Attaché Privacy Policy

Last updated: 2026-10-20

This Privacy Policy explains how Attaché ("Attaché," "we," "us") collects, uses, stores, and protects your personal information when you use Attaché on the web (attachecv.com), in the Attaché Android app, and through related services (together, the "Service").

Attaché is available to students and jobseekers across Africa and in other countries. This Policy is written to meet the requirements of both Zimbabwe's Cyber and Data Protection Act [Chapter 12:07] and South Africa's Protection of Personal Information Act (POPIA). Where the two laws differ, we follow whichever standard gives you stronger protection.

If you are a Zimbabwe-registered user, the Cyber and Data Protection Act governs your rights below. If you are a South Africa-registered user, POPIA governs your rights below. Your account's registered country determines which applies to you; see Section 8.

1. Who We Are

Attaché is a job and internship discovery platform for students and jobseekers. Attaché is the responsible party for your personal information under this Policy.

For any privacy question or request, contact: contact@meshiaret.com

2. What Data We Collect

Category	Examples	Source
Account & authentication data	Name, email address, hashed password (email/password signup), or OAuth identity token and basic profile (Google sign-in)	You, via our sign-in provider or Google sign-in
Account metadata	Registered country (chosen at signup and changeable in Settings), city, account settings, contributor tier, signup date	You, at signup and in Settings
Approximate location	Only if you tap "Use my current location" when picking your city: your device's approximate position, used once on your device to find the nearest listed city. The position itself is never sent to us or stored - only the city you then pick is saved.	Your device, with your permission
CV / résumé contents	The uploaded CV file itself (PDF/DOCX etc.), kept in secure cloud storage	You, via CV upload
Parsed profile data	Skills, work experience, education/degree, bio, links, extracted from your CV by an AI model	Derived from your CV, reviewed/edited by you before saving
Career goals	Freeform text describing what you're working toward, and your selected field(s) of study	You, via the Career Journey / Career fields selector
Application history	Jobs you've applied to, application status (Applied/Interview/Rejected/Accepted), timestamps, AI-generated application email drafts	Generated as you use the Apply Flow
Insights & feedback data	AI-computed job matches, skill gaps, CV feedback checklist items and completion state	Generated by our AI from your profile
Job interaction data	Archived/saved jobs, submitted job flyers (photos), job reports (flagged listings)	Generated as you use Navigator
Meshy data	Companies you save to your pipeline and their status, your notes and outreach drafts, companies you suggest, and your Meshy Chat conversations	Generated as you use Meshy
Device/usage data	App version, device model and operating system version, error and crash reports (what went wrong and where in the app), theme preference, which screens you visit and which features you use (for example "generated CV feedback"), page-load speed, and the campaign tags (`utm_*`) in the link you first arrived from	Automatically, through our error-monitoring and analytics tools. Usage events are linked to your account id, never to your name, email or CV contents
Payment records	If you buy a Job Hunt Pass: the pass, amount, payment method, status, time, and your phone number or payment reference where the method needs it. We never receive your PIN, card or bank details	You and our payment provider, at checkout
Feedback you send us	Your 1-5 rating, anything you write in the feedback box, the screen you sent it from, and the campaign tags of the link you first arrived from	You, via Settings → Send feedback
Advertising measurement data	Meta Pixel cookies (`_fbp`, `_fbc`), the ad-click identifier in your landing URL (`fbclid`), your IP address and browser user-agent, and a one-time random event identifier - sent to Meta together with a one-way hashed form of your email address and account id when you finish creating an account	Automatically, if you arrived from one of our ads

We do not knowingly collect sensitive categories of personal information (health, biometric, religious, political, criminal history, etc.) - nothing in Attaché's flows asks for these, and if your CV happens to contain any (e.g., a disclosed disability in a cover letter you upload), we don't process it separately from the CV file itself.

Android app permissions. The Android app asks for approximate location only - never precise or background location - and only when you tap "Use my current location". It does not access your contacts, camera, microphone or photo library; any file you upload, such as your CV or a job flyer, is one you pick yourself.

3. Why We Collect It

We only process your data for purposes tied to running the Service:

To create and secure your account (auth data)
To parse your CV and build your profile so we can show you relevant jobs (parsed skills/experience, career goals)
To match you to jobs and generate feedback (Insights, CV Feedback)
To let you apply to jobs and track your applications (application history, AI-drafted emails)
To operate the job board itself (aggregating and displaying listings; your archived/flagged jobs)
To help you reach companies directly and answer questions about your job hunt (Meshy search, pipeline and Meshy Chat)
To set your city from your location, only when you ask (approximate location, processed on your device)
To enforce fair use (application quotas, contributor tiers)
To process payments for an optional Job Hunt Pass, where you buy one
To maintain and secure the Service (device/usage/error data)
To understand how Attaché is used and improve it (usage events and feedback: which steps people get stuck on, which features they use, whether they come back)
To communicate with you about your account (e.g., confirmation emails)
To measure our advertising (to know which of our ads led to real signups, so we don't waste budget on ads that don't work - see "Advertising and cookies" below)

We do not sell your personal information. We do not share your CV, profile, career goals, applications, or Insights with any advertiser. The only data used for advertising is the measurement data described below, and it is limited to telling Meta that a signup happened.

