Privacy policy
Last updated [date]. Version 1.1.
This policy explains what personal information Mennula collects, why, who we share it with, how long we keep it and what your rights are under the Protection of Personal Information Act (POPIA).
1. Who we are
Mennula is recruiting software for recruitment agencies in South Africa. It is provided by [Company name] (Pty) Ltd, registration number [registration number] ("Mennula", "we", "us"), at [physical address].
Our Information Officer is [Information Officer's name]. You can reach them at privacy@mennula.com or on [phone number].
2. Our two roles
When we decide why and how information is used, we are the responsible party. This covers people who visit our website, contact us, join early access, test Mennula, or use it as part of an agency, and the people who pay us.
When an agency uses Mennula, the agency is the responsible party and we are its operator. This covers the candidates, clients and contacts an agency adds to Mennula. We only use that information to do what the agency asks, under a written operator agreement. If you're a candidate, the agency that holds your CV is the one to contact first. Our candidate privacy notice explains how it works, and we will help the agency answer you.
3. What we collect and why
| Who | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitors | Pages viewed, counted without cookies and without identifying you. Our servers also log IP addresses and browser details | To see which pages help, and to keep the site secure | Our legitimate interest in running a safe website |
| People who contact us or join early access | Name, agency name, work email, mobile number, your message, how many recruiters you have, and whether you want product news | To reply, arrange demos and invite you when we open | Your request, and your consent for product news |
| People who use Mennula at an agency | Name, work email, mobile number, role, sign-in records, settings, and a record of actions in the audit log | To provide the service, keep accounts secure and show the agency who did what | Our contract with your agency, and our legitimate interest in security |
| Billing contacts | Name, email, plan, invoices and payment status. Card details go straight to Paystack; we never see full card numbers | To bill the agency and keep tax records | Our contract, and tax law |
| Anyone who asks for help | Your messages and notes of calls | To solve the problem and improve Mennula | Our contract or your request |
| Phase 1 testers and people who try a demo | Name, email, agency, feedback on ratings, and any sample CVs you choose to share | To run the test and improve the rating system | The test agreement, signed before any real CVs are shared |
| Recruiters who switch on WhatsApp alerts | Mobile number | To tell you when something needs your OK | Your choice to switch alerts on |
We don't ask for, and don't want, special personal information about you (such as race, religion, health or criminal records) or information about children.
4. Candidates and clients
When an agency adds a CV or a client contact, we process it only to do what the agency asks: read the CV, match it to jobs, prepare messages for the agency to approve, book interviews and keep records. We do this under an operator agreement that requires us to keep it confidential and secure. We don't use it for our own purposes, we don't sell it and we don't use it to train AI.
5. How we use AI
To read CVs and job ads, compare them and draft messages, we send text to an AI service run by Anthropic in the United States. Before anything is sent, our servers in South Africa remove names, phone numbers, email addresses, ID numbers, street addresses and places that could identify someone. Anthropic does not use it to train its models and deletes it after a short period. [Confirm the period in Anthropic's current commercial terms, or change this to "does not keep it" once a zero data retention agreement is signed.]
Mennula's scores and suggestions are advice. A person at the agency makes every decision about a candidate, and nothing is sent to a candidate or client until a person approves it. Mennula never rejects anyone on its own.
6. Who we share information with
We share personal information only with the providers we need to run Mennula, under written agreements, and only for