Privacy Policy

Our Commitment

AI Career Index collects and processes the minimum information required to deliver the assessment and reporting service. We do not sell, share or monetise personal data.

Data Collected

We collect the minimum information required to deliver the service: your email address (for account authentication), your assessment responses (used to generate your structural score), your premium-access status, your company association when applicable (for invited employees), and basic usage data (to maintain platform integrity). We do not collect payment card data on our servers. All card data is handled directly by our payment processor, Lemon Squeezy, which is PCI DSS compliant.

How Data Is Used

Your assessment data is used exclusively to compute and store your structural scores, generate your report, allow you to access historical assessments, and (for company customers) produce aggregated workforce readings for your administrator. We do not use your personal data for advertising targeting, third-party profiling, or training AI or machine-learning models. Anonymous, aggregated statistics may be used internally to improve the methodology, but never in a form that can be linked back to you.

Where Data Is Stored & Security

AI Career Index runs on a managed application platform that uses Supabase for database and storage, with infrastructure hosted on Amazon Web Services (AWS). Data is transmitted between your browser and our servers over HTTPS/TLS, and is encrypted at rest on the AWS infrastructure layer. Access to production data is restricted to authorised personnel and protected by individual authentication. We do not sell, share, or monetise personal data with any third party.

Sub-processors

We rely on the following sub-processors to deliver the service. Each is bound to confidentiality and security obligations that are no less protective than those in this policy: (1) our managed application platform, which provides authentication, database, hosting, and serverless functions; (2) Supabase, operated on AWS, our storage and database backend used by the application platform; (3) Lemon Squeezy, our payment processor for premium unlocks (PCI DSS compliant; we never see card data); (4) Amazon Web Services (AWS), the underlying cloud infrastructure for the application platform and storage. The name of the application-platform provider is available on request to data subjects with a legitimate interest. If we add or change a sub-processor, we will update this list before the change becomes operative.

POPIA & GDPR Compliance

We process personal information in line with the Protection of Personal Information Act, 2013 (POPIA) of South Africa and, where applicable, the EU General Data Protection Regulation (GDPR). That means we collect data with a clear purpose, use it only for that purpose, keep it accurate, store it securely, and retain it only for as long as we need it. Where any cross-border transfer takes place, it is to jurisdictions with comparable data-protection standards or under appropriate contractual safeguards, in line with POPIA section 72. Our Information Officer can be reached via the contact channel below.

Your Rights

Under POPIA and GDPR you have the right to: access the personal information we hold about you; correct it if it is inaccurate or incomplete; have it deleted (subject to legal-retention obligations); object to processing that you believe is unlawful; and withdraw any consent you have previously given. To exercise any of these rights, contact us via the platform. We will respond within 10 business days. If you are unsatisfied with our response you have the right to lodge a complaint with the Information Regulator of South Africa (https://inforegulator.org.za/) or, in the EU, your national data-protection authority.

Data Retention

Assessment records are retained for as long as you maintain an active account. You may request deletion of your data at any time. Upon deletion, all assessment records and personal identifiers are permanently removed from our active systems within 30 days; routine backup copies are overwritten on the standard backup rotation. Anonymous, aggregated statistics derived from your data may be retained because they cannot identify you.

Cookies

We use session cookies for authentication and preference storage only. We do not use third-party tracking cookies, advertising cookies, or cross-site behavioural tracking. You can disable cookies in your browser; this will prevent you from logging in but will not affect public pages.

Changes to This Policy

We may update this policy from time to time, for example when we add or change a sub-processor, expand the service, or in response to regulatory change. Material changes will be communicated by updating the effective date below and, where appropriate, by an in-product notice. Continued use of the service after a change constitutes acceptance of the updated policy.

Contact

For privacy-related queries, data subject access requests, or to contact our Information Officer, reach us via the contact form on the site or by email to the address on the contact page. We will respond within 10 business days.