Legal basis for processing

Under both the Cyber and Data Protection Act and POPIA, we rely on:

Consent - for CV upload/parsing, career goals, Meshy Chat, using your device's location, and any AI-generated content, which are actions you initiate.
Contractual necessity - for account and application data, which is necessary to provide the Service you've signed up for.
Legitimate interest - for basic device/error logs needed to keep the app working, kept to the minimum necessary.

We share data only with the service providers that make Attaché work, and only to the extent each one needs. They process it on our instructions and may not use it for their own purposes, unless stated otherwise below.

Recipient	What they process	Why
Cloud hosting and database providers	Account and sign-in data, database records, uploaded CV and flyer files	Running the Service: storage, sign-in and the app's backend
AI model providers	CV text, profile data and career goals, to generate parsed profiles, feedback, insights, and application and outreach drafts. For Meshy Chat, your messages and the parts of your account they draw on (profile, CV feedback, Insights, applications and pipeline)	Powering the AI features you choose to use
Error-monitoring provider	Error and crash reports: what went wrong and where, the app version, device model and operating system, the screen involved, and your account id (not your name or email)	Finding and fixing bugs
Product-analytics provider	Usage events linked to your account id (not your name or email), device type, approximate country from your IP address, and page-load speed. We don't record your screen or what you type	Understanding which parts of Attaché work and where people get stuck
Website hosting provider	Standard request data needed to serve pages (IP address, browser user-agent) and anonymous page-view counts	Serving the website
Google	Your Google identity, if you sign in with Google. The city and sector you search in Meshy, to find companies (no personal details). In the Android app's map, the standard technical data needed to load the map, such as your IP address	Google sign-in, and finding and showing companies with Google Maps. Google handles this data under the Google Privacy Policy
Meta (Facebook)	Advertising measurement data only: `_fbp`/`_fbc` cookies, `fbclid`, IP address, user-agent, and a one-way hash of your email and account id, sent when you complete signup	Measuring which of our ads produce signups
Paynow	If you buy a Job Hunt Pass: the amount, the payment method, and your phone number or reference where the method needs it. Your PIN, card or bank details go to Paynow or your mobile wallet, never to us	Taking payment for a Job Hunt Pass (Zimbabwe only)

You can ask us for the current list of the service providers in each category at contact@meshiaret.com.

We do not otherwise sell, rent, or share your personal information with third parties, except:

Where required by law (e.g., a valid legal request from a Zimbabwean or South African authority)
If Attaché is acquired or merges with another entity, in which case your data would transfer under this same Policy (you'll be notified)

Aggregated job listings you see in Navigator come from public job boards, employer postings, or other users' submitted flyers — we don't share your data with these sources; we only pull their public listings in.

Advertising and cookies

We advertise Attaché on Meta's platforms (Facebook and Instagram). To know whether those ads actually produce signups rather than just clicks, we run the Meta Pixel on our website and tell Meta when a signup happens.

What is sent, and when. A single signup event at the moment you finish setting up your account. It carries the measurement data listed in Section 2. Your email address and account id are hashed one way before they are sent - Meta receives the hash, never the address itself. No CV, profile, job, or application data is ever included.
Cookies. The Meta Pixel sets _fbp (a browser identifier) and, if you arrived by clicking one of our ads, _fbc (derived from the fbclid in that link). These are advertising cookies, not required for the Service to function - blocking them in your browser, or using a tracker blocker, does not affect your ability to use Attaché.
Page views. Because the Pixel loads on our site, Meta also receives a page-view signal as you browse it.
Legal basis. We rely on legitimate interest in measuring our own advertising, limited to the minimum data needed to attribute a signup. You can object to this - see Section 7 - and you can prevent it entirely by blocking third-party cookies or scripts from facebook.net and facebook.com.

Meta acts as an independent controller for the data it receives here, under its own Data Policy.

Cross-border data transfers

Some of our service providers operate infrastructure outside Zimbabwe and South Africa, so your personal information may be processed on servers outside your country. As required by the Cyber and Data Protection Act (Part VII) and POPIA (section 72), we only transfer personal information to recipients that are bound by law, binding agreements or binding corporate rules to give it a level of protection comparable to the protection it has in your country.

