Privacy Policy

Karii (karii.ai) is operated by RMexpertise Consultants (Pty) Ltd ("we", "us"), a company registered in South Africa with registration number 2011/002770/07. We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA). Our street address is D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130, and our postal address is D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130. Our Information Officer is Arend Cornelius de Waal (Director), and our Deputy Information Officer is Maryna Magdalena de Waal; both can be reached at privacy@karii.ai.

Most of what we hold, you give us. The rest comes from how you use Karii, from Paystack when you pay, from a programme’s code if you use one, and, for interview briefs, from public web pages (§3).

• Account details: your name, email address, and cellphone number (asked for only when our free-tier checks need it, to verify your account by SMS; we never call you or send marketing messages to it), plus the profile details you choose to give us: who you are (student, graduate, etc.), your country and whether you want a CV or a résumé, target role and preferred locations. When you sign up, we suggest a country from where your internet connection appears to be; we keep only the country you choose.
• Age confirmation: when you confirmed you are 18 or older, and which versions of our Terms of Use and this policy were in force then.
• Career content: the CV you upload or build, job descriptions you add, company reports you upload for a job, and your application statuses. A CV can hold sensitive details about you (§6) and details of other people, such as referees (§3).
• Sensitive details: we don’t ask for them, but a CV you upload may include some, such as an ID number, date of birth, race, gender, marital status, health or disability, religion or a criminal record. We use them only to run your CV features, with the consent you give before you upload a CV (accounts that uploaded earlier are asked when they next upload or keep a detail), and Kāi points out the ones it can find so you can remove or keep each one.
• Generated content: CV feedback, tailored CVs, cover letters, interview briefs, practice packs, and your conversations with Kāi.
• Mock interviews: your voice recordings, transcripts, scores and feedback.
• Payments: if you buy a pack or a credit, Paystack processes your payment. We keep none of your card details: for each payment we keep what you bought, the amount, whether it went through, when it was paid, how you paid (for example, by card) and the payment reference.
• Job searches: the words, place and category you search for in Find jobs, and how many listings came back, kept to improve search and to share the listings service fairly.
• Phone check steps: when you were asked to verify your number, opened the page, were sent a code and verified it, and the kind of problem when a step failed, and which check asked for it (never the number or the code), kept to see where people get stuck.
• Free-tier checks: a one-way hash of your email address and of your verified cellphone number, and of the network you connect from when you use a free monthly tool, kept so the free tools cannot be claimed many times over.
• Sponsored access: if a university, training programme or employer pays for your access with a code, we record which programme it was and when you used the code, and we measure your use of Karii for that programme’s reports: whether you have a CV in Karii, its readability score, how many applications and tailored CVs you made, how many reached an interview as you marked them, and how many mock interviews you completed and their scores, once around day 10 and once around day 95. The programme sees your name and one status (not activated, active or dormant) for up to 12 months after you use the code, and totals for the whole group, never shown for fewer than 10 people, except how many people used the code. It never sees your own CV, letters, applications, scores, recordings or messages.
• Problem reports: if you use Report a problem, your message, the page you were on, and your email address. Each report is also emailed to our support inbox, so we can reply.
• Records of your requests: when you exported your data or asked to change your sign-in email, and, if you delete your account, the record described in §10.
• Technical data: usage logs (which AI features, transcriptions, job and company searches and SMS codes ran for you, the country each SMS went to, and what they cost us to run) kept for capacity and abuse protection. Our hosting provider sees your network address with each request, and our sign-in provider may record it when you sign in; Karii’s own records never keep it.

This section is for someone who is not a Karii user but may appear in Karii.

People who run a company a user is interviewing with. What we hold: published information about a person’s professional role: their name, their job title at that company, the function they lead, and what the published source says about them in that role. We hold nothing about their private life or contact details, and no special categories such as health, race, religion, political or trade-union affiliation, sex life or criminal history. Where it comes from: publicly available web pages, found by search: the company’s own site, news coverage, and similar. We do not buy personal information, and we do not take it from social or professional networks. Why: so a candidate preparing for an interview knows who runs the organisation and where their role would sit. We rely on legitimate interests as the justification, on the basis that this is business-role information already published, narrowly scoped, and shown only to one person preparing for an interview at that organisation. Who sees it: only the user whose brief it is. To write the brief, the research is sent to our AI provider, Anthropic, in the United States (§8). It is not published, shared or sold, and it is never used to train AI models. How long: only for as long as that brief exists: it is deleted when the user deletes that job or their account. Where: at present we do this only for roles based in South Africa. Your rights: if you are named in a Karii brief you may ask what we hold, have it corrected, object to it, or have it removed. Email privacy@karii.ai and we respond within 30 days. If you object, we put your name, and the company if you give one, on a list that Karii checks before it lists anyone among the people in a brief, and take you out of the people listed in the briefs already made; we keep that list for as long as briefs name people, so the objection keeps working. You may also complain to the Information Regulator of South Africa (inforegulator.org.za; complaints: POPIAComplaints@inforegulator.org.za; phone: 010 023 5200; Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191; postal: P.O. Box 31533, Braamfontein, Johannesburg 2017).

