Hassle BotLast updated: 9 September 2026
CDSoft (Pty) Ltd trading as Hassle Bot
Before you create an account
When you use Hassle Bot without signing up, your conversation is processed by our AI provider (Anthropic) to generate responses.
What we collect
- Consent record: When you accept our terms, we store a record that consent was given, the text shown, and a timestamp. This is linked to a random session identifier — not your name or email.
- Chat messages: Your conversation is stored on Cloudflare infrastructure to maintain context across messages. Messages are keyed to a random visitor identifier.
- Session cookie: We set an HTTP-only cookie (
hb-session) containing a random identifier. No personal information is stored in the cookie.
What we don’t collect
- No name, email, phone number, or account information
- No IP-based tracking or analytics profiling
- No marketing analytics or tracking pixels
How long we keep it
If you chat but don’t create an account, your conversation and session data are automatically deleted after 14 days.
Clearing your data
You don’t have to wait — on the sign-up page, you can click “Not you? Start fresh” to clear your session immediately. This permanently disconnects you from the conversation — we have no way to retrieve it.
What we recommend
Don’t share sensitive personal information (ID numbers, banking details, medical information) in chat. While we don’t link conversations to your identity, the data exists on our infrastructure.
When you create an account
When you sign up or log in, we collect additional information to provide the CV review service.
What we collect
| Data | Why |
|---|---|
| Email address | Account identity, verification, sending your CV review, occasional news and offers about our own service (one click stops those — see the Terms) |
| CV file (PDF/Word) | The service — reviewing and rewriting your CV |
| Chat history | Context for your CV review, career goals, conversation with Hassle |
| Payment reference | Record of purchase, transaction ID |
| Consent record | Proof you accepted terms (POPIA requirement) |
All data is stored on Cloudflare infrastructure.
What we don’t collect
- No passwords (we use email verification codes)
- No social media profiles
- No browsing history or device fingerprinting
Cross-device
When you log in on a new device, your account, CV, and chat history are available. We link your new session to your existing account — your data follows you, not the device.
How long we keep it
Your account, CV, and chat history are kept while your account is active. If you don’t log in for 12 months, we’ll email you a warning. If there’s no response after 30 days, your account and all associated data are deleted.
Payment and consent records are kept for 5 years as required by South African tax and consumer protection law.
You can request deletion at any time by contacting us.
Logging out
Logging out clears your session on that device. On a shared computer, log out to prevent the next person from seeing your conversation.
Payment
Payment is processed by PayFast (Network International). We do not see or store your card details. PayFast sends us a confirmation with a transaction reference and amount — no card numbers, no bank details.
Your email address is shared with PayFast for the payment form.
CV processing
Your CV is read by AI (Claude by Anthropic) to generate a review and rewrite. The CV content is sent to Anthropic’s API. Anthropic does not train on API inputs — see their API terms.
The generated rewrite is reviewed by a human before being sent to you. We store the original CV, the AI-generated output, and the final approved version.
What your CV might contain
South African CVs often carry more personal information than CVs elsewhere, because older local templates ask for it. Race, health or disability details are what POPIA calls special personal information — a category the law protects more strictly than ordinary personal information. An ID number and a photograph aren’t in that category, but they identify you closely and travel with the document wherever it goes.
Please leave it out. We don’t use your ID number, photograph, race, marital status or health details to review or rewrite your CV. If you include them we’ll process them as part of the document — but we’d rather not hold them, and you lose nothing by removing them first. Modern South African CV convention is moving the same way, and we write about that too.
If you do include them, they are processed and stored as part of your CV, and sent to Anthropic with the rest of the document.
Contact form and inbound email
Messages you send us through the contact form or by email are screened automatically:
- Bot check (contact form only): the form uses Cloudflare Turnstile to verify the submission comes from a human. It runs invisibly — Cloudflare processes technical browser signals for the check, and it does not track you across sites. See Cloudflare’s privacy policy.
- Spam screening: if you’re not registered with us, the text of your message may be sent to our AI provider (Anthropic) to tell genuine messages from spam — so real messages get a reply and spam gets none. Anthropic does not train on API inputs.
Messages screened as spam are stored but never replied to, and fall under the same retention rules as other unconsented inbound mail.
Error tracking
We use Sentry to monitor errors in the application. When something goes wrong, Sentry receives technical details about the error — stack traces, request URLs, and browser/OS information (e.g. browser name, operating system). This is not used for tracking or fingerprinting. It does not receive your CV content, chat messages, or email address.
Data processors
| Provider | Role | Location | Legal basis | Terms |
|---|---|---|---|---|
| Cloudflare | Infrastructure (processing at nearest edge, storage in US/EU) | Global | Contract performance | Cloudflare DPA |
| Anthropic | AI processing | US | Contract performance | Commercial Terms |
| PayFast | Payment processing | South Africa | Contract performance | PayFast T&Cs |
| Resend | Transactional and service email | EU | Contract performance | Resend DPA |
| Sentry | Error tracking | EU | Legitimate interest | Sentry DPA |
All cross-border transfers are disclosed here as required by POPIA Section 72.
Security
All data is transmitted over HTTPS. Authentication uses email verification codes — no passwords are stored. Cloudflare provides infrastructure-level security including DDoS protection and encryption; as part of this, Cloudflare processes IP addresses at the network level for security, but we do not log or use IP addresses for tracking or analytics.
Data breaches
If a security compromise affects your personal information, we will notify you and the Information Regulator as soon as reasonably possible, as required by POPIA (section 22).
Children
Hassle Bot is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.
Your rights under POPIA
As a South African data subject, you have the right to:
- Access — request a copy of your personal information
- Correction — request updates to inaccurate data
- Deletion — request removal of your data
- Object — object to processing for direct marketing
- Complaint — lodge a complaint with the Information Regulator
For pre-registration chat, the “Start fresh” option clears your session immediately. We hold no data that can identify you.
For registered accounts, contact us to exercise your rights. We will respond within 30 days.
For how to request access to records CDSoft holds — including the applicable PAIA forms and fees — see our PAIA Manual.
Contact
Information Officer: Brent Greeff (CDSoft (Pty) Ltd) Contact us
Back to chat