5. How Long We Keep Your Data

While your account is active: we retain your account, profile, CV, application, and Insights/Feedback data for as long as your account exists, so the Service continues to work correctly.
CV versions: when you upload a new CV, the prior version is archived rather than overwritten, so you can still refer back to it. Archived versions and their parsed data are deleted automatically 12 months after they are superseded. Your current CV is never deleted on a timer.
When you delete your account (see Section 6): your uploaded files and their parsed contents are deleted outright, identifying data on remaining records is anonymized immediately, and any remaining copies (including backups) are purged within 30 days.
AI-generated drafts: application and outreach emails we generate for you are kept for 30 days, then deleted. They can always be regenerated.
Meshy: your saved companies, notes and Meshy Chat conversations are kept while your account is active, and deleted when you delete your account.
Error reports: kept for up to 90 days, then deleted automatically.
Usage events: kept for up to 12 months, then deleted.
Payment records: kept for as long as tax and accounting law requires, even after you delete your account.
Feedback: kept while your account is active, and deleted when you delete your account.
Job reports / moderation records: retained for a limited period after resolution (up to 12 months) for accountability and to prevent repeat abuse, then deleted.

We don't keep data longer than the purpose it was collected for requires - this is a requirement under both laws, not just a courtesy.

6. Account Deletion

You can delete your Attaché account at any time from Settings → Delete Account, in the Android app or on the web at attachecv.com/app/settings (sign in, then open Settings). No need to email us - this is in line with app store requirements for account deletion.

When you delete your account:

Your CV file and its parsed contents are deleted, along with any flyer images you uploaded, your Meshy Chat conversations, and your saved Meshy companies, notes and outreach drafts - not anonymized, deleted.
Your profile, career goals, and application history are anonymized immediately - your identifying information is stripped and the account is signed out. The records themselves are kept in anonymized form (see Section 5); the person they belonged to is not recoverable from them.
Any residual copies in backups are purged within 30 days.
Deletion is permanent and cannot be undone once initiated.
Some minimal records (e.g., that a flyer submission was reviewed, stripped of identifying detail) may be retained briefly for moderation accountability, per Section 5.

If you'd rather just stop using Attaché without deleting your account, your data stays as described in Section 5 until you either delete it or it becomes subject to routine retention limits.

7. Your Rights

Under the Cyber and Data Protection Act and POPIA, you have the right to:

Access (portability) - request a copy of the personal information we hold about you. You can do this yourself from Settings, which exports your profile, CVs and parsed CV data, applications, submissions, generated drafts, and your Meshy pipeline and chats as a machine-readable file.
Correction (rectification) - fix inaccurate or incomplete data. Most of this you can do yourself in-app (Review Profile, CV Feedback edits); anything you can't, we'll do on request.
Deletion (erasure) - request deletion of your data. The in-app account deletion (Section 6) covers this; you can also email us to request deletion of specific data (e.g., an old flyer submission).
Object - object to a specific processing purpose (e.g., ask us not to use your data for AI-generated insights, while keeping your account for browsing).
Withdraw consent - for anything based on consent (CV parsing, career goals, AI features), at any time, without affecting the lawfulness of processing before withdrawal.
Complain to the regulator - you can lodge a complaint with:
- Zimbabwe: the Data Protection Authority (established under the Cyber and Data Protection Act, administered via POTRAZ)
- South Africa: the Information Regulator (established under POPIA)

To exercise any of these rights, use the in-app controls where available, or contact contact@meshiaret.com. We'll respond within a reasonable time and in any event within the timeframe required by the applicable law.

8. Which Law Applies to You

Your account records the country you are based in, which you choose at signup and can change at any time from Settings - people move, and moving should not cost you your account. The country you are registered in determines which data protection law primarily governs your rights under this Policy. In practice we apply the same standards and processes to every user regardless of country.

9. Security

We protect your data with reasonable technical and organisational measures, including encryption in transit and at rest, access controls that limit who can see your data, and regular review of our security practices.

No system is perfectly secure, and we can't guarantee absolute security, but we take reasonable, industry-standard steps to protect your data and will notify affected users and the relevant regulator of any data breach as required by law.

10. Minors

Attaché is intended for users 18 years of age or older. We require confirmation of this at signup and do not knowingly collect personal information from anyone under 18. If we learn that a user under 18 has created an account, we will delete the account and associated data. If you believe a minor has created an account, contact contact@meshiaret.com.

11. Changes to This Policy

We may update this Policy as the Service evolves. Material changes will be flagged in-app or via email before they take effect. Continued use of Attaché after a change takes effect means you accept the updated Policy.

12. Contact

Questions, requests, or complaints about this Policy or your data: contact@meshiaret.com