Privacy Policy

Effective date: 1 January 2026 · Compliant with the Protection of Personal Information Act, 4 of 2013 (POPIA)

1. Responsible party

Booksmith is the responsible party for personal information collected through this Platform. Contact our Information Officer at privacy@booksmith.co.za.

2. Information we collect

When you register and use the Platform we collect:

Identity information — name, email address, username
Profile information — bio, location, career interests, phone number (optional)
CV / resume data — work history, qualifications, skills you add voluntarily
Activity data — posts, comments, course progress, interview sessions
Usage data — pages visited, features used, device type (collected via server logs)

3. How we use your information

We use your information to:

Provide and improve the Platform (pathway recommendations, AI coaching, mentor matching)
Send transactional emails (account confirmation, password reset, session reminders)
Personalise your experience (leaderboards, cohort assignment, interest-based content)
Detect and prevent fraud and abuse
Comply with legal obligations

We do not sell or rent your personal information to third parties.

4. Sharing your information

We share information only in limited circumstances:

Mentors — when you request a session, your name and career stage are shared with the mentor
Employers — only information you explicitly submit with an opportunity application
Service providers — cloud infrastructure (hosting, email delivery, file storage) operating under data processing agreements
Legal requirements — when required by South African law or court order

5. AI features

The AI coaching, interview assessment, and path recommendation features send relevant portions of your profile and session data to third-party AI providers (Anthropic and Groq) for processing. These providers act as sub-processors and do not use your data to train their models under our agreements with them.

6. Data retention

We retain your account data for as long as your account is active. If you delete your account, your personal identifiers are anonymised within 72 hours. Anonymised, aggregated data may be retained indefinitely for platform analytics.

7. Your rights under POPIA

You have the right to:

Access — request a copy of the personal information we hold about you
Correction — update or correct inaccurate information via your profile settings
Deletion (erasure) — delete your account, which anonymises your personal data
Objection — object to processing of your information for direct marketing
Complaint — lodge a complaint with the Information Regulator of South Africa at inforegulator.org.za

To exercise these rights, email privacy@gryffindor.co.za. We will respond within 30 days as required by POPIA.

8. Security

We use industry-standard measures to protect your information: TLS encryption in transit, hashed passwords (ASP.NET Core Identity), and restricted database access. No system is perfectly secure; please use a strong, unique password.

9. Cookies

We use a single authentication cookie to keep you signed in. We do not use advertising or third-party tracking cookies. No cookie consent banner is required for strictly necessary cookies under current South African guidance.

10. Children

Users under 18 must have parental or guardian consent. We do not knowingly collect information from children under 13. If you believe a child under 13 has registered, contact us and we will delete the account promptly.

11. Changes to this Policy

We will notify registered users by email at least 14 days before any material changes to this Policy take effect.

12. Contact

Privacy questions or access requests: privacy@gryffindor.co.za