This Privacy Policy explains how STM Analytics ("we", "us" or "our"), a South African software engineering company, handles personal information when you visit our website, contact us about a project, or use our products, such as the STM CV Builder (together, the "Service").

We are the responsible party for this information under the Protection of Personal Information Act, 2013 (POPIA). We process it lawfully, only for the purposes below, and we keep it to what we need. This policy forms part of our Terms of Service.

1.1 Information you give us:

• Enquiries: your name, email address, phone number, company, the service you're interested in, an optional budget range and your message, when you use our contact form or email us.
• Account information: your name, email address and password when you register.
• Profile information: a profile photo and any other details you add to your account.
• CV data: your contact details, work experience, education, skills, achievements and references, and any photo you add to your CV.
• Draft CVs: if you build a CV before signing in, it is stored against a random identifier kept in a secure cookie on your device, and moved into your account when you sign in. Unclaimed drafts are deleted after 30 days of inactivity.
• Reviews: the review you write about the CV builder. Reviews are published with your first name and initial only.
• Payments and contributions: when you buy Premium templates or make a contribution, PayFast processes the payment. We receive the amount, status and payment references, never your card details. If you contribute without an account, we also keep the email address (and optional name) you give us so that we can send your receipt. Your first name and initial appear on our supporters list only if you choose that.

1.2 Information collected automatically:

• Log data: your IP address, browser type, the pages you visit, and the date and time of your visit.
• Device information: the type of device and operating system you use. We keep the IP address and browser of contact-form submissions to prevent spam and abuse.

1.3 Information from social sign-in:

If you sign in with Google or Facebook, we receive your name, email address and profile picture, as allowed by your privacy settings on that platform. We never receive your password for those accounts.

We use your personal information to:

• Respond to project enquiries, prepare proposals and manage our relationships with clients.
• Provide, maintain, secure and improve the Service.
• Create and manage your account.
• Build, store and deliver your CV documents.
• Fill in or improve your CV when you use CV import or writing help.
• Process payments, unlock purchases and send receipts.
• Show reviews and supporters' names, only in the ways described above.
• Send you service messages, such as email verification and receipts.
• Detect and prevent fraud, spam and unauthorised access.
• Comply with our legal, tax and accounting obligations.

We do not sell, rent or trade your personal information, and we only send you marketing emails if you have asked to receive them.

When we build, host or support software for a client, we may handle personal information on that client's behalf, such as the details of their customers or employees in a system we maintain. In that role we act as an operator under POPIA. We process that information only on the client's instructions and under our agreement with them, keep it confidential and secure, and do not use it for our own purposes. The client's own privacy policy explains how they use it.

We only share personal information:

• With service providers who help us run the Service, such as hosting, email delivery, payment processing and AI providers. They may use it only to provide their service to us and must keep it secure.
• When the law requires it, for example under a court order or a request from a government authority.
• To protect the rights, property or safety of STM Analytics, our users, our clients or the public.

Cross-border transfers: some of our providers store or process information outside South Africa. We only use providers who protect personal information to a standard comparable to POPIA, as section 72 of POPIA requires.

• Account and CV data: for as long as your account is active. You can delete your account from your profile page at any time.
• Unclaimed draft CVs: deleted after 30 days of inactivity.
• Enquiries: for as long as we need them to respond and to manage any project or relationship that follows.
• Payment records: for as long as tax and accounting law requires, generally five years.

We protect personal information with industry-standard measures, including encrypted connections (HTTPS), hashed passwords, access controls with least privilege, and verified, audited payment processing.

No method of sending or storing information over the internet is 100% secure, so we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the Information Regulator as POPIA requires.

We use essential session cookies to keep you signed in, and a secure draft cookie that links a CV you build before signing in to your device. Favourites you save while signed out are kept in your browser's local storage. None of these track you across other websites.

You can set your browser to refuse cookies, but parts of the Service, such as signing in and guest drafts, will then not work.

The Service uses the following third-party services, which handle your information under their own privacy policies:

• Google and Facebook for sign-in.
• Google Maps, embedded on our contact page to show our address. Google may set its own cookies when the map loads.
• PayFast for payment processing.
• Amazon Web Services for email delivery.
• Anthropic (Claude) for AI processing of CV text, only when you upload a CV or ask for writing help. The text is used to produce your result and for nothing else.
• Our hosting provider, which runs our servers and databases.

We encourage you to read the privacy policies of these services.

Under POPIA you have the right to:

• Access the personal information we hold about you.
• Correct personal information that is inaccurate or incomplete.
• Delete your account and personal information, subject to records we must keep by law.
• Object to the processing of your personal information in certain circumstances, including for direct marketing.
• Complain to the Information Regulator of South Africa (inforegulator.org.za) if you believe we have not handled your information properly.

To exercise any of these rights, email us at stmanalyticss@gmail.com.

The Service is intended for adults. Under POPIA a child is anyone under 18. If you are under 18, please use the Service only with the consent of a parent or guardian. If you believe a child has given us personal information without that consent, contact us and we will delete it.

We may update this policy from time to time. When we do, we will post the updated version here with a new "Last Updated" date, and tell you about significant changes. By continuing to use the Service after a change, you accept the updated policy.

If you have questions about this policy or how we handle your information, contact our Information Officer at stmanalyticss@gmail.com or use our contact page.

Postal address: STM Analytics, 13 Casava Street, Soweto, Protea Glen, Gauteng, 1819, South Africa.