Privacy Notice

Last updated: 4 May 2026

This notice explains how Dawnlist (Pty) Ltd (“Dawnlist”, “we”, “us”) handles your personal information when you use the candidate platform at dawnlist.co.za.

Who we are

Dawnlist (Pty) Ltd is a South African company operating an AI-powered job search platform. Candidates upload their CV, we use AI to match them against scraped job listings, and we deliver matched jobs by email each morning.

Our Information Officer, registered with the Information Regulator of South Africa, is TBC, TBC. You can contact them at privacy@dawnlist.co.za.

What we collect

When you sign up and use Dawnlist, we collect:

• Account information — your email address. We do not store passwords. Authentication is via magic link.
• Your CV — the file you upload, which we store. We extract the text and structured information from it (your work history, education, skills, location).
• A profile derived from your CV — an AI-generated structured summary of your skills, experience level, location, and the kinds of jobs that fit your background. You can review and edit this.
• Match history — which jobs we have surfaced to you, your scores against them, whether you marked them as interested or not interested, whether we generated a cover letter.
• Email engagement — whether you opened our daily emails (we do not track which links you clicked outside our platform).
• Usage information — when you log in, your IP address at the time of each session, which pages you visited on dawnlist.co.za. We use this for security and to enforce the limits of your subscription tier.
• Communications — if you email support, we keep that correspondence.

What we do with your information

• Match you to jobs. We send your CV-derived profile and recently scraped job descriptions to AI providers for matching. We do this nightly so you have fresh matches each morning.
• Generate cover letters. If you have a paid tier or use a free monthly allowance, we generate AI cover letters for jobs you mark as interested.
• Email you. We send daily match emails and occasional service notifications. You can stop the daily emails at any time without losing access to the website.
• Run the platform. Authenticate you, show you your matches, process your payments, enforce tier limits.
• Improve the product. We may look at anonymous, aggregate data — for example, “how often does our matching produce 9+ scores” — but we do not sell or share your individual usage data.

Legal basis

Under POPIA, we rely on Section 11(1)(a) — your consent for everything we do with your personal information. You give consent when you sign up. You can withdraw consent at any time by deleting your account, which deletes all your personal information.

We rely on Section 11(1)(c) — performance of a contract for billing data once you take a paid subscription, because we need it to fulfil the agreement.

We rely on Section 11(1)(e) — legitimate interest for security logs (IP addresses, login times) — needed to detect and prevent abuse of the platform.

A separate consent for sharing with recruiters

Dawnlist is paired with a sister platform, Talvi, which is a B2B recruiter search service. By default, your information stays inside Dawnlist and is never shared with recruiters or with Talvi.

If you want recruiters on Talvi to be able to find you, you can give us separate, specific consent at any time. This is a distinct tickbox and you must opt in deliberately — your sign-up consent does not include it.

If you opt in, we will share with Talvi:

• Your name
• Your professional headline
• Your location at city or province level
• A summary of your skills and experience drawn from your CV
• Your work history and education
• An AI-generated narrative description of your profile

We will not share with Talvi:

• Your email address (recruiters who want to contact you will route their request through Dawnlist, and we will deliver it to your inbox; you decide whether to reply)
• Your phone number or any private contact information
• Your CV file itself (only the structured profile drawn from it)

You can withdraw your Talvi consent at any time. When you do, we will instruct Talvi to delete the information they hold about you within 30 days, and we will keep an audit record of your withdrawal.

Who we share information with

• Anthropic (United States) — we use Claude AI for CV reading, matching, and cover letter generation. Anthropic does not retain this data for training under their commercial API terms.
• Resend / Amazon SES (Ireland, eu-west-1) — we use this service to send transactional and daily-match emails.
• Stripe (United Kingdom) — payment processing if you take a paid subscription. Dawnlist never sees or stores your full card number.
• Supabase (Ireland, eu-west-1) — our database and authentication provider.
• Vercel (Frankfurt, Germany) — frontend and API hosting.
• Talvi (Pty) Ltd (South Africa) — only if you have given explicit, separate consent to be discoverable by recruiters (see above).

We do not sell your personal information. We do not share it for advertising purposes.

Cross-border transfers

Some of our processors operate outside South Africa. Under POPIA Section 72, we transfer information to these providers because:

• The destination jurisdictions (Ireland, Germany, United Kingdom, United States) have data protection regimes — GDPR for the EU and UK, and contractual safeguards for US providers — that we consider meet POPIA's adequacy threshold.
• The transfer is necessary to provide the service you have signed up for.
• Each processor is contractually bound to use your information only for the purposes we have instructed.

How long we keep your information

• Active account. While your account is active.
• CV file. While your account is active. If you replace it, we delete the old one within 30 days.
• Match history. Rolling 12 months. Older match data is deleted automatically.
• Audit logs of consent and consent withdrawal. 5 years (POPIA accountability requirements).
• Billing records. 5 years (South African tax law).
• After account deletion. We delete your CV, profile, match history, and account record within 30 days. We retain a minimal record (your email and the fact of deletion) so we can prevent your information from being re-added if a future scrape or sync ever uses an external data source. If you don't want even this retained, email privacy@dawnlist.co.za and we will discuss options.

Your rights under POPIA

You have the right to:

• Access. Ask us what personal information we hold about you. Email privacy@dawnlist.co.za and we will respond within 30 days.
• Correct. Ask us to correct anything inaccurate. The fastest way is to update your profile in the app; for things you cannot edit yourself, email us.
• Delete. Delete your account at any time from the settings page. This is the immediate, complete withdrawal of your consent.
• Object. Object to specific processing on legitimate grounds.
• Withdraw consent. Each consent (sign-up, Talvi sharing, marketing emails) is independent and can be withdrawn separately.
• Complain. To the Information Regulator of South Africa at inforeg@justice.gov.za or via inforegulator.org.za. Address: JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001.

AI-specific disclosures

We use AI in three places. We are deliberate about telling you what each one does.

1. CV reading. When you upload your CV, we send the text content (not the file) to Claude (Anthropic) to extract structured information — skills, experience, location, the kind of role that fits. The extracted profile is stored in our database. You can review and edit it.
2. Job matching. Each night, we send your CV-derived profile and recently scraped job descriptions to Claude to score the match between you and each job. Scores 7+ make it into your daily email.
3. Cover letter generation. If you mark a job as interested, we send your profile and the job description to Claude to draft a cover letter. You review and edit before sending.

We do not use your information to train AI models. Our AI providers are contractually committed not to retain your data for their own training.

Cookies

Dawnlist uses essential cookies for authentication and session management. We do not use advertising cookies or third-party tracking pixels. We do not run analytics that profile you across other websites.

Security

We protect your information with TLS encryption in transit, encrypted storage at rest, and row-level security in our database (you can only see your own data). Authentication is by magic link, so there is no password for an attacker to steal.

If we ever experience a security compromise that affects your information, we are required by POPIA to notify you and the Information Regulator within 48 hours of becoming aware of it. We will do this.

Changes to this notice

We may update this notice from time to time. The effective date at the top will reflect the most recent version. If we change anything material — particularly anything that affects what we do with your information or who we share it with — we will email you before the change takes effect.

Contact

privacy@dawnlist.co.za for any privacy questions or to exercise any of the rights above.