Privacy Policy

1. Information we collect

• Account details — your name, email, and password (or, if you sign in with Google, your name, email, and profile photo). Passwords are hashed and never stored in plain text.
• CV content — anything you put into the CV builder: your name, contact details, work history, education, skills, languages, certifications, a headshot photo, and any job description you paste in for tailoring.
• Uploaded documents — an existing CV or job advert you upload to have it read and pre-filled automatically.
• Payment details — we never see or store your card number, M-Pesa PIN, or CVV. Payments are handled entirely by M-Pesa (Safaricom) and Paystack; we only receive confirmation that a payment succeeded or failed, plus a reference number.
• Design requests and contact messages — whatever you tell us in the "Request a quote" and "Contact" forms, plus any reference files you attach.
• Basic technical data — standard web server logs (IP address, browser type) and session cookies needed to keep you logged in and forms secure.

2. How we use it

We use your data to:

• Create and run your account, and let you build, edit, and download your CV.
• Generate CV content (summaries, bullet points, an ATS match score) using the Claude API, and clean up your CV photo using remove.bg — see "Third parties" below.
• Process payments for CV downloads, software, and courses via M-Pesa and Paystack.
• Respond to design requests, contact messages, and support questions.
• Keep the platform secure — rate-limiting abusive requests, detecting fraud, and enforcing our Terms of Use.

We do not sell your personal data to anyone, for any reason.

3. Third parties we use

A few specific pieces of your data are shared with the specialist services that make each feature work, and only for that purpose:

• Anthropic (Claude API) — your CV text and any job description are sent to Claude to generate summaries, rewrite bullets, score ATS matches, and read documents you upload. Claude does not train on this data under Anthropic's API terms.
• remove.bg — your CV photo is sent to remove.bg to clean up the background, and nothing else.
• Safaricom Daraja (M-Pesa) and Paystack — process your payment; we only receive a success/failure result and reference number, never your PIN or full card number.
• Google — if you choose "Sign in with Google", we receive your name, email, and profile photo from Google's own consent screen.
• Our email provider — used only to send you account, order, and notification emails.

4. eCitizen & KRA facilitation services

If you ask us to help with an eCitizen or KRA errand (a passport, ID replacement, business registration, KRA PIN, and so on), that application still happens on the government's own eCitizen or iTax platform, under your own account and your own payment. We are not part of, and do not receive data from, those government systems — we only see what you choose to tell us directly (over the phone, in person, or via our contact form) to help you prepare.

5. Cookies

We use a session cookie to keep you logged in and a CSRF token cookie to protect forms from cross-site attacks — both are strictly functional and expire when appropriate. We don't use third-party advertising or tracking cookies.

6. How we protect your data

CV documents, uploaded files, and design-request attachments are stored privately and are never publicly listed or guessable — they're only ever served to you after we confirm you're the owner. Passwords are hashed, not stored as plain text. Admin access is restricted to a small number of authorized accounts. In production, the platform is served over HTTPS.

7. Data retention

We keep your account and CV data for as long as your account is active. If you delete your account or ask us to remove your data, we'll delete it, except where we're required to keep payment or transaction records for accounting or legal reasons.

8. Your rights

Under Kenya's Data Protection Act, 2019, you have the right to know what data we hold about you, to access and correct it, to ask us to delete it, to object to certain processing, and to receive a copy of it in a portable format. To exercise any of these rights, email biasharacontinent@gmail.com. If you're unsatisfied with our response, you can also complain to Kenya's Office of the Data Protection Commissioner (ODPC).

9. Children

This platform is intended for job seekers, business owners, and students old enough to enter into their own agreements. We don't knowingly collect data from children under 18 without a parent or guardian's involvement.

10. Changes to this policy

If we make a material change to how we handle your data, we'll update the date at the top of this page. Continuing to use the platform after a change means you accept the updated policy.

11. Contact us

Questions about this policy or your data: biasharacontinent@gmail.com.