People named in a CV or a job ad. A CV often names referees, with their job titles and contact details, and a job ad can name a recruiter. Users add these details themselves, and our Terms of Use ask them to have a referee’s agreement first. We use them only to prepare that user’s CV and applications, and we leave them out of what we send our AI provider for features that do not need them. They are deleted when the user deletes their account, or the CV or job they appear in; a CV tailored for a job keeps the referees it was given until that job is deleted. If you are named in someone’s CV, you can ask us what we hold about you at privacy@karii.ai.

POPIA allows us to process personal information only on a legal basis. Ours, for each use:

• Running Karii for you (your account, CVs, jobs and applications, briefs, mock interviews, Kāi, and payments for what you buy): it is necessary to provide the service you signed up for (section 11(1)(b)).
• Sensitive details in your CV (§6): your consent, given before Karii reads a CV you upload, or as §6 describes for accounts that uploaded earlier (section 27(1)(a)).
• Confirming you are 18 or older, and recording which Terms of Use and policy you accepted: our legitimate interest in keeping Karii for adults and in being able to show what you agreed to (section 11(1)(f)).
• Free-tier checks (the cellphone check, the one-way hashes, and the limit on programme-code attempts) and usage logs: our legitimate interest in keeping the free tools free for everyone, stopping abuse, and running Karii within its costs (section 11(1)(f)).
• Job searches and phone check steps: our legitimate interest in finding and fixing where search and the phone check fail people (section 11(1)(f)).
• Sponsored access: the legitimate interest of the programme paying for your access in knowing whether the access it paid for is used, and of Karii in reporting to it (section 11(1)(f)).
• Problem reports, records of your requests, and error monitoring: our legitimate interest in answering you, showing that we did what you asked, and keeping Karii working (section 11(1)(f)).
• People named in briefs (§3): legitimate interests (section 11(1)(f)).
• People named in a CV or a job ad (§3): the legitimate interest of the user, and of Karii, in preparing that user’s CV and applications (section 11(1)(f)).

Where we rely on legitimate interests, you may object (§11). Where we rely on your consent, you may withdraw it at any time; that does not affect what we did before.

We process your information to run Karii for you: scoring and improving your CV, tailoring applications, researching companies, running mock interviews, and powering Kāi. If a programme pays for your access, we also measure your use of Karii for its reports, as §2 describes under Sponsored access. We do not sell your personal information, show you ads, or share your data with recruiters or employers; a programme that pays for your access, which can be an employer, sees only what §2 describes. You apply to jobs yourself; Karii never submits anything on your behalf.

• To have an account: your email address (to sign in), your name, who you are (student, graduate, etc.), your country and, where we ask, whether you want a CV or a résumé, and your confirmation that you are 18 or older. Without these we cannot create your account.
• For most features: a CV, uploaded or built with Kāi. Without one, Karii cannot review, tailor or prepare you for a job; Home, Settings and Kāi still work.
• Optional: your target role and preferred locations, which shape the jobs Karii suggests.
• Only when a check asks: your cellphone number, before a free monthly tool. If you would rather not give it, you can use a credit or a pack instead, or leave that tool.
• Only if you buy something: your payment details, which you give to Paystack, not to us.
• No law requires you to give us any of this. We ask for it because you have asked us to provide Karii.

CVs often carry details that POPIA treats as special personal information, or that need extra care: an ID number, date of birth or age, race or population group, gender or sex, marital status, health or disability, religion, or a criminal record. A photo can show some of these too.

