Privacy Policy

This Privacy Policy explains how Career Buddy Trust trading as Espen AI processes personal information when you interact with our website, mobile applications, and AI-powered educational services. It covers what we collect, how we use it, who we share it with, how we keep it secure, and the rights you have over your data.

1. Information We Collect

Information you provide

• Name, email address, phone number, username, and password.
• Account preferences and profile details.
• Payment information (processed by Stripe; we do not store full card numbers).
• Content you submit through the services, including learner data where you are authorised to provide it.

Information we collect automatically

• IP address and device characteristics.
• Browser type and version, operating system, and approximate location data.
• Log and usage data from your interactions with the services.
• Device identifiers, where permitted by the operating system.

2. How We Use Personal Information

We process personal information to:

• create and authenticate your account;
• deliver the services you request and the academic intelligence features you use;
• respond to enquiries and provide customer support;
• send administrative communications and service updates;
• monitor the services for security threats and prevent fraud;
• improve and personalise the services through analytics and research; and
• comply with legal obligations.

3. Sharing With Third Parties

We share personal information only with third parties that help us operate the services, and only to the extent necessary for them to perform their function. These include:

• Payment processors (Stripe).
• Authentication providers.
• Analytics platforms (including Google Analytics).
• AI service providers we use under contract, including AWS, Anthropic, OpenAI, Google Cloud, and Microsoft Azure.
• Testing, monitoring, and observability tools.

Each of these providers is bound by contract to use the personal information only as we instruct, and to apply appropriate security measures.

4. AI Products and Technologies

Espen uses AI models for natural language processing, predictive analytics, conversational interfaces, and search functionality. Where we use third-party AI providers to power these features, your data is processed under our contracts with those providers and is not used to train external AI models.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies for security, functionality, and analytics. For more information about how we use cookies and how you can control them, please see our Cookie Notice.

6. Your Rights

You have the right to:

• request access to the personal information we hold about you;
• correct inaccurate or incomplete personal information;
• request deletion of your personal information, subject to our legal obligations;
• withdraw consent for processing where consent is the legal basis;
• submit a data subject access request; and
• object to processing or request restriction in certain circumstances.

To exercise any of these rights, contact us at hello@espen.ai.

7. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes set out in this policy, unless a longer retention period is required or permitted by law. When personal information is no longer required, we either delete it or anonymise it so that it can no longer be associated with you.

8. Security

We implement appropriate and reasonable technical and organisational security measures designed to protect personal information against loss, theft, and unauthorised access, including encryption at rest and in transit, role-based access controls, and regular security review. No method of transmission over the internet or method of electronic storage is 100% secure, however, and we cannot guarantee absolute security.

9. Data Hosting and International Transfers

Our primary hosting infrastructure is in Ireland (within the European Economic Area). South African school data is processed with data residency in South Africa where required. By using the services, you consent to the transfer of your data to the jurisdictions where our hosting and processing partners operate.

10. South African Users (POPIA)

If you are in South Africa, you have rights under the Protection of Personal Information Act (POPIA), including the right to access and correct your personal information and the right to lodge a complaint with the Information Regulator. You can reach the Information Regulator at the contact details published on the South African government's official website.

11. Children's Privacy

The services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without verified parental or guardian consent. Where the services are made available to learners through their school, the school acts as the responsible party for student data on behalf of parents.

12. Changes to This Policy

We may update this Privacy Policy from time to time to remain compliant with applicable laws and to reflect changes in our practices. The updated policy will be posted on this page with a revised effective date. We encourage you to review this policy periodically.

13. Contact Us

For any questions about this Privacy Policy, or to exercise any of your data rights, contact our Data Protection Officer:

Career Buddy Trust
Watershed, 17 Dock Road
Victoria & Alfred Waterfront
Cape Town, 8002, South Africa
Telephone: +27 78 705 1175
Email: hello@espen.ai