Privacy Policy

1. Who we are

Ajira is operated by Tatua Solutions in Kenya ("Ajira", "we", "us"). We are the data controller for the personal data described in this policy. For any privacy question or request, email privacy@ajira.ai.

2. What Ajira does

Ajira helps job seekers find relevant jobs, check how their CV fits a job, draft application answers, tailored CVs and cover letters from their own CV, fill ordinary fields on application forms, and track applications. You review everything and submit applications yourself. Ajira never submits an application for you.

3. Information we collect

Account information. Your email address and a securely hashed version of your password (we never store your plaintext password), plus email-verification and password-recovery codes while they are valid.

Information from Google sign-in. If you choose to sign in with Google, Google shares your name, email address, whether that email is verified, your Google account identifier and, if available, your profile picture. We keep your email address and Google account identifier, and use your name once to fill in an empty profile name. We do not store your profile picture. We request only the basic openid, email and profile permissions. We do not receive your Google password and we cannot access your Gmail, Drive, Contacts, Calendar or any other Google data.

Profile and CV. The CV you upload (we extract and keep its text and layout information; the original file is processed only temporarily), and the profile details you save, such as your name, contact details, target roles, preferred country, skills, experience and education.

Jobs and applications. Job postings and links you analyse or open, fit analyses, application answers, tailored CVs and cover letters you generate or edit, application questions you ask Ajira to help with, and your application tracker (including submission status and outcomes you record).

Payments. Payments are processed by Paystack. We do not receive or store your full card number, CVV or M-Pesa PIN. We keep the plan you bought, amount, currency, payment reference and status, and your paid periods. If you choose automatic renewal when paying by card, we also keep a Paystack card token together with the card brand, last four digits and expiry month and year, so we can charge your renewal.

Usage, security and referral records. Usage counters and allowance periods; records of AI requests (such as the AI model used, token counts and estimated cost, but not extra copies of your CV, prompts or answers); sign-in sessions; security events; connection addresses, which we store in hashed form; days on which you were active; and, if you joined through someone's invite link, the referral code used.

Job alerts. Whether you want job-alert emails, which jobs we have already sent you, and, if you turn on WhatsApp alerts (Platinum), the WhatsApp number you give us and when we last messaged it.

Cookies and browser storage. The website uses a secure, HttpOnly sign-in cookie and, if you arrive through an invite link, a 30-day referral cookie that is cleared when you register. The Chrome extension keeps your sign-in tokens, remembered email and your current job selection in your browser's extension storage. We do not use advertising cookies. On our public information pages (such as the features, help, glossary and blog pages) we may use Google Analytics and Microsoft Clarity to understand which pages are useful, but only if you choose "Allow" in the analytics notice; your choice is kept in your browser and can be changed at any time from "Cookie settings" in the page footer. These tools never load in the signed-in app, the Chrome extension or on pages that show your CV, jobs or applications.

4. How we use your information

• To create and secure your account, sign you in, and verify your email address.
• To provide Ajira's features: job discovery and matching, fit analysis, AI-drafted answers and documents, form filling you request, and application tracking.
• To process payments, manage your plan and allowances, apply referral rewards, and, only if you opt in, renew your plan automatically.
• To send service emails such as verification codes, password recovery and renewal reminders, and job alerts about new jobs that match your profile. Every job-alert email has a one-click unsubscribe link, and you can turn alerts off in Settings. We only send WhatsApp messages if you turn them on.
• To prevent abuse and fraud, enforce fair-use limits, keep the service secure, and fix problems.
• To understand how the service is used through aggregate counts (for example, how many analyses or payments happen each day). These reports do not show anyone's CV, job descriptions or answers.
• To meet legal, tax and accounting obligations.

We do not sell your personal data, use it for advertising, or use it to train our own AI models.

Legal bases. Under Kenya's Data Protection Act, 2019, we process your data to perform our contract with you (providing the service you sign up for), with your consent (for example Google sign-in, automatic card renewal, and the extension reading pages you choose), for our legitimate interests in keeping Ajira secure and preventing abuse, and to comply with the law. You can withdraw consent at any time; this does not affect processing that already took place.

