsApp Business API) — used to send important notifications such as job match alerts, application updates, and weekly digests to users who have opted in to WhatsApp notifications. We send messages only to users who have explicitly connected their WhatsApp number and enabled the WhatsApp channel in their settings. We do not share any personal data with Meta beyond the recipient phone number and the message content.
- PayFast — payment processing for premium features.
- Anthropic (Claude) — AI processing for CV parsing and content generation.
- DeepSeek (self-hosted) — a self-hosted model running on our own server, used to compose application emails, generate reply suggestions, and analyse employer responses. No data leaves our server for this processing.
- DeepSeek API — used for interview preparation, career coaching, and lesson content only. Does not receive any email or Gmail data.
5. Data Sharing
We share your information only in the following circumstances:
- With employers — when you apply for a job, your CV, cover letter, and selected documents are sent to the employer from your connected email account.
- With AI providers — limited data for processing as described above.
- With Google / Microsoft — your OAuth credentials are exchanged directly with these providers during the connection process. We store the resulting tokens (encrypted) to send emails on your behalf. We do not share these tokens with any other party.
- With payment processors — transaction data for payment processing.
- As required by law — when compelled by South African law, court order, or regulatory authority.
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
6. Communications & Notifications
We may contact you via email, WhatsApp (opt-in only), and in-app notifications. You can control non-essential notifications from your settings. Security alerts and important account notifications are mandatory while your account is active.
7. Your Rights Under POPIA
Under the Protection of Personal Information Act (POPIA), you have the right to access, correct, delete, or object to the processing of your personal information. You may withdraw consent and lodge complaints with the Information Regulator.
To exercise any of these rights, email legal@spaannow.co.za. We will respond within 30 days.
8. Data Retention
We retain your data for as long as your account is active. If you delete your account, your personal data is permanently removed within 30 days, including all stored email credentials and OAuth tokens. Anonymised, aggregated data may be retained indefinitely.
Email Accounts
This section explains exactly what happens when you connect your Gmail or Outlook account to SPAAN NOW — what permissions we request, how we use them, how your credentials are protected, and how to disconnect at any time.
1. Why We Ask You to Connect Your Email
Job applications on SPAAN NOW are sent directly from your own email address, not from a SPAAN NOW address. This means employers see your real name and email in their inbox, replies come straight to you, and there is no middleman between you and the employer.
To make this possible, we need your permission to send emails on your behalf through your Gmail or Outlook account. We use the official OAuth 2.0 authorisation flow provided by Google and Microsoft — the same secure process used by thousands of apps worldwide. We never see, ask for, or store your email password.
2. How the Connection Works
When you tap 'Connect Gmail' or 'Connect Outlook', you are redirected to Google's or Microsoft's own sign-in page. You log in there (not on our site) and Google or Microsoft shows you the specific permissions we are requesting. You choose whether to grant them. If you do, Google or Microsoft issues us a set of tokens — digital keys that allow us to perform only the actions you approved.
At no point does SPAAN NOW receive your email password. The tokens we receive are limited to the permissions you granted and can be revoked by you at any time.
3. Permissions We Request
Gmail (Google)
When you connect a Gmail account, we request the following permissions through Google's OAuth consent screen:
- Send email on your behalf (
gmail.send) — This allows us to compose and send job application emails from your Gmail address. We use this permission exclusively for sending job applications that you have authorised, either manually or through the Auto-Apply feature. - View your email messages (read-only) (
gmail.readonly) — This allows us to poll the delivery status of application emails we sent on your behalf, and to check for employer replies to your applications. We use this permission to provide the following features:- Application status tracking — Automatically detect whether an application was delivered, bounced, or received a reply. Your application status updates automatically based on employer responses.
- Follow-up status — Know when an employer has responded to your application so you don't send unnecessary follow-ups, and track which follow-ups have been answered.
- Suggested replies — When an employer replies, we analyse the message and suggest AI-generated response options tailored to the conversation, helping you reply professionally and promptly.
- Interview detection — Automatically identify interview invitations in employer emails so we can prompt you to confirm your availability and track upcoming interviews.
- Document request detection — Detect when an employer asks for additional documents (certificates, ID copies, etc.) and prompt you to upload and send them without leaving the platform.
- View your email address (
email,profile) — This allows us to identify which email address you connected and display it in your settings.
