Privacy Policy

1. Summary

Sebenza AI holds some of the most sensitive documents you own — your resume, work history, offers and messages. This policy explains what we collect, why, who can see it, and the controls you have.

The short version: your career data is visible only to you, plus the people you deliberately share it with. We never sell it, and the AI never sends anything to an employer without your approval.

2. Who we are

Sebenza AI — whose legal business name is "Sebenza AI" — is the seller of this service and the data controller for personal data processed through it. You can reach us at privacy@sebenzaai.app or through in-app support.

If you purchase a paid plan, payments are processed by our payment partner, which acts as Merchant of Record for the order and is named at checkout before you pay. The payment partner collects and processes billing data (such as payment card details and billing address) under its own privacy terms; Sebenza AI does not see or store your card details.

3. What we collect

Account details: your name, email address and sign-in credentials.

Career data: what you add or upload — resumes and documents, work history, skills, education, achievements, goals, job preferences and your chosen countries and cities.

Activity data: saved roles, applications, interview preparations, agent permissions and the audit log of actions taken in your account.

Recruiter data (recruiter accounts): company name, work email, website and job listings you post.

Technical data: sign-in events, and a record of AI usage (which feature, token counts, success or failure) so costs and reliability can be audited. We do not run advertising trackers.

4. Why we use it — and the legal basis

To provide the service: build your career profile, discover matching jobs, prepare applications, power mock interviews and give career guidance. Legal basis: performance of our contract with you.

To keep the service safe and honest: independently assess job listings for quality and risk, moderate content, prevent fraud and abuse, and keep an audit trail. Legal basis: our legitimate interests in a safe, trustworthy service.

To communicate with you: sign-in emails, security notices, and status of your applications. Legal basis: contract performance. We will not send marketing emails unless you ask for them; where we do, the legal basis is your consent, which you can withdraw at any time.

To meet legal obligations: keeping basic billing and audit records where the law requires it. Legal basis: legal obligation.

5. AI processing

Sebenza AI uses AI models to draft, score and summarise. Your career data is sent to these models only to perform the feature you are using, through a managed gateway with contracts in place.

External content — job adverts, recruiter messages, uploaded PDFs — is treated as untrusted data, never as instructions, to defend against prompt injection.

Consequential actions (submitting an application, emailing a recruiter, confirming an interview) always wait behind your explicit approval. The AI proposes; you decide.

6. Who can see your data

You: your career profile, documents, applications and settings are readable only by your account. This is enforced with row-level access control in the database, not just in the app.

People you share with: an employer sees only what you submit with an application you approved. Recruiters see candidate information only where the candidate submitted it or explicitly opted in to discovery, and candidates can withdraw at any time.

Sebenza AI staff: only as needed to operate, moderate and support the service, and admins can see that a listing or company needs moderation — not your private career data.

Service providers: hosting, authentication, email delivery and AI providers, under contract, only to run the service. We do not sell personal data to anyone.

Payment processors: when you buy a paid plan, our payment partner (named at checkout before you pay) receives the billing data needed to process your payment, manage your subscription, handle tax compliance and invoicing, and process refunds.

Professional advisers and authorities: legal or accounting advisers where needed, and authorities where the law requires it.

7. Security

Data in transit and at rest is encrypted. Access to your rows is controlled at the database level per account.

Documents you upload are stored privately and are never publicly accessible.

Agent permissions are enforced outside the AI model, so a model error can never grant access you did not allow.

Every consequential action is logged, so you can audit what was done and when.

8. How long we keep it

Your career data and documents: until you delete them or close your account.

Account records: deleted or anonymised after account closure, except records we must keep by law — for example, basic billing or audit records.

Audit logs: kept for a reasonable period so account activity can be reviewed, then deleted.

9. Your rights and controls

You can export or delete your data, revoke any agent permission, and delete your account at any time from Settings.

You can correct anything in your career profile — nothing is locked away from you.

You can object to processing or ask us to restrict it; contact privacy@sebenzaai.app and we will respond within a reasonable time.

If you are in the EU or UK, you also have the right to complain to your local data protection authority.

10. Children

Sebenza AI is not intended for children under 18. We do not knowingly collect their data; if we learn we have, we will delete it.

11. Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect.