How we handle your data.

Who we are

Cited is a CV scoring service operated as part of CareerForge, based in Durban, South Africa. We are subject to the Protection of Personal Information Act (POPIA). The information officer is the registered business owner; for any data-related questions or requests, contact hello@cited.co.za.

What we collect

When you run a free scan, we collect:

• Your CV file (PDF or Word document)
• Your email address
• The job description text, if you paste one in
• Your IP address and browser user agent (for security and to prove consent)

When you pay for an upgrade, PayFast (our payment processor) additionally collects card and contact details to process the transaction. We don't see or store your card number — only PayFast's confirmation that the payment succeeded, plus the cell number you provided to PayFast (used only for transactional messages about your order).

Why we collect it

Your CV and email are needed to perform the service you asked for — running the scan, showing you results, and letting you retrieve or upgrade later. That's a contractual lawful basis under POPIA.

If you tick the marketing-email box, we use your email to send tips and product updates. That's a separate consent-based lawful basis. You can withdraw it any time using the unsubscribe link in any email, or by emailing us.

How long we keep it

• Your CV file: 30 days, then permanently deleted.
• Scan record (score, issues, no CV text): kept indefinitely for our analytics, but no longer linked to your CV after the 30-day window.
• Email address: kept while you have an active marketing consent, plus a permanent record of when you granted and withdrew consent (POPIA requires this audit trail).
• Payment records: kept for 7 years per SARS requirements.

Who we share it with

We share data only with service providers required to deliver the service: PayFast (payments) and our hosting provider Replit (infrastructure). We don't sell, rent, or share your data with marketers or advertisers. We never share CV content with anyone.

Your rights

Under POPIA you can ask us to:

• Show you what data we hold about you
• Correct anything that's wrong
• Delete your data (subject to the SARS retention requirement above for paid orders)
• Withdraw your consent for marketing emails
• Lodge a complaint with the SA Information Regulator at inforegulator.org.za if you think we've handled your data badly

Email hello@cited.co.za with any of these requests. We aim to respond within 7 business days.

Unsubscribing from marketing emails

Every marketing email contains a one-click unsubscribe link. You can also email us, or visit /unsubscribe directly. Unsubscribe is permanent within 24 hours and we keep an audit record of when it happened.

Changes to this policy

If we update this policy in a way that materially affects your rights, we'll email everyone with active marketing consent. Minor wording changes get a date update at the top of this page.