The short version: your CV and career data are used for one thing — helping you land a job. We never sell your data, never use it to train AI models, and never send an application on your behalf. Voice recordings self-delete after 30 days. You can export or delete everything from Settings, any time.
Karii (karii.ai) is operated by RMexpertise Consultants (Pty) Ltd ("we", "us"), a company registered in South Africa. We are the responsible party for your personal information under the Protection of Personal Information Act, 2013 (POPIA). Our Information Officer can be reached at privacy@karii.ai.
Account details: your name, email address, and cellphone number (used once to verify your account by SMS), plus the profile details you choose to give us — who you are (student, graduate, etc.), institution, graduation year, target role and preferred locations. Career content: the CV you upload or build, job descriptions you add, and your application statuses. Generated content: CV feedback, tailored CVs, cover letters, interview briefs, practice packs, and your conversations with Kāi. Mock interviews: your voice recordings, transcripts, and feedback. Payments: if you buy a pack, Paystack processes your card — we never see or store card details; we keep only your plan status and payment reference. Technical data: usage logs (which AI features you used and what they cost us to run) kept for capacity and abuse protection.
This section is for someone who is not a Karii user but may appear in Karii: the people who run a company one of our users is interviewing with. What we hold: published information about a person’s professional role — their name, their job title at that company, the function they lead, and what the published source says about them in that role. We hold nothing about their private life or contact details, and no special categories such as health, race, religion, political or trade-union affiliation, sex life or criminal history. Where it comes from: publicly available web pages, found by search — the company’s own site, news coverage, and similar. We do not buy personal information, and we do not take it from social or professional networks. Why: so a candidate preparing for an interview knows who runs the organisation and where their role would sit. We rely on legitimate interests as the justification, on the basis that this is business-role information already published, narrowly scoped, and shown only to one person preparing for an interview at that organisation. Who sees it: only the user whose brief it is; it is not published, shared or sold, and it is never used to train AI models. How long: only for as long as that brief exists — it is deleted when the user deletes that job or their account. Where: at present we do this only for roles based in South Africa. Your rights: if you are named in a Karii brief you may ask what we hold, have it corrected, object to it, or have it removed — email privacy@karii.ai and we respond within 30 days. You may also complain to the Information Regulator of South Africa (inforeg.org.za).
We process your information for one purpose: to run Karii for you — scoring and improving your CV, tailoring applications, researching companies, running mock interviews, and powering Kāi. We do not sell your personal information, show you ads, or share your data with recruiters or employers. You apply to jobs yourself; Karii never submits anything on your behalf.
Karii sends the content needed for each feature (for example your CV text and a job description) to the AI providers listed below to generate your results. Your information is never used to train AI models — not by us, and our provider agreements do not permit our data to be used for training.
We use a small set of service providers (POPIA "operators"), each only for the job named: Anthropic (AI analysis and generation, USA); Deepgram (speech-to-text for mock interviews, USA); Twilio (one-time SMS verification codes, USA); Supabase (database and file storage); Vercel (hosting); Resend (sending sign-in and account emails); Paystack (payment processing, South Africa); Adzuna (live job search — receives only your search terms, never your CV); Brave Search (company research — receives only company names); Sentry (error monitoring, EU — receives technical error reports only; personal-data collection is switched off, so no CV content, message content or account details are sent). Some of these providers process data outside South Africa; where they do, the transfer is protected by contractual safeguards consistent with section 72 of POPIA.
Raw audio from mock interviews is automatically deleted 30 days after recording. Transcripts and feedback are kept with your account so you can track your progress. Deleting your account removes recordings, transcripts, and feedback immediately.
Under POPIA you may access, correct, or delete your personal information, and object to processing. In the app: Settings → Export everything downloads a complete copy of your data, and Settings → Delete my account permanently removes your account and all associated data. For anything else, email privacy@karii.ai — we respond within 30 days. If you are not satisfied, you may lodge a complaint with the Information Regulator of South Africa (inforeg.org.za).
Your account data is kept until you delete your account. Mock-interview audio: 30 days. Technical usage logs: 12 months, for capacity planning and abuse protection. Backups expire on a rolling schedule after deletion. One exception survives deletion: a one-way cryptographic hash of your verified cellphone number, kept solely to prevent abuse of the free tier (one set of free monthly tools per person). The number itself is deleted with your account, and the hash cannot be turned back into your number.
Karii is used across every career stage, from matric scholars to senior executives, so some users may be under 18. If you are under 18, you may only use Karii with the consent of a parent or guardian, and they may exercise your POPIA rights on your behalf.
Karii uses only the essential cookies required to keep you signed in. We do not use advertising or cross-site tracking cookies.
All data is encrypted in transit (TLS) and at rest. Database row-level security ensures each account can only ever read its own data. Access to production systems is restricted, and payment card data never touches our servers.
If we make material changes to this policy, we will tell you in the app or by email before they take effect. Questions: privacy@karii.ai.