Plain English. No fine print.

01Who we are

PositionMeAI is a service operated by De Vlamingh & Associates Consulting CC (“we”, “us”, “our”), a close corporation registered in South Africa. We are the Responsible Party under the Protection of Personal Information Act (POPIA, Act 4 of 2013).

Our registered email for data queries: hello@positionmeai.co.za

02What we collect, and why

We collect only what we need to provide the service you’ve asked for. We don’t sell your data, and we don’t share it with advertisers.

When you take a Career Scan

When you complete a Scan (Career Launch, Shift, Evolve, Return, FuturePath, or the readiness check-in), your answers are processed in your browser to generate your Career Report. We do not see these answers unless you choose to share them with us.

When you ask for your report by email or download

If you ask us to email you your report or scan snapshot, we collect your email address and a structured summary of your results: for example your top matched direction, the career stage and industry you told us, and your capability-band scores per dimension, not just a one-line summary. We send this one report once you ask for it, because that’s the specific thing you asked us to do. This doesn’t depend on ticking anything else.

Ongoing updates are separate and opt-in. Every email-capture step has its own, separate, unticked-by-default checkbox for “occasional updates about new tools and Foundations.” We only add you to that mailing list if you tick it. Leaving it unticked still gets you the one report or snapshot you asked for. It just means we don’t contact you again. You can unsubscribe from ongoing updates at any time using the link in any email.

Downloading a PDF directly (without entering an email) never transmits anything to us. The PDF is generated entirely in your browser.

When you request Foundations access

When you submit the CareerLaunch Sprint application form (or the Foundations Training access form, which routes to the same Sprint application), we collect:

• Your first name and surname
• Your email address
• Your selected career stage
• The optional context paragraph you provide
• Your optional Foundation-of-interest or context selection

We use this to respond to your application within 2 business days with whether it’s a fit for the founding cohort, the secure PayFast payment link if appropriate, and any clarifications.

When you apply for a 1:1 Consultation

When you submit the Consultations apply form (or email us directly), we hold whatever you write in your application. We use it only to respond to your application, propose an associate match, and to prepare for any session you book. We share the relevant parts of your application with the proposed associate to assess fit; we don’t share it more widely.

When you pay for the Bundle via PayFast

When you make a payment via PayFast, PositionMeAI never sees your card details, banking information, or any other payment-instrument data. PayFast is a South African payment processor regulated by the South African Reserve Bank and is independently POPIA-compliant. PayFast holds your payment data under their own privacy policy; we hold only the confirmation that a payment was made, the amount, the transaction reference, and the email associated with the purchase, for accounting, customer service, and to grant you Bundle access.

When you use the AI-assisted features

See Section 7 below: these features have their own handling because they involve a third-party AI processor.

What we do not collect

We do not collect:

• Your ID number, address, banking details, or other sensitive personal information, unless you specifically include them in something you send us
• Information about you from third-party data brokers
• Detailed device tracking, advertising IDs, or social-graph data

03What we store on your device (localStorage and cookies)

We use browser localStorage to remember your progress across the site: for example, which page of a Playbook you were on, your personalisation choices on a Playbook, and the answers you’ve given so far in a Scan you haven’t finished.

The localStorage data itself lives on your device only and is never read or transmitted by us in bulk. You can clear it at any time using your browser’s “clear site data” function. This is separate from the specific, individual actions you take on a page (like submitting an email address) which do transmit exactly what that action involves. See Section 2 for what each of those sends.

We do not use third-party advertising cookies, and no third-party analytics script (e.g. Google Analytics, PostHog) is currently active on the site. The site uses one essential first-party cookie (pmai_session, for logged-in account access, HttpOnly and never readable by page scripts) and Cloudflare’s standard hosting cookies for security and performance. We also record anonymous, aggregate page-level counters for a short list of key actions (e.g. how many people started a Career Report): no identifiers, no per-user data, just a running total per day.

Optional: anonymised platform insights. At the start of the Career Report you may tick an opt-in checkbox allowing us to use your anonymised answers to surface platform-wide patterns (e.g. which career directions cluster with which capability profiles, where SA users score strongest or weakest, how Foundations Training is engaged with). If you tick this, the data is stripped of your name and email at source and used only for product insight and aggregated trend reporting: never sold, never shared with third parties, never used for academic publication without separate explicit consent. If you don’t tick it, nothing leaves your device. Either way, the Report works identically and you receive the same results.

04How long we keep what we collect

You can ask us to delete your data sooner. See Section 9 for how.

05Who we share your information with

We use a small number of third-party processors to deliver the service. We have contractual relationships with each, and they process your data only on our instructions.

We do not share your information with any third party for advertising, marketing, or commercial purposes outside of what you’ve directly asked us to do.

We may disclose information if we are legally required to (for example, in response to a lawful court order or to comply with a regulatory request) or if we believe disclosure is necessary to prevent imminent harm. We will tell you about such disclosure where we are legally able to do so.

06International transfers of your information

Some of our processors (Cloudflare, Anthropic) are based in the United States, and Brevo is based in the European Union. This means your information is transferred outside South Africa.