Outlook (Microsoft)
When you connect an Outlook account, we request the following permissions:
- Send mail as you (
Mail.Send) — This allows us to compose and send job application emails from your Outlook address. We use this permission exclusively for sending job applications that you have authorised. - Read your mail (
Mail.Read) — This allows us to poll the delivery status of application emails we sent on your behalf, and to check for employer replies to your applications. We use this permission to provide the following features:- Application status tracking — Automatically detect whether an application was delivered, bounced, or received a reply. Your application status updates automatically based on employer responses.
- Follow-up status — Know when an employer has responded to your application so you don't send unnecessary follow-ups, and track which follow-ups have been answered.
- Suggested replies — When an employer replies, we analyse the message and suggest AI-generated response options tailored to the conversation, helping you reply professionally and promptly.
- Interview detection — Automatically identify interview invitations in employer emails so we can prompt you to confirm your availability and track upcoming interviews.
- Document request detection — Detect when an employer asks for additional documents (certificates, ID copies, etc.) and prompt you to upload and send them without leaving the platform.
- Read your basic profile (
User.Read) — This allows us to identify your email address and display name for your settings. - Maintain access (
offline_access) — This allows us to refresh your connection in the background so you don't have to reconnect every hour. Without this, your token would expire after roughly 60 minutes and you would need to re-authorise every time.
4. What We Do with Your Email Connection
We use your connected email account for the following purposes and no others:
- Send job application emails — When you apply for a job (manually or through Auto-Apply), the application email is composed on our platform and sent from your connected email account. The email includes your subject line, a short message body, and your CV, cover letter, and any other required documents as attachments.
- Confirm delivery — We check whether an application email was delivered or bounced, so we can update the status in your application tracker and alert you to any failures.
- Poll for employer replies on application threads only — After sending an application, we periodically check the specific email thread (identified by the unique thread ID and message ID of the application we sent) for new replies from the employer. We only look at messages within the application thread — we never scan your inbox broadly. This allows us to:
- Detect employer replies and update your application status automatically
- Generate AI-suggested replies to help you respond professionally
- Identify interview invitations, document requests, and other important responses
- Track follow-up status so you know when an employer has already responded
- Save to your Sent folder — Application emails sent through your connected account appear in your Sent folder, so you have a complete record of every application in your own email.
5. What We Will Never Do
We make the following commitments regarding your connected email account:
- We will never read your personal emails — not your inbox, not your conversations, not your promotions, not your social messages. We do not scan, index, analyse, or store the content of any email you receive or send outside of SPAAN NOW application threads.
- We will never scan your entire inbox — our email access is strictly limited to the specific threads that contain applications we sent. We identify these threads by the unique message ID and thread ID of each application we dispatched from your account.
- We will never send emails that you haven't authorised — every email we send is either a job application you initiated manually, or an automated application governed by your Auto-Apply settings (which you control and can disable at any time).
- We will never send marketing emails, spam, or promotional content from your account.
- We will never share your email credentials (tokens) with any third party, advertiser, or data broker.
- We will never use your email connection to track you across other services or websites.
- We will never modify, delete, or move any existing emails in your account.
- We will never access your contacts, calendar, Google Drive, OneDrive, or any other service beyond the specific permissions listed above.
- We will never read emails from threads we did not originate — if an employer emails you separately (outside the application thread), we do not access, read, or process that email.
6. How We Protect Your Credentials
The security of your email tokens is a top priority. Here is exactly how we handle them:
- Encryption at rest — Your access token and refresh token are encrypted using AES-256-CBC encryption before they are stored in our database. Even if our database were somehow compromised, the tokens would be unreadable without the application's encryption key.
- No password storage — We never receive or store your Google or Microsoft password. Authentication happens entirely on Google's or Microsoft's servers via OAuth 2.0.
- Minimal token exposure — Tokens are decrypted only at the moment they are needed (when sending an email or refreshing a connection) and are never logged, cached, or written to disk in plaintext.
- Automatic refresh — Access tokens expire after roughly one hour. Our system automatically refreshes them using the refresh token, so you stay connected without re-authorising. This happens server-to-server between SPAAN NOW and Google/Microsoft — your browser is not involved.
- Automatic cleanup — If a refresh fails (for example, because you revoked access through Google or Microsoft), we immediately mark the connection as expired, clear the stored tokens, and prompt you to reconnect. We do not retain expired or invalid credentials.