• Before your first CV upload, we ask your consent to process any such details your CVs hold, and record when you gave it. Accounts that uploaded a CV before we asked are asked when they next upload or keep a detail. Building a CV with Kāi asks for none of them, so it needs no consent.
• Kāi’s CV review looks for an ID number and for lines labelled with those details, lists what it found, and lets you remove each one from your CV in one tap, or keep it. It cannot see what a photo shows; if your CV has one, you can take it out and upload the CV again.
• What you keep is processed like the rest of your CV, including by our AI provider in the United States (§8), and is used only for your CV and applications.
• You can withdraw your consent at any time by emailing privacy@karii.ai, and Karii then asks again before it reads a CV you upload, or by deleting your account. Removing a detail takes it out of your current CV only: earlier CVs, and CVs already tailored for a job, keep it until you delete them or that job.

Karii’s reviews, documents, briefs, feedback and Kāi’s replies are written by AI. For each feature we send the content it needs (for example your CV and a job description, the transcript of a mock answer, or your message to Kāi) to Anthropic, and your recorded answers to Deepgram for speech-to-text, both in the United States (§8). Interview questions, feedback on your answers and interview briefs are written without your email address, phone number, referees or the sensitive details Kāi can find in your CV, and cover letters without your referees or those details. Tailored CVs are written without the sensitive details Kāi can find, except the ones you choose to keep.

We do not use your information to train AI models. Anthropic’s commercial terms do not allow it to train its models on what Karii sends, and every request Karii sends to Deepgram opts out of Deepgram’s model-improvement programme.

Your CV score and interview scores are advice for you. Karii makes no decision about you, and no one else sees your own scores.

We use a small set of service providers (POPIA "operators"), each only for the job named:

• Anthropic (AI analysis and generation: reading and reviewing your CV, tailoring it, writing cover letters, briefs and mock-interview questions and feedback, and Kāi’s replies). The content each feature needs: your CV (and, when Karii cannot read the text of a PDF, the file itself, with any photo in it), the job ads you add, research about the company (including any company report you upload), the transcripts of your mock answers, your messages to Kāi, and the profile details a feature uses, such as who you are, your target role, your country and your preferred locations. No account number or network address is attached. Where: United States. Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Deepgram (speech-to-text for mock interviews). The recording of each mock-interview answer. Every request opts out of Deepgram’s model-improvement programme, so Deepgram keeps it only as long as it needs to process the request. Where: United States. Sending it there is necessary to provide the service you asked us for (POPIA section 72(1)(c)).
• Twilio (one-time SMS verification codes). Your cellphone number, and the code you type back. Where: United States. Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Supabase (database, sign-in and file storage). Everything Karii stores about you, and your network address when your device reaches it directly: when you open a link we email you to sign in or to confirm a new email address, and when you download a file from your data export. Where: European Union (Germany). Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Vercel (hosting: every page and request passes through it). What you send to and see in Karii, as it passes through, and your network address with each request. Where: United States. Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Resend (email delivery: the sign-in and account emails we send you, and any report you send with Report a problem, which reaches our support inbox with your email address so we can reply). Your email address, and the text of any report you send, with the page you were on. Where: European Union (Ireland) and United States. Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Paystack (payment processing). Your email address, what you are buying and its price, and your Karii account number, so a payment reaches the right account. You give your card details to Paystack directly, on its checkout page. Where: South Africa and European Union (Ireland). Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Sentry (error monitoring). Technical error reports, and timing data from a sample of page loads. Personal-data collection is switched off, so no CV content, message content or account details are sent; an error or a sampled page load in your browser is reported from your device, so Sentry sees its network address, which we have told it not to store. Where: European Union (Germany). Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).
• Xneelo (our support and privacy mailboxes). Reports you send with Report a problem, with your email address and the page you were on, and anything you email us. Where: South Africa. It processes your information in South Africa.
• Google (Google Drive, part of Google Workspace, where we keep the company’s records of privacy requests, security compromises and marketing consents). If you make a request, an objection or a complaint about your personal information to us, our record of it: your name, how you reached us, what you asked and what we did, with any recording of the call if you made it by phone. If we have contacted you about Karii at your work: your name, role and work contact details, whether you agreed to hear from us or asked us not to contact you, and any reply you gave us, such as your email reply or a recording of the call. Where: any country where Google or the providers it uses have facilities. Our written agreement with it binds it to protect your information to a standard substantially similar to POPIA’s, including when it uses providers of its own (POPIA section 72(1)(a)).

Karii also asks these services for information, and sends them nothing that identifies you:

• Adzuna (United Kingdom): live job search. It receives only the words, place and category you search for, never your CV or who you are.
• Brave Search (United States): company research. It receives only company names, their web addresses and the job’s country, never a person’s name.

Information sent outside South Africa. Where a provider above processes your information outside South Africa, it goes there on the basis given for that provider. The European Union’s data-protection law gives protection substantially similar to POPIA’s. The United States has its own laws, and for providers there we rely on the basis given above rather than on its law.