We rely on Section 72 of POPIA for these transfers. In plain terms, the transfer is permitted because:

• It is necessary to perform the service you have asked us for, or
• The receiving party is subject to laws or contractual obligations that provide a level of protection substantially similar to POPIA (the EU’s GDPR meets this test; we have contractual data-processing terms with our US processors that include POPIA-aligned commitments)

If you do not want your information transferred internationally, we cannot provide the service. Email us and we will delete any information we already hold.

07AI-assisted features

The one AI-assisted feature currently live is the Legacy Scan’s personalised AI toolkit, available to paying Legacy Scan users. If you use it, the profession/field you told us, your assessment results, and the free-text answers you write about your experience are sent to our AI processor, Anthropic PBC (United States), under a commercial API agreement, to generate your personalised toolkit.

In plain terms:

• Anthropic does not train Claude on data sent through their commercial API. Your answers are not absorbed into the model.
• Anthropic’s standard commercial API retention applies: currently up to 30 days for routine deletion, or up to 2 years if a session is flagged for a Usage Policy violation or retention is legally required. See Anthropic’s current retention policy for the up-to-date position. This is Anthropic’s policy, not ours, and can change on their side.
• We separately cache the generated toolkit ourselves for 180 days, tied to your account, so you don’t have to wait for it to regenerate every time you view your results.

The CV Generator’s AI features are not currently active. If that changes, this section will be updated before the feature goes live, not after.

A few things you can do to reduce what you share when using an AI-assisted feature:

• Use initials instead of full names for past employers, clients, or references
• Leave out ID numbers, addresses, or dates of birth
• Write your draft yourself and use the AI only to polish sections

If you don’t want to use AI for any of this, our non-AI Foundations cover the same craft (CV, positioning, interview preparation) without any external AI processing involved.

08Children

Most of PositionMeAI is built for adults entering or navigating the South African workforce. One tool, FuturePath, is explicitly designed for school-age learners exploring career curiosity, and that changes what we’re allowed to do with a self-identified under-18 respondent’s information.

If you tell FuturePath you’re still in school (Grade 8–11 or matric), and you want your results emailed to you, we don’t email you directly. Instead:

• We ask for a parent or guardian’s email address, not yours.
• We send that address a one-time confirmation request explaining exactly what we’d send and why.
• Only if they click through do we send anything, and we send it to them, not to you.
• Nothing is added to any ongoing mailing list through this process.

You can always download your own results as a PDF directly in your browser with no email required at all. That never involves us or leaves your device.

Being candid about a limit here: this confirms a parent/guardian email address took an affirmative action, which is a real and meaningful step up from a self-service checkbox, but it does not verify that address genuinely belongs to a parent or guardian in a legally airtight sense. We treat this as a good-faith, reasonable safeguard while POPIA’s own guidance on what counts as sufficiently “verifiable” consent online remains, in our reading, unsettled.

The APS Calculator is intended for use by Grade 11 and 12 learners (typically 16–18 years old). It runs entirely in your browser and does not currently have any feature that transmits information to us at all.

If you believe a person under 18 has provided us with personal information without appropriate consent, contact us immediately at hello@positionmeai.co.za and we will delete it.

09Your rights under POPIA

Under POPIA, you have the right to:

• Confirm whether we hold any personal information about you
• Access the personal information we hold about you
• Correct information that is inaccurate, out of date, or incomplete
• Delete information that we no longer have a lawful basis to hold
• Object to processing of your information for direct marketing purposes
• Withdraw consent for any processing you previously agreed to
• Lodge a complaint with the Information Regulator if you believe we have not handled your information lawfully

To exercise any of these rights, email hello@positionmeai.co.za with “Data request” in the subject line. We will respond within 30 days as required by POPIA, and faster wherever we can.

You can contact the Information Regulator directly at:

Information Regulator (South Africa)
JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001
Telephone: +27 (0) 10 023 5200
Email: POPIAComplaints@inforegulator.org.za
Website: inforegulator.org.za

10Security

We use industry-standard measures to protect your information, including:

• Encrypted connections (HTTPS) across the whole site
• Contractual data-processing terms with each of our third-party processors
• Access controls on any system that holds your personal information
• Your scan answers only reach our servers if you take a specific action that requires it: asking for your report by email (Section 2), or ticking the separate, opt-in anonymised-insights checkbox (Section 3). Simply completing a Scan and viewing your results never transmits anything; that stays in your browser.

No system is perfect. If we ever become aware of a breach that puts your information at risk, we will notify you and the Information Regulator as required by POPIA.

11Changes to this policy

We may update this policy as the platform grows. When we make material changes (for example, adding a new processor or a new AI-assisted feature), we will:

• Update the “Last updated” date at the top
• Notify subscribers by email if the change is significant
• Keep an archive of previous versions available on request

Small wording or formatting updates that don’t change the substance of the policy will not trigger a notification.

12Contact us

For any question about this policy, your information, or how we handle it:

De Vlamingh & Associates Consulting CC
Email: hello@positionmeai.co.za
Subject line: “Data query” or “Privacy”

We respond to every email. If you don’t hear back within 5 working days, please resend. Emails sometimes go astray.