Privacy policy

Who we are

Hemline is an online service that tailors CVs and cover letters for South African students and recent graduates. It is run by a South African student founder, who is the responsible party for your personal information under POPIA and also acts as our information officer.

To ask a question, make a request or complain, contact us using the support email address or WhatsApp number in the contact details on our website.

What we collect

• Account details: your email address, your name and your password. Your password is stored only in scrambled (hashed) form by our log-in provider, so we can't read it.
• Your CV: everything in the CV you upload or build, such as your contact details, education and marks, work experience, leadership roles, projects, skills, awards and references, plus the file you upload.
• Job ads you paste, and any organisation, role and closing date you add.
• Generated documents: your tailored CVs, cover letters, match scores, gaps and tips, and any changes you make to them.
• Application tracker data: the applications you track and their status.
• Payment records: what you bought, when, what you paid and the credits added. We never see or store your card number; our payment provider, Paystack, handles card details.
• Records of your choices: when you agreed to how we use your information at sign-up, and your cookie choice (kept in your browser).
• Basic technical records: error logs and the number of CVs you upload each day (we limit uploads), which keep the service working and protect it from abuse.

Please only include what an application needs. Leave out sensitive details such as your ID number, health information or religious beliefs unless an ad specifically asks for them, and only list references who have agreed to share their contact details.

Why we use it

We use your personal information to provide the service you signed up for:

• to read your CV, tailor it to the ads you paste, write cover letters, score the match and create PDFs;
• to run your account: logging in, confirming your email, keeping you logged in and keeping track of your credits;
• to keep Hemline secure and working, prevent misuse and fix problems;
• to improve Hemline, using analytics only if you accept them; and
• to meet our legal duties, such as keeping payment records.

We rely on the consent you give when you sign up and on the need to process your information to provide the service you asked for. We don't sell your information, we don't use it for advertising, and we never send your CV to employers. Only you decide where your applications go.

Who processes it for us

We use a few trusted service providers (called operators in POPIA) to run Hemline. They may only use your information to provide their service to us.

• Supabase hosts our database, file storage and log-in system, so it stores your account, CV, uploaded files, applications and tracker.
• Anthropic provides the Claude API, the AI that reads your CV and tailors your applications. When you upload a CV or tailor an application, the CV content and the ad text are sent to Anthropic to produce the result.
• Paystack (our payment provider, a Stripe company) processes your payment and card details when you buy credits, under its own privacy policy.
• Umami, a privacy-friendly analytics tool, counts visits and the pages people use, without building advertising profiles. It only runs if you accept analytics in our cookie banner.
• Google or Apple, only if you choose “Continue with Google” or “Continue with Apple”: they confirm who you are and share your name and email address with us, under their own privacy policies. We never see your Google or Apple password.
• Have I Been Pwned helps us block passwords that appeared in known data breaches. Only the first five characters of a scrambled (hashed) version of a new password leave our server, never the password itself.

Information sent outside South Africa

Anthropic is based in the United States, and our other providers may store or process information on servers outside South Africa. Under section 72 of POPIA we only allow this with appropriate safeguards: each provider is bound by written terms that require it to protect your information to a standard similar to POPIA and to use it only to provide its service. Anthropic's commercial terms also say it does not use information sent through its API to train its models. When you sign up, you also agree to these transfers.

We will only share your information with anyone else if the law requires it, for example under a court order.

Cookies and browser storage

• Essential cookies keep you logged in and keep your session secure. Hemline can't work without them, so they can't be switched off.
• Your settings, such as your cookie choice and whether you prefer less motion, are saved in your browser's local storage.
• Optional analytics (Umami) only load after you choose Accept. If you choose Decline, they never load.

You can change your choice at any time with the “Cookie settings” link at the bottom of our pages, or here: Cookie settings.

How long we keep it

• We keep your account, CV, applications and tracker until you delete your account.
• Deleting your account (on the Account page) permanently removes everything: your account, CV, uploaded files, applications, cover letters and tracker. This can't be undone.
• We keep payment records for as long as South African tax and accounting law requires, even after you delete your account.
• Our providers may keep short-lived copies, such as backups and security logs, for a limited time under their own retention schedules before deleting them.

Your rights

Under POPIA you have the right to:

• ask what personal information we hold about you and get a copy of it;
• ask us to correct or update it (you can edit most of it yourself in the app);
• ask us to delete it (you can delete your account yourself at any time);
• object to how we process it, or withdraw your consent (we'll then stop processing it, which means closing your account); and
• complain to the Information Regulator, South Africa's data protection authority, at inforegulator.org.za.

To use these rights, contact us using the details on our website. We may ask you to confirm your identity first, and we'll reply as soon as we can, and within 30 days. We'd appreciate the chance to sort out any concern before you go to the Regulator, but you can contact the Regulator at any time.

Security

Your information travels over encrypted connections (HTTPS) and is stored with an established hosting provider. Each student can only reach their own data, secret keys stay on our servers, and we limit who can access the systems behind Hemline. No system is perfectly secure, so if a breach ever puts your information at risk, we'll tell you and the Information Regulator as POPIA requires. Please use a strong password that you don't use anywhere else.

Children

Hemline is for people aged 18 and over. If you're under 18, you need permission from a parent or guardian before you sign up. If we find out that a child has signed up without that permission, we'll delete the account.

Changes to this policy

If we change this policy, we'll update the date at the top. If a change affects how we use your information in an important way, we'll tell you by email or in the app before it takes effect. Please also read our Terms of use.