Privacy Policy
What we collect, why, who else sees it, and how to get it back or get rid of it.
Version 1 · In effect from 7 August 2026
The short version
You give us your CV so we can turn it into something an employer can verify. To do that we send it to services outside South Africa, including AI services that read it and interview you. We publish only what you choose to publish. You can take an export or delete everything, at any time, without asking us.
Who is responsible for your information
The responsible party is CVFIDE (Pty) Ltd (registration number 2026/627961/07), trading as CVfide, of Unit UG09, Nobel Park, Bellville, 7535, South Africa.
Our Information Officer is Pierre Malan, reachable at admin@cvfide.com. The office is registered with the Information Regulator under reference 2026-063907.
What we collect, and where it comes from
| What | Where it comes from |
|---|---|
| Your name, email address and password | You, when you create an account |
| Your CV document, and everything in it | You, when you upload it. It is read once and then discarded — see the note below. |
| The structured version of your CV | Produced by an AI service reading your document, then corrected by you. This is what we keep. |
| Your photograph | You, or generated from photographs you supply |
| Interview recordings, transcripts and scorecards | Video and audio are recorded on our servers while you are interviewed. A copy of each spoken answer is transcribed automatically, and you see the text before it is used. |
| Payment records | Paystack, when you pay. We never receive your card number. |
| Who opened your profile, when, and roughly where from | Collected automatically when someone visits your public link |
| Your IP address and browser details at the moment you consent | Collected automatically, as evidence that the consent is genuine |
We also deliberately do not extract your identity number or street address into that structured version, and the parser refuses any location value that looks like a street address. If you spot something in your profile you would rather we did not hold, delete it there and it is gone.
Why we process it
- To build your profile and keep it available at a public web address.
- To conduct your interview, transcribe it, and produce feedback.
- To prove that a recording is genuine — this is the point of the product, and it is why recording happens on our servers rather than on your device.
- To take payment and keep the tax records the law requires.
- To tell you who has viewed your profile.
- To keep the service secure and to investigate abuse.
Providing this information is voluntary. It is also unavoidable if you want the service: we cannot build a CV we have not been given, and we cannot verify an interview that did not happen. If you decline, the consequence is simply that we cannot deliver the service.
Information that gets special treatment
POPIA treats some categories as special personal information, needing specific authorisation rather than ordinary consent. Two are relevant here.
- Your face and voice. A recording of you is biometric-adjacent, and we ask for separate, explicit consent immediately before the first recording — not bundled into these terms, and not weeks in advance at sign-up.
- Criminal and credit information. We do not currently offer these checks. When we do, each will have its own consent screen, and credit checks will be available only where the role genuinely involves handling cash or finances — the National Credit Act does not permit them otherwise, even with your consent.
Who else sees it
We do not sell your personal information, and we do not share it with employers or recruiters. The only people who see your profile are the people you send the link to.
We do rely on the following operators to run the service. Each processes your information only on our instructions.
| Operator | What for | Where |
|---|---|---|
| Supabase | Database, authentication and file storageAccount details, CV content, uploaded documents, recordings | United Kingdom (London) |
| Vercel | Application hosting and content deliveryRequest metadata, IP addresses | United States, with global edge delivery |
| Anthropic | Reading uploaded CVs into structured data, and conducting the interviewCV content, interview questions and answers | United States |
| Paystack | Card and EFT payment processingName, email, payment amount. Card details go to Paystack directly and never reach us. | South Africa and Nigeria |
| LiveKit | Carrying and recording the live interviewLive audio and video during an interview | European Union |
| Deepgram | Turning spoken interview answers into textA copy of the audio of each spoken answer, sent as it is given and not stored by us | United States |
| Replicate | Removing the background from one frame of the interview recording to make the professional headshotA single still frame of the candidate's face from the live interview recording, sent for processing and not retained by them beyond the request | United States |
Your information leaves South Africa
It does, and we would rather say so plainly than bury it. Your CV is stored in the United Kingdom, read by an AI service in the United States, and your interview is carried by servers in the European Union.
Section 72 of POPIA permits this where the recipient is subject to a law or binding agreement providing protection substantially similar to POPIA’s own principles. We rely on that, together with a data processing agreement with each operator. South Africa has no data localisation requirement, and there is currently no South African region available for the infrastructure this service runs on.
Artificial intelligence, and what it is not used for
AI reads your CV into a structured form, conducts your interview, and drafts your feedback. Your CV content and your interview answers are sent to Anthropic for those purposes. They are not used to train AI models.
AI is never used to generate video or audio of you. Every recording on a CVfide profile is a real recording of a real person, captured live. That is the entire basis of the verification badge, and we would have no product without it.
No decision with a legal or similarly significant effect on you is made automatically. Your interview scorecard is feedback for you; we do not screen you, rank you against anyone, or pass a score to an employer.
How long we keep it
| Category | Kept for | Why |
|---|---|---|
| The CV file you upload | Not kept at all | It is read once to extract your history and then discarded. We never write it to storage. |
| The structured version of your CV | While the account is open, then 30 days | This is what your profile is built from, and what you can edit. |
| Published profile content | 30 days after the subscription lapses | A grace period so a lapsed payment does not destroy your work. |
| Interview recordings (full session) | Deleted once the answers you chose have been cut from it | We have no reason to hold twenty minutes of your face including the parts you chose not to publish. |
| Identity documents | 90 days from verification | Long enough to resolve a dispute about the check, and no longer. |
| Consent records | Life of the account, plus 3 years | A consent record is evidence that processing was lawful. Deleting it would remove the proof, not the processing. |
| Payment records | 5 years | Required by South African tax law. |
Your rights
- See what we hold. Take a complete export of your information from your dashboard, in a machine-readable form, without asking us.
- Correct it. Everything we read out of your CV is editable, and we would rather you fixed it than lived with it.
- Delete it. Delete your account from your dashboard. This removes your profile, recordings, transcripts and uploaded documents. We keep payment records where tax law requires it, and consent records as evidence that past processing was lawful.
- Withdraw consent. At any time. This ends the service, and does not undo processing that already lawfully happened.
- Object. To processing you think we should not be doing, at admin@cvfide.com.
- Complain. To us first, we hope — but to the Regulator whenever you like.
Once you have shared your public link, we cannot recall copies other people have already saved or forwarded. Unpublishing removes the page; it does not reach into someone’s downloads folder.
How we protect it
- Encrypted in transit and at rest.
- Row-level security on every table in our database, default deny — one account cannot reach another's data even if the application has a bug.
- No public media URLs. Video and documents are served through short-lived signed links.
- Identity documents, when we hold them, live in a separate encrypted store on a shorter deletion clock.
If a breach affects your personal information, we will notify you and the Regulator as POPIA requires.
Children
CVfide is for people of working age and you must be 18 or older to create an account. We do not knowingly hold information about children, and will delete it if we find we have.
Changes
This is version 1. If we change it materially we will tell you before the change takes effect, and where the change alters what you consented to, we will ask again rather than assume.
Complaints
Start with admin@cvfide.com. If we do not resolve it, you may complain to the Information Regulator (South Africa):
Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
010 023 5200 · Toll free 0800 017 160
See also our Terms of Service and the Media and Publication Licence.