Your CV is yours. Your data is too.

CV Chap Chap is an online CV builder and careers platform for job seekers in Tanzania, Kenya, Uganda and the wider region. In this policy, “CV Chap Chap”, “we”, “us” and “our” mean the business that operates cvchapchap.com from Dar es Salaam, Tanzania.

We are the data controller for the personal data described here, which means we decide why and how it is processed and we are accountable for it.

This policy covers:

• cvchapchap.com and its subdomains
• the CV builder, cover letter tools, ATS CV checker and CV upload
• our jobs board, employer accounts and the affiliate programme
• emails, SMS and WhatsApp messages we send you about the service

It does not cover websites we link to. When you apply for a job on an employer’s own site or applicant tracking system, that organisation becomes responsible for your data and its own privacy notice applies.

We process personal data in line with the Personal Data Protection Act, 2022 of the United Republic of Tanzania and its 2023 regulations, which are supervised by the Personal Data Protection Commission.

Where you use the service from another country, we also honour the rights given to you by your own data protection law, including Kenya’s Data Protection Act, 2019, Uganda’s Data Protection and Privacy Act, 2019, and equivalent laws elsewhere in the region. If your local law gives you stronger rights than this policy describes, those stronger rights apply.

We collect only what the service needs. Most of it is information you type in yourself.

CV and letter content

Your name, phone number, email address, location, optional photo, work history, education, skills, languages, certifications, links, achievements, and the names and contact details of any referees you add.

Account data

Email address, an encrypted form of your password (we never see the password itself), display name, optional phone number and sign-in activity.

Anonymous drafts

Before you sign in, your draft is kept in your browser’s local storage together with a random anonymous identifier, so your work survives a refresh or a dropped connection. It is not linked to your identity until you create an account.

Payment data

Amount, currency, the mobile money number or masked card reference used, the provider’s transaction reference and the payment status. We never receive or store your full card number, your card CVV or your mobile money PIN.

Uploaded documents

If you upload an existing CV, we read its text to fill in your details or to score it against ATS checks. We process the file in memory and do not keep the uploaded file itself.

Jobs and applications

Jobs you view or save, and any details you choose to send to an employer through the platform.

Employer data

For employer accounts: the name and work contact details of the person posting, and the organisation’s details. Employer contact details are restricted and are not exposed to the public board.

Affiliate data

Your name, the mobile money number you want to be paid on, referral clicks, confirmed sales and payout records.

Marketing sign-ups

A phone number, if you ask us to send you job alerts or career tips.

Technical data

IP address, device and browser type, pages viewed, referring page, country-level location derived from your IP, and cookie identifiers.

Support messages

What you send us by email, WhatsApp or phone, and our replies.

CVs in our region often include a date of birth, marital status, gender, nationality, religion, a photograph, or details about health or disability. Some of that is sensitive personal data under the Personal Data Protection Act, and it needs your explicit consent. You give that consent by choosing to type it into your CV.

We do not require sensitive data to provide the service, we do not use it to profile you, and we never share it with employers or advertisers. You can remove it from your CV at any time.

Referees: if you add someone else’s name and contact details, you are responsible for having told them and for having their agreement.

We must have a lawful basis for every use of your data. These are ours.

Run the service

Build, save, preview and render your CV or cover letter, and keep your drafts across devices. Basis: performance of our contract with you.

Take payment

Process a payment, unlock your download, issue a receipt and reconcile a payment that stalled. Basis: performance of our contract, plus our legal obligation to keep tax and accounting records.

AI suggestions

Generate a summary, job description, skills list, cover letter or ATS score at your request. Basis: performance of our contract.

Security and abuse prevention

Rate limiting, fraud checks on affiliate commissions, blocking automated abuse and protecting accounts. Basis: our legitimate interest in keeping the service safe and available.

Improve the product

Understand which pages and features are used so we can improve them. Basis: consent where a non-essential cookie is involved, otherwise our legitimate interest.

Job alerts and updates

Send you job openings, career tips or product news. Basis: your consent, which you can withdraw at any time.

Legal compliance

Meet tax, accounting and regulatory obligations, and respond to lawful requests from a competent authority. Basis: legal obligation.

When you ask for a professional summary, a job description, a skills suggestion, a cover letter or an ATS score, the text you submit for that request is sent to our AI provider so a response can be generated and returned to you.

• We do not sell your CV, and we do not share it with recruiters, employers or advertisers.
• We do not use your CV content to train AI models, our own or anyone else’s, and our AI provider is engaged on terms that do not permit training on data submitted through their interface.
• AI output is a suggestion. Nothing on our platform makes an automated decision that has a legal or similarly significant effect on you: we do not accept, reject, rank or score you for any job.
• The ATS checker analyses your own document and returns guidance to you only. Its score is never shared with an employer.

We do not sell your personal data. We share it only with the service providers who make the platform work, and only as far as each one needs.

Vercel

Website hosting, content delivery and performance measurement.

Supabase

Database and account authentication, where your saved CVs and account records are stored.

OpenAI

Generating AI suggestions and ATS analysis from text you submit for that purpose.

Payment partners

Snippe for mobile money and USSD payments, and a licensed card acquirer where card payment is offered. They receive the payment details needed to take the payment.

Resend

Sending transactional email such as download links, receipts and password resets.

Upstash

Short-lived rate limiting records used to block abuse.

Google, Meta and Ahrefs

Audience and advertising measurement through cookies and similar technologies. See the cookies section below.