- Deletion on disconnect — When you disconnect an account from SPAAN NOW, we revoke the token at Google's servers (Google supports remote revocation) and then permanently delete it from our database. For Microsoft, we delete the token locally — you can additionally revoke from your Microsoft account.
- Deletion on account removal — If you delete your SPAAN NOW account, all connected email tokens are permanently destroyed within 30 days alongside all your other data.
7. Auto-Apply and Your Email
If you enable the Auto-Apply feature, SPAAN NOW will send job application emails from your connected account automatically when a matching job is found. Here is how this works and the controls you have:
- Match threshold — Only jobs that meet your minimum match score (which you set in your profile settings) are considered.
- Daily limit — You set a maximum number of applications per day (default: 5). We will never exceed this limit.
- Pause and resume — You can pause Auto-Apply at any time, either indefinitely or until a specific date.
- Unique messages — Each automated application email includes a unique, AI-generated message body tailored to the specific job and your profile. We do not send identical bulk messages.
- Document requirements — You can require that Auto-Apply only sends to jobs where you have all the necessary documents uploaded.
- No email if no mailbox — If you have not connected an email account, Auto-Apply will prepare your application but will not send it. You will be notified to connect your email or send it manually.
8. Monitoring and Tracking
We do not monitor your email inbox broadly. The only email activity we are aware of is:
- Application emails that we composed and sent through your connected account
- The delivery status of those specific emails (delivered, bounced, or failed)
- Replies from employers within the specific application threads we originated (identified by thread ID and message ID)
Our polling is strictly limited to checking for new messages within application threads we sent. When an employer replies within that thread, we use that reply to:
- Update your application status automatically (e.g., from "Submitted" to "Employer Replied")
- Generate AI-suggested replies so you can respond promptly and professionally
- Detect interview invitations, document requests, and other key employer communications
- Update follow-up status so you don't send unnecessary reminders after an employer has already responded
We do not track whether employers open your application emails, and we do not install tracking pixels, read receipts, or link-tracking in outgoing emails. We do not access or read emails outside of the application threads we originated.
9. How to Disconnect
You can disconnect your email account at any time through two methods:
- From SPAAN NOW — Go to your profile settings and tap 'Disconnect' next to your connected Gmail or Outlook account. This revokes the token at Google's servers (for Gmail) and permanently deletes it from our database.
- From Google or Microsoft directly — Visit Google Account Permissions or Microsoft Account Permissions and revoke SPAAN NOW's access. Our system will detect the revocation on the next refresh attempt and clear the invalid credentials.
Disconnecting your email account does not delete your SPAAN NOW account or any applications that have already been sent. It only removes our ability to send future emails from your address.
10. Data We Access vs Data We Store
| Data | Accessed | Stored | Purpose |
|---|---|---|---|
| Your email address | ✓ | ✓ | Display in settings, identify the sender |
| Access token | ✓ | ✓ (encrypted) | Send application emails and poll application threads |
| Refresh token | ✓ | ✓ (encrypted) | Keep the connection alive |
| Token expiry time | ✓ | ✓ | Know when to refresh |
| Display name | ✓ | ✗ | Show during the connection flow |
| Application thread messages (thread ID + message ID we sent) | ✓ | ✓ (sender, subject, body of employer replies) | Detect replies, update status, suggest AI replies, identify interviews and document requests |
| Inbox contents (outside application threads) | ✗ | ✗ | Not accessed or stored |
| Emails from threads we did not originate | ✗ | ✗ | Not accessed or stored |
| Contacts | ✗ | ✗ | Not accessed or stored |
| Calendar | ✗ | ✗ | Not accessed or stored |
| Email password | ✗ | ✗ | Never received by SPAAN NOW |
| Sent application emails | Status only | Subject + body text + delivery status | Application record, delivery tracking, and thread identification for reply detection |
11. Compliance
Google API Services — Limited Use Disclosure
SPAAN NOW's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically:
- We limit our use of Google user data to providing and improving user-facing features that are visible and prominent in our application's user interface. The features that use Gmail data are: sending job applications from your connected account, checking delivery status, detecting employer replies, generating AI-suggested replies (processed on our own server, not sent to any external service), and detecting interview invitations and document requests.
- We do not transfer Google user data to any third party — not to AI providers, advertisers, data brokers, or any other service. All processing of Gmail data occurs locally on our own servers using a self-hosted model. No Gmail data is transmitted to an external AI provider or cloud service.