5. Google user data

Ajira uses the information it receives through Google sign-in (name, email address, email verification status, Google account identifier and profile picture) only to create your Ajira account or link it to your existing Ajira account with the same verified email, sign you in, keep your account secure, and fill in your profile name if it is empty. We do not store your profile picture. We do not request access to any other Google services or data.

We do not sell Google user data, use it for advertising, or use it to build user profiles for other purposes. We do not transfer it to others except to service providers who help us run Ajira (listed below) under confidentiality and data-protection terms, when you ask us to, or when the law requires it. Our staff do not read this data except with your permission, to investigate security or abuse, or to comply with the law.

Ajira's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can remove Ajira's access at any time from your Google Account at myaccount.google.com/permissions.

6. The Chrome extension

The extension works only on job and application pages you open and allow it on. When you ask it to, it reads the job posting and the application questions on that page, and fills fields you approve. It does not collect your general browsing history, and it never fills sensitive screening questions or submits applications. Information you fill into an employer's form is then handled by that employer under its own privacy policy.

The extension's use of information follows the Chrome Web Store User Data Policy, including its Limited Use requirements.

7. Who we share information with

We share personal data only with service providers that help us run Ajira, and only what they need:

• OpenAI processes your CV text, the job content and your application questions to produce analyses, answers, documents and interview preparation. OpenAI does not use data sent through its API to train its models by default.
• Paystack processes payments, including card and M-Pesa payments, and stores card details on our behalf for automatic renewal if you choose it.
• DigitalOcean hosts our servers and database.
• Resend delivers our service emails and job alerts.
• Meta (WhatsApp) delivers WhatsApp job alerts if you turn them on. Meta receives your WhatsApp number and the message content.
• Google provides sign-in if you choose to sign in with Google.

Job listings come from public job sources such as Jobicy, Himalayas and Opened Career. When you view jobs, your browser may load company logos directly from the job source's image host, which receives your connection address. When you open or apply to a job, you go to the employer's or job board's own site.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of the business, in which case this policy will continue to apply to your information.

8. International transfers

Some of our service providers store or process data outside Kenya, including in the United States and Europe. When we transfer data abroad, we rely on safeguards permitted by Kenya's Data Protection Act, 2019, such as the providers' data-processing and confidentiality commitments.

9. How long we keep information

• Your workspace (CV, profile, analyses, documents and tracker) is kept until you delete it in Settings or ask us to delete your account.
• Your account is kept until you ask us to delete it.
• Payment records are kept for as long as tax and accounting law requires, generally at least five years.
• A saved card token is deleted when you remove the card in Settings or delete your account.
• Usage and security records are kept to enforce fair-use limits and protect the service. When your account is deleted, security records are kept only without your account identifier.
• Backups are rotated and deleted on a schedule, so deleted data can remain in a backup until that backup expires.

Signing out of the extension or uninstalling it does not delete your account. To remove information stored in your browser, sign out and uninstall the extension.

10. Your rights and choices

Under Kenya's Data Protection Act, 2019, you have the right to be informed about how your data is used, to access it, to correct it, to have it deleted, to object to processing, to withdraw consent, and to receive a copy of your data in a portable format.

• Export or delete your workspace at any time in Settings.
• Turn off automatic renewal or remove a saved card in Settings.
• Delete your account, or make any other request, by emailing privacy@ajira.ai from the email address on your account. We may need to confirm that you control the account. Please never send your password or sign-in codes. We aim to respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Data Protection Commissioner in Kenya at odpc.go.ke.

11. Security

All connections to Ajira use HTTPS. Passwords are stored with a memory-hard hashing algorithm, connection addresses are stored in hashed form, and access to personal data is limited to what is needed to run and secure the service. Card details are handled by Paystack, which is certified to the PCI DSS payment security standard. No system is perfectly secure; if a breach affects your personal data, we will notify you and the Data Protection Commissioner as the law requires.

12. Children

Ajira is intended for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@ajira.ai and we will delete it.

13. Changes to this policy

We may update this policy as Ajira changes. We will post the new version here with a new effective date and, for significant changes, tell you by email or in the app before they take effect.

14. Contact us

Tatua Solutions (operator of Ajira), Kenya
Email: privacy@ajira.ai