Besides these providers, your information goes to a programme that pays for your access only as §2 describes, and to anyone else only where a law requires it or you ask us to.

Your account data is kept until you delete your account, or until you delete that part of it yourself. Mock-interview audio: 30 days. Uploaded CV files: 30 days after upload; the CV text Karii read from them stays with your account. Technical usage logs: 12 months, for capacity planning and abuse protection. Job searches: 12 months. Phone check steps: 12 months. Programme measurements (sponsored access): 12 months after each is taken. Free-tier network records: 48 hours. The listings a search returns are kept for up to a day, with nothing that identifies who searched, so the same search can be answered again without asking Adzuna. Failed attempts to use a programme code: counted for an hour to stop codes being guessed, with a one-way hash of the network they came from (never the address itself), then deleted by the next daily clean-up at the latest. Problem reports: the copy in Karii is deleted with your account; the email in our support inbox is deleted 12 months after it arrives.

Database backups are kept for 7 days, so anything deleted is gone from them within that time. When you delete your account we keep a record that it was deleted and when, with a one-way hash of your email address in place of the address, to show the deletion was done. We keep that record, and the dates of any exports you made and of any requests to change your sign-in email, with no end date; none of them holds your address or any of your content. Some free-tier records outlive the account, kept solely to stop the free monthly tools being claimed many times over: a one-way cryptographic hash of your verified cellphone number with its monthly free-tool counts, kept until the end of the following month; a one-way hash of your email address with its monthly counts, kept until the end of the following month; and a one-way hash of the network you used a free tool from, with the day and a one-way hash of your account, kept for up to 48 hours. The number itself is deleted with your account. Usage logs lose their link to you and are deleted at 12 months. Our service providers keep their own copies for their own periods, and Paystack keeps its own record of any payment. A programme that paid for your access keeps any report it already received from us.

Under POPIA you may ask whether we hold personal information about you and see it, have it corrected or deleted, object to how we use it, and withdraw any consent you gave. Exercising these rights is free.

• See it: Settings → Export everything downloads a complete copy of your data, with links to your stored files that work for an hour (up to five exports a day). If any part cannot be included, the export stops with an error instead of giving you part of it.
• Correct it: Settings → Account corrects your name, sign-in email, country, career stage, target role and preferred location; a verified cellphone number is changed or removed on request to privacy@karii.ai. For a new sign-in email, Karii emails a link to the new address and to your current one, and the change happens once you have opened both. You can also edit or replace your CV.
• Delete it: Settings → Data & privacy deletes parts of it on their own: an earlier CV (with its file, if Karii still keeps it), a mock interview with its recordings, your job-search history, and your Kāi conversations from earlier days. Delete a job with the bin icon on its row in Applications (or Delete job on its page), or your whole account in Settings → Delete my account, which removes everything except the records §10 says are kept.
• Object: where we rely on legitimate interests (§4), you may object at any time, and we stop unless the law allows us to carry on.
• Withdraw consent: for sensitive details in your CV, as §6 describes.

For anything else, or if you prefer, email privacy@karii.ai, write to us at D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130, or contact us in any other reasonable way. We may first ask you to confirm who you are, usually by replying from the email address on your account. We respond in writing within 30 days. If you are not satisfied, you may lodge a complaint with the Information Regulator of South Africa (inforegulator.org.za; complaints: POPIAComplaints@inforegulator.org.za; phone: 010 023 5200; Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg 2191; postal: P.O. Box 31533, Braamfontein, Johannesburg 2017).

All data is encrypted in transit (TLS) and at rest. Database row-level security ensures each account can only ever read its own data. Access to production systems is restricted. Card payments are made on the checkout page Paystack hosts, so your full card number never reaches our servers, and we keep none of your card details.

Karii’s own records never keep your network address. We keep a one-way hash made with a secret key instead of a network address, and instead of an email address or cellphone number where a record must outlive your account (§10). A hash like this cannot be turned back into the original, but someone who had the key could test guesses against it, so the key is kept secret, out of our code and our database.

If a security compromise affects your personal information, we will tell the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires.

Questions, requests and objections go to our Information Officer, Arend Cornelius de Waal, or our Deputy Information Officer, Maryna Magdalena de Waal, at privacy@karii.ai or by post to D'Stellen Estate No. 20, Bredell Rd, Cape Town, 7130. Our PAIA manual describes the records we hold and how to ask for them.