- We do not allow humans to read Google user data unless (a) we have the user's affirmative agreement for a specific message (e.g. to assist with a support request the user initiated), (b) it is necessary for security purposes such as investigating abuse, or (c) it is required to comply with applicable law.
- We do not use Google user data for serving advertisements, including retargeting, personalised, or interest-based advertising.
- We do not use Google user data to train, retrain, fine-tune, or improve any machine learning or artificial intelligence model, whether proprietary or third-party.
Other compliance
Our use of Microsoft Graph complies with the Microsoft API Terms of Use.
Our handling of your personal data, including email credentials, complies with the Protection of Personal Information Act (POPIA) of South Africa.
If you believe we have accessed or used your email account in any way not described in this policy, please contact us immediately at legal@spaannow.co.za.
12. Changes to Email Permissions
If we ever need to request additional permissions beyond what is described above, we will notify you in advance, explain why, and ask for your explicit consent again through the OAuth flow. We will never silently expand the scope of our access to your email account.
Cookies Policy
1. What Are Cookies
Cookies are small text files stored on your device when you visit a website. They help the site remember your preferences, keep you signed in, and understand how you use the Platform.
2. Cookies We Use
Essential cookies
These are required for the Platform to function and cannot be disabled. They include session cookies for authentication, CSRF protection tokens, and security cookies.
Analytics cookies
We use Google Analytics to understand how visitors interact with the Platform. You can opt out by installing the Google Analytics Opt-out Browser Add-on.
Advertising cookies
We display advertisements through Google AdSense. Google may use cookies to serve ads based on your browsing history. Manage your preferences through Google Ads Settings.
Preference cookies
These remember your choices such as theme preference, language, and notification settings.
3. Managing Cookies
Most browsers allow you to control cookies through their settings. Disabling essential cookies may prevent the Platform from functioning correctly.
4. Cloudflare
We use Cloudflare for security and performance. Cloudflare may set cookies (such as __cf_bm and cf_clearance) to identify trusted traffic and protect against bots.
Data & Security
1. How We Store Your Data
Your documents are stored securely using Cloudflare R2 object storage with data encrypted at rest and in transit. Your profile data is stored in our database, protected by access controls, regular backups, and encrypted connections.
2. Document Security
- All file uploads are transmitted over HTTPS (TLS 1.2+)
- Documents are stored in Cloudflare R2 with access restricted to authenticated operations
- Our team does not access your documents unless required for support (with your consent) or compelled by law
- Files are validated before storage to prevent malicious uploads
- When you delete your account, all documents are permanently deleted within 30 days
3. Email Credential Security
Connected email account credentials receive the highest level of protection in our system:
- OAuth tokens are encrypted with AES-256-CBC before storage
- Tokens are decrypted only in server memory at the moment they are needed, and are never logged, cached, or written to files
- The encryption key is stored separately from the database
- Failed or revoked tokens are purged immediately
- All token operations happen over encrypted HTTPS connections to Google's and Microsoft's servers
4. Sensitive Information
- SA ID numbers — stored encrypted, used only for date-of-birth extraction and employment equity. Never shared with employers unless included in your CV.
- Identity documents — stored securely, shared only as part of authorised job applications.
- Disability status — optional, never disclosed without your consent.
- Email OAuth tokens — stored encrypted, used only for sending authorised application emails. Never shared with third parties.
5. What We Share with AI Providers
We send to AI providers: extracted CV text, structured profile data, job listing text, and profile summaries for composing email bodies.
We do not send: ID numbers, identity documents, passwords, authentication tokens, banking details, email OAuth credentials, actual document files, or the content of any emails in your inbox.
6. Payment Security
All payments are processed through PayFast, a PCI DSS Level 1 compliant gateway. SPAAN NOW never stores your credit card or banking details.
7. Security Measures
- HTTPS encryption on all pages and API endpoints
- Cloudflare DDoS protection and Web Application Firewall
- Password hashing using bcrypt
- AES-256-CBC encryption for OAuth tokens and sensitive credentials
- CSRF protection on all forms and API calls
- Rate limiting on authentication endpoints
- Session management with secure, HTTP-only cookies
8. Data Breach Protocol
In the event of a data breach, we will notify affected users within 72 hours as required by POPIA. If email credentials are affected, we will immediately invalidate all stored tokens and prompt affected users to reconnect. We will also notify the Information Regulator.
9. Contact Our Data Team
Email: legal@spaannow.co.za · Support: support@spaannow.co.za