Privacy policy
Last updated: 30 September 2026
TumaCV ("we", "us") helps people in Kenya improve their CVs and apply for jobs. This policy explains what personal data we collect, why, and your rights under the Kenya Data Protection Act, 2019. TumaCV is operated by [Legal entity name], [postal address], Kenya. We are registered with the Office of the Data Protection Commissioner as [data controller/processor registration number].
What we collect
- Your CV. When you upload a file, we read the text and then delete the file. We keep the text and the structured version (name, contact details, work history, education, skills, referees) so we can score it and build your CV.
- Your Google account basics. If you sign in with Google, we receive your name, email address and profile photo. We do not get your Google password or access to your Gmail.
- Your settings and activity. Jobs you save, applications you approve or send, follow-ups and replies, and your sending preferences.
- Employer replies. If you choose to route replies through TumaCV, we receive the employer's reply, record that it arrived, and forward it to your email.
- Technical data. A session cookie to keep you signed in, and standard server logs (IP address, browser type, time) kept for security.
Your CV may include details about your referees. Please only list referees who have agreed to be contacted.
What we don't want
Please don't upload your ID number, date of birth, marital status, religion, health information or photos of documents. We flag these and leave them out of the CVs we create.
Why we use your data
- To score your CV, suggest fixes and create CV and letter documents (to provide the service you asked for).
- To match you with job adverts and, only when you approve it or turn on automatic sending, email your application to the employer from your name (your consent, which you can withdraw at any time in Settings).
- To send follow-ups and forward replies, if you turn these on.
- To keep TumaCV secure, prevent abuse and fix problems (our legitimate interest).
We do not sell your data. We do not show your CV publicly. We only send your CV to employers you apply to.
Who we share it with
- Employers you apply to receive your application email and CV.
- Service providers who process data for us under contract: our web host ([hosting provider], [country]); our email provider (Resend, United States) to deliver applications and notifications; Google for sign-in; and an AI provider ([AI provider], [country]) to help write text such as cover letters and CV points. AI providers process your CV text only to produce that text, under terms that do not allow them to train on it.
- Authorities when the law requires it.
Some of these providers are outside Kenya. Where we transfer data abroad, we rely on appropriate safeguards as required by Section 48 to 50 of the Data Protection Act.
How long we keep it
- Uploaded files: deleted immediately after reading.
- CVs checked without signing in: deleted after 7 days.
- Account data: until you delete your account. Deleting your account removes your CVs, applications and tracker straight away.
- Server and email delivery logs: up to 90 days.
Your rights
You have the right to be told how your data is used, to access it, to correct it, to delete it, to object to its use, and to receive it in a portable format. In Settings you can download all your data or delete your account at any time. For anything else, email [privacy@tumacv.co.ke]. We reply within 14 days.
If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner (odpc.go.ke).
Security
We use encrypted connections (HTTPS), keep access to data limited to the people who need it, and delete what we don't need. If a breach affects your data, we will notify the Data Protection Commissioner within 72 hours and tell you without delay where there is a real risk to you.
Children
TumaCV is for people aged 18 and over.
Employers
If you receive applications through TumaCV and want them to stop, use the link at the bottom of any application email or reply with STOP. We store your email address only to stop future applications.
Changes
If we make important changes, we will tell you by email or on the site before they take effect.
Contact
[Legal entity name], [postal address]. Email: [privacy@tumacv.co.ke]. Data protection officer: [name].