Privacy Policy
What we keep, and where it goes.
Last updated: 06 October 2026
Who we are
Profile Audit is operated by Aidan Koetaan, trading as Profile Audit, a South African sole proprietorship based in Bloemfontein, Free State. We are the responsible party under the Protection of Personal Information Act 4 of 2013 ("POPIA") for the personal information described here.
Our Information Officer can be reached at hello@setout.co.za.
What we collect
| What | When | Why |
|---|---|---|
| Email address, and a password hash or your Google account identifier | When you create an account or sign in | To let you back into your history and to send you your reports |
| The LinkedIn profile text you paste, or the LinkedIn profile URL you submit | Each time you run an audit | It is the thing being assessed. Without it there is no report |
| CV text and job advert text | When you use the Pro apply tools | To produce a cover letter and a restructured CV for that advert |
| The reports we generate for you | On every paid run | So you can come back to them in your history |
| Payment reference, amount, date and outcome | When you pay | To match a payment to your account and to meet tax record-keeping duties |
| Basic technical logs — IP address, browser, timestamps, errors | Automatically | Security, abuse and rate-limit enforcement, and fixing faults |
We never receive your card details. Card and banking data is entered on PayFast's own pages and stays with them. We see only the reference, amount and whether it succeeded.
A LinkedIn profile or CV often contains more than a name and job history — a photograph, an employer, dates, sometimes an indication of health, religion or membership of an organisation. Whatever is in the text you paste, we process. If you would rather we did not hold something, remove it from the text before you paste it.
Whose information you may submit
Submit your own profile and your own CV. If you paste anyone else's personal information you are responsible for having their agreement to do so.
Artificial intelligence, and where your text goes
Every audit, free and paid, is produced by an AI model. To produce the free audit, the Quick Fix, the expert report and the apply-tool output, the text you paste is transmitted to Anthropic PBC in the United States and processed by Claude. This is a cross-border transfer of personal information under section 72 of POPIA. We rely on two grounds: it is necessary for performing the contract you asked us to perform, and Anthropic is bound by terms that give your information a level of protection substantially similar to POPIA.
- Anthropic does not use text submitted through its commercial API to train its models.
- We do not use your profile, CV or reports to train any model of our own.
- If you do not want your text processed abroad, do not run an audit.
Who else touches your information
| Who | What for | Where |
|---|---|---|
| Anthropic PBC | AI analysis for every audit, free and paid | United States |
| PayFast (Payfast (Pty) Ltd) | Payment processing and recurring billing | South Africa |
| Sign-in, if you choose "Continue with Google"; Google Analytics, which measures site traffic | United States | |
| Cloudflare | Hosting, DNS and protection against abuse | Global edge network |
| Our transactional email provider | Sending report-ready and account emails | United States / EU |
That is the whole list. We do not sell, rent or trade your personal information, we do not run advertising on the site, and we do not share your profile or CV with recruiters, employers or anyone else.
We will disclose information if the law requires it — a court order, a statutory demand — and will tell you unless we are forbidden from doing so.
How long we keep it
- Account and audit history — for as long as your account is open. Delete your account and we remove them within 30 days.
- Reports and saved applications — same as the account. Email us to delete individual items at any time.
- Payment records — five years, because the Tax Administration Act requires it. These are transaction records, not your profile text.
- Technical logs — 90 days, then deleted.
How we protect it
- The whole site runs over HTTPS.
- Passwords are stored as salted hashes. We cannot read your password, and we will never ask for it.
- Access to the production database is limited to the operator of the business.
- Rate limiting and abuse detection on audit runs.
No system is perfectly secure. If a breach happens that creates a real risk to you, we will tell you and the Information Regulator, as section 22 of POPIA requires.
Cookies
We set two cookies the site needs to work: a session cookie so you stay signed in, and an anonymous-audit cookie that links free audits to your browser so they carry over if you sign up. Blocking these will stop you staying signed in.
We also use Google Analytics to see which pages are read and how people find the site. It sets
first-party cookies (_ga and _ga_*, kept for up to two years) and records
the pages you visit, how you reached the site, your approximate location, and your device and
browser type. Google receives this as our operator. It never receives your profile, CV or report
text. We use it only to measure the site, not to identify you or to target advertising. You can
block these cookies in your browser or install the
Google Analytics opt-out add-on; the site
works the same without them.
Your rights under POPIA
- Ask what personal information we hold about you, and get a copy.
- Have anything inaccurate corrected.
- Have your information deleted, subject to records we must keep by law.
- Object to processing, on reasonable grounds.
- Withdraw consent, where consent is what we relied on.
- Complain to the Information Regulator.
Email hello@setout.co.za and we will answer within 30 days. There is no charge unless a request is repetitive or excessive, and we will tell you before charging anything.
The Information Regulator of South Africa: complaints.IR@justice.gov.za · inforegulator.org.za.
Children
Profile Audit is for people old enough to be looking for work and is not directed at children. If we learn we hold a child's information without the consent of a competent person, we delete it.
Changes
We may revise this policy. The date at the top shows the last revision. For a material change we email account holders before it takes effect.
How to reach us
hello@setout.co.za — Bloemfontein, Free State, South Africa.