npm run check:legal.)Data Retention & Deletion
Version 1.0 · Last updated: 30 September 2026
We keep personal data only for as long as we need it for the purposes in our Privacy Policy, and then delete it or make it anonymous (the storage-limitation principle in the Data Protection Act, 2019). This page states the periods and how deletion works.
1. How long we keep each kind of data
| Data | How long | Then |
|---|---|---|
| Account, profile, CV files and extracted CV text, preferences, saved jobs, applications, cover letters, application answers, fit analyses, test results, notification settings | While your account is active | Deleted when you delete your account (section 2) |
| Gmail connection and tokens | Until you disconnect Gmail or delete your account | Access is revoked with Google and tokens deleted. Employer-reply records (sender, subject, snippet) already matched to your applications stay in your application timeline until you delete your account. |
| Job listings (public data collected from job boards) | Until the listing expires | Expired listings are removed automatically |
| Payment records (amount, date, M-Pesa receipt number, plan/pack) | 7 years from the transaction | When your account is deleted these records are kept only in de-identified form: they are unlinked from your account and your phone number is masked. Kept because tax and company law require us to keep accounting records. |
| Security and operational logs, error alerts, automation run statistics, AI-usage log | 90 days | Deleted automatically each day |
| In-app activity events (first-party analytics; no third-party trackers) | 12 months | Deleted automatically each day; also deleted with your account |
| Reports you make about job listings | While your account is active | Deleted with your account. A listing that was flagged as unsafe stays flagged. |
| Raw text of adverts you pasted or forwarded for saving | 7 days | The raw text is erased automatically; the job on your tracker stays until you delete it or your account |
| Salary reports you contributed | While your account is active | Deleted with your account (anonymous ranges are only ever shown when at least 5 people reported) |
| Tailored CV versions, message drafts, contacts, interviews, saved searches, followed employers | While your account is active | Deleted with your account |
| Rate-limit and quota counters | 30 days | Deleted automatically each day |
| Support emails and complaints | Until the matter is closed plus 2 years | Deleted |
| Provider backups | Up to 7 days | Overwritten on the provider's backup cycle. If we ever restore a backup we will delete again anything you had already deleted. |
We may keep data for longer only where the law requires it, or where it is needed to establish, exercise or defend legal claims or to investigate suspected fraud — and then only what is necessary and only for as long as needed. We do not currently delete inactive accounts automatically; you can delete yours at any time.
2. Deleting your account yourself
Go to Settings → Account → Danger Zone → Delete Account. When you confirm, we:
- revoke any Gmail access you gave us, with Google;
- delete every CV file you uploaded from storage, then check that they are gone;
- delete your account and the data linked to it in our database;
- de-identify the payment records described above.
If step 2 fails, your account is not deleted and you are shown an error so you can try again; we do not tell you the account is deleted while your files remain. Deletion is permanent and cannot be undone.
3. Asking us to delete your data
If you cannot sign in, or want us to delete only some data, email privacy@careerpilot.co.ke from your registered email address. We may ask you to verify your identity. We will acknowledge within 7 days and complete deletion within 30 days, or sooner where the law requires.
4. What we cannot delete
- Applications already sent. Employers, recruiters and job boards that received your application hold their own copies as independent controllers. Contact them to exercise your rights there.
- Records we are legally required to keep (section 1, payment records), in de-identified form.
- Copies in your own email or on other services you connected.
5. Getting a copy of your data first
Before deleting, you can download a copy of your data in Settings → Privacy & Security → Download my data.