Privacy Policy

Effective date: 1 January 2025  •  Last updated: March 6, 2026

This Privacy Policy explains how SmartCV Tanzania, operated by Dragonfinity Systems ("we", "us", "our"), collects, uses, stores, and protects your personal data when you use our website at smartcv.dragonfinitysystems.com. We are committed to protecting your privacy and handling your data responsibly.

1. Data We Collect

Data Type	What We Collect	Why
Account data	Email address, name, phone number	To create and manage your account, send login OTPs
CV content	Work history, education, skills, profile photo, summary	To generate your CV and provide AI-assisted services
Payment data	Transaction reference, amount, payment status	To verify and record payments; card/mobile details are handled by Selcom, not us
Uploaded files	CV files uploaded to the recruiter portal (PDF/DOCX)	To extract text for AI-powered candidate ranking
Usage data	IP address, browser type, pages visited, timestamps	Rate limiting, security, and error logging
Free CV check	Uploaded CV (temporary), IP address	To score the CV with AI; file is never stored, only read in memory

2. How We Use Your Data

• Delivering the services you request (CV generation, AI rewriting, recruiter ranking)
• Sending one-time login codes to your email
• Processing and verifying payments via Selcom
• Improving our AI prompts and service quality (aggregated, not personally identifiable)
• Enforcing rate limits and preventing abuse
• Responding to your support enquiries

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. AI Processing

Portions of your CV content are sent to the Anthropic Claude API for AI-assisted rewriting, scoring, and optimization. Anthropic processes this data in accordance with their own privacy policy and API usage terms. We send only the minimum data required for each task and do not store raw AI inputs or outputs beyond what is necessary to deliver the service to you.

4. Data Retention

• Free CV check: Your uploaded file is never saved — it is processed from temporary memory and discarded immediately.
• Job seeker CVs: Stored securely in our database while your account is active. You may delete them at any time from your dashboard.
• Recruiter candidate files: Retained according to your package (Basic: deleted immediately after processing; Standard: 30 days; Professional: 60 days; Quarterly: 90 days). Files are automatically purged by our scheduled cleanup process.
• Payment records: Retained for 7 years as required by Tanzanian financial regulations.
• Login OTP codes: Expire after 10 minutes and are permanently marked as used.

5. Data Security

We implement the following security measures to protect your data:

• All data transmitted over HTTPS (TLS encryption)
• Uploaded files stored outside the public web root, not directly accessible via URL
• CSRF tokens on all forms to prevent cross-site request forgery
• HMAC-SHA256 signature verification on all payment webhooks
• Passwords are not used — OTP-only authentication reduces credential exposure
• CV files served only via signed, time-limited tokens

6. Cookies and Sessions

We use a single session cookie to maintain your login state. We do not use tracking cookies, advertising cookies, or third-party analytics. The session cookie is deleted when you log out or your browser session ends.

7. Third-Party Services

Service	Purpose	Data Shared
Selcom	Payment processing	Name, email, phone, transaction amount
Anthropic Claude	AI text generation and scoring	CV text content (no names/emails sent unless part of the CV body)
SMTP mail server	Sending OTP login codes	Your email address and the OTP code

8. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Update inaccurate data in your account or CV
• Deletion: Request deletion of your account and all associated data
• Portability: Export your CV data from your dashboard at any time
• Objection: Object to processing of your data for purposes beyond service delivery

To exercise any of these rights, email us at support@smartcv.dragonfinitysystems.com. We will respond within 14 working days.

9. Children's Privacy

Our Service is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above. Material changes will be communicated via email or a notice on the site. Continued use of the Service after the effective date constitutes acceptance of the updated policy.

11. Contact

For privacy enquiries, data requests, or concerns, contact us at:
Email: support@smartcv.dragonfinitysystems.com
Website: smartcv.dragonfinitysystems.com
Operator: Dragonfinity Systems, Tanzania