We may also disclose data:

• to an employer, but only what you choose to send when you apply through the platform
• to our professional advisers, auditors or insurers, under a duty of confidentiality
• to a court, regulator or law enforcement body where we are legally required to do so, after checking that the request is valid
• to a buyer or successor if the business is sold or reorganised, in which case they are bound by this policy and we will tell you

Our hosting, database, email and AI providers operate outside Tanzania, so your data is processed abroad. Under the Personal Data Protection Act, a transfer of this kind needs appropriate safeguards or your consent.

Our safeguards are:

• written data protection terms with each provider that bind them to process data only on our instructions and to keep it secure
• encryption in transit and encryption at rest
• access limited to the smallest number of people who need it, with administrator actions recorded
• no onward transfer by a provider without equivalent protection

By creating a CV with us you understand and agree that your data is processed outside Tanzania on this basis. If you are not comfortable with that, please do not submit content to the service.

We keep personal data only for as long as we need it, then delete it or make it anonymous.

Draft in your browser

Until you clear it, or until your browser clears its storage. You control this from your own device.

Saved CVs and letters

For as long as your account is open. When you delete a CV we remove it from your account; residual copies in encrypted backups are overwritten within 30 days.

Account records

For as long as your account is open. If you ask us to close it, we delete or anonymise your data within 30 days, apart from records we are required to keep.

Payment records

At least five years, as required by Tanzanian tax and record keeping law. These records are financial, not CV content.

Uploaded CV files

Not retained. The text is read in memory to fill in your details and the file is discarded when the request finishes.

Support messages

Up to 24 months, so we can see the history of an issue.

Marketing sign-ups

Until you opt out, after which we keep only the record needed to honour your opt out.

Analytics data

For the retention period set by each measurement provider, typically up to 14 months.

We apply technical and organisational measures appropriate to the risk:

• encrypted connections (TLS) across the whole site, and encryption of stored data
• row level security on the database, so one account cannot read another account’s records
• passwords stored only in hashed form, never in plain text
• role-based administrator access, granted to the smallest set of people and reviewed
• rate limiting and abuse monitoring on sensitive endpoints
• payment card and PIN data handled entirely by licensed payment providers, never by us

No online service can promise perfect security. If a breach happens that is likely to put your rights at risk, we will notify the Personal Data Protection Commission and tell affected users without undue delay, explaining what happened and what to do about it.

In relation to your personal data you have the right to:

• be told what we hold and why, and receive a copy of it
• have inaccurate or incomplete information corrected, which you can do yourself in the builder at any time
• have your data deleted, where we do not have to keep it by law
• restrict or object to processing that relies on our legitimate interest
• withdraw consent at any time, including consent to marketing messages, without affecting anything done before you withdrew it
• receive your CV data in a portable form, which you can do yourself by downloading it
• complain to a supervisory authority

How to make a request

Email info@cvchapchap.com from the address on your account, or write to us at the address in the last section. We may ask you for proof of identity, which protects you from someone else making a request in your name.

We respond within 30 days. If a request is unusually complex we will tell you inside that period and explain how much longer we need. Requests are free. We only charge, or decline, where a request is clearly repetitive or excessive, and we will explain our reasons if that ever happens.

If you are not satisfied with our answer, you may complain to the Personal Data Protection Commission in Tanzania, or to the data protection authority in your own country.

Essential

These keep you signed in, protect the site against abuse, save your draft, and remember the country used to show you the right price and the referral code of an affiliate who sent you. The service cannot work without them.

Measurement and advertising

We use Google Analytics, the Meta pixel, Ahrefs Analytics, and Vercel Analytics and Speed Insights to understand how many people visit, which pages help them, and whether our advertising works. These providers set their own cookies and identifiers.

How to control them

• block or delete cookies in your browser settings, including third-party cookies specifically
• use your browser’s private or incognito mode
• reset or limit the advertising identifier in your phone’s privacy settings
• use Google’s and Meta’s own advertising controls to limit personalised advertising

Blocking measurement cookies does not affect your ability to build or download a CV. Blocking essential cookies will break sign-in and payment.

We send service messages you cannot opt out of while you have an account, such as a payment receipt, a download link, a password reset or an important notice about these terms.

We send job alerts, career tips and product news only where you asked for them or where you bought from us. You can stop them at any time by replying STOP to a message, using the unsubscribe link in an email, or emailing info@cvchapchap.com. We do not sell or rent your phone number or email address to anyone.

The service is intended for adults looking for work. Under Tanzanian law a child is a person under the age of 18.

If you are under 18, you may use CV Chap Chap only with the consent and supervision of a parent or guardian, and we may ask for evidence of that consent. We do not knowingly collect data from a child without it. If you believe a child has given us personal data without the right consent, contact info@cvchapchap.com and we will delete it.

Some listings are posted by employers with an account. Others are curated by us from publicly available sources, and link back to the employer’s own advertisement.

Most applications are made on the employer’s own site, their applicant tracking system, or by email. Once you leave CV Chap Chap, that organisation controls your data and its privacy notice applies, not ours. We do not receive a copy of what you send them.

We update this policy when the service or the law changes. The current version is always on this page with its “last updated” date.

Where a change materially affects your rights, we will give you notice by email or a clear notice on the site at least 14 days before it takes effect, unless the law requires the change sooner. Continuing to use the service after that date means the updated policy applies to you.

For any privacy question, a request about your data, or a complaint, contact us and we will deal with it properly.

Privacy and legal

info@cvchapchap.com

Account and payments

support@cvchapchap.com

Phone and WhatsApp

+255 682 152 148

Address

CV Chap Chap, Dar es Salaam, United Republic of Tanzania.

Supervisory authority

The Personal Data Protection Commission of Tanzania, or the data protection authority of your own country.

See also our Terms of Service, which govern your use of the platform.