Privacy Policy

This Privacy Policy explains how Leap Innovations ("CareerPilot", "we", "us") collects, uses, shares and protects your personal data when you use the CareerPilot website and services (the "Service"). It is written to meet the Data Protection Act, 2019 of Kenya (the "Act") and the regulations made under it. Please read it together with our Terms of Service, Cookie Policy, Data Retention & Deletion page and list of Service Providers.

1. Who we are and how to contact us

• Data controller: Leap Innovations, company registration no. BN-35CKQ9Y.
• Address: 463-00516, Nairobi.
• Data Protection Officer / contact: ⟦NOT SET: NEXT_PUBLIC_LEGAL_DPO_NAME⟧ — privacy@careerpilot.co.ke.
• Registration with the Office of the Data Protection Commissioner (ODPC): ⟦NOT SET: NEXT_PUBLIC_LEGAL_ODPC_REG_NO⟧.

2. Who this applies to

It applies to visitors, account holders and anyone whose information you (or we, on your instruction) submit through the Service. CareerPilot is for adults only (see section 14). For the applications you send, the employer or job board that receives them becomes a separate controller of what it receives (section 7).

3. The personal data we collect, why, and on what legal basis

The Act requires us to have a lawful basis for each use. The table sets them out.

Where we rely on legitimate interests, we have weighed them against your rights and freedoms; you may object (section 12). Where we rely on consent, you may withdraw it at any time (for example by disconnecting Gmail or switching off WhatsApp in Settings) without affecting what was done before. If you do not provide information we need to provide the Service (for example a CV), we will not be able to provide the matching or application features.

4. Sensitive personal data

The Act gives extra protection to "sensitive personal data" (for example health, ethnic or social origin, race, sex, religious belief, or criminal record). Some employers' application forms ask for it. CareerPilot never guesses, infers or invents answers to those questions. Such questions are flagged for you to answer yourself; we store an answer only if you enter it, use it only to complete the application you asked for, and send it only to that employer. By entering a sensitive answer you give your explicit consent to that use. You can edit or delete stored answers at any time.

5. Automated processing and decisions about you

We use automated tools, including artificial intelligence, in these ways:

• Job matching and fit scores compare your CV and preferences with job requirements.
• AI-drafted content (cover letters, CV suggestions, recommendations, aptitude questions) is generated using large-language-model providers (OpenAI, Anthropic, Google (Gemini) and Perplexity). Relevant extracts of your CV and of the job description are sent to them for this purpose. AI output can be inaccurate; review it before you rely on it.
• Automatic applications: if you switch on auto-apply and set your rules, we may submit an application for you without asking each time. Where a job board does not allow safe automatic submission, we prepare the application and ask you to review and confirm it. You can pause or turn off auto-apply at any time.
• Scam checks score job adverts for warning signs (for example requests to pay a fee). High-risk adverts are hidden from digests and are never added to automatic applications. These checks are about the advert, not about you.
• Fraud and abuse checks use simple rules (for example unusual payment or usage patterns) to flag accounts for a person on our team to review.

We do not make decisions producing legal effects on you based solely on automated processing, other than the applications you have instructed us to send. Employers make their own hiring decisions. Under the Act (section 35) you may ask that a person reviews an automated result, express your point of view, or object; contact us at the address in section 1.

6. Gmail and Google user data

If you connect Gmail we request read-only access. We read only sender, subject, date and a short snippet to match employer replies to your applications. We do not read full email bodies for other purposes, send, delete or modify email, or use Gmail data for advertising or to train general AI models. Your access tokens are encrypted at rest.CareerPilot's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. No person at CareerPilot reads your email except where you ask us for support and give permission, where required for security investigations, or where the law requires. You can disconnect Gmail in Settings at any time, which revokes our access with Google; you can also revoke it at myaccount.google.com/permissions.

7. Who we share data with

We do not sell your personal data. We share it only as follows:

• Service providers (processors) who process data on our instructions under written contracts: hosting, database, storage and authentication, AI providers, email delivery, payments, messaging and Google services. The current list is on our Service Providers page.
• Employers, recruiters and job boards / applicant-tracking systems to whom you apply, or ask us to apply on your behalf. They receive the content of the application (CV, cover letter, contact details and answers) and become independent controllers under their own privacy policies. We cannot recall or delete what they hold.
• Payment networks: Safaricom M-Pesa receives your phone number and amount to process payment.
• Authorities and advisers: where required by law, court order or to protect rights and safety, and to our professional advisers, under duties of confidentiality.
• A successor if we merge or sell the business, who must honour this Policy.

The Service does not share your data with third parties for their own marketing, and does not list your profile publicly or make it searchable by recruiters.

8. Transfers outside Kenya

Our providers process data in the following places: ⟦NOT SET: NEXT_PUBLIC_LEGAL_DATA_REGIONS⟧. Some (for example AI, email and Google/Meta services) may also process data in other countries. Where personal data leaves Kenya we do so in line with sections 48–50 of the Act: to providers that give appropriate safeguards through contract (including confidentiality, security and use restrictions), or on the basis of your consent where required. Ask us for details of the safeguards at the address in section 1.

9. How long we keep data

We keep data only as long as needed for the purposes above. In short: your account data is kept until you delete your account; de-identified payment records are kept for 7 years for tax and accounting; operational logs are kept for 90 days. Full details, including what happens to backups, are on the Data Retention & Deletion page.

10. How we protect your data

We use measures appropriate to the risk, including:

• encryption of data in transit (HTTPS/TLS) and of stored Gmail tokens (AES-256-GCM);
• per-user access controls in the database so that one user cannot read another user's data, and private storage for CV files;
• restricted staff access, separate administrator accounts, and an audit log of administrator actions;
• rate limits, monitoring and alerts for unusual activity; and
• vetting of service providers and written data-processing terms.

No system is completely secure. If a personal data breach is likely to put your rights and freedoms at risk we will notify the Data Commissioner within 72 hours of becoming aware of it, and we will tell you without unreasonable delay, in plain language, what happened, what data is involved and what you can do.

11. Marketing

We send service messages (for example receipts, security notices, application updates you asked for). We send optional emails (weekly summaries, new-match alerts) and WhatsApp digests only according to your notification settings, which you can change at any time; you can also use the unsubscribe or STOP option in the message. We do not send marketing on behalf of third parties.

12. Your rights

Under the Act you have the right to:

• be informed of how your data is used (this Policy);
• access the personal data we hold about you;
• object to processing, including for direct marketing;
• correct inaccurate or incomplete data;
• have your data deleted where there is no lawful reason to keep it;
• restrict processing in certain cases;
• receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible (data portability);
• not be subject to a decision based solely on automated processing that significantly affects you (section 5); and
• withdraw consent at any time.

How to use them: most can be done yourself in Settings — edit your profile, CV files and answers; download a copy of your data in Settings → Privacy & Security → Download my data; and delete your account under Settings → Account → Danger Zone. For anything else, email privacy@careerpilot.co.ke. We will acknowledge your request within 7 days and complete it within 30 days, or sooner where the law requires. We may need to verify your identity first. We do not charge for exercising your rights, except we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive, as the law permits. If we refuse, we will explain why.

13. Complaints

Please contact us first so that we can try to fix the problem. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner, Kenya (https://www.odpc.go.ke).

14. Children

CareerPilot is intended only for people aged 18 or over. We do not knowingly collect personal data of children. If we learn that an account belongs to someone under 18 we will close it and delete the data. If you believe a child has used the Service, tell us.

15. Cookies and similar technologies

We use only strictly necessary cookies and browser storage (to keep you signed in and remember your theme). No advertising or third-party analytics cookies are used. See the Cookie Policy.

16. Third-party links

Job listings link to employers' and job boards' sites. We are not responsible for their privacy practices; please read their policies.

17. Changes to this Policy

We will post any change here with a new date and version. If a change is material we will tell you by email or in the app before it takes effect, and ask for fresh consent where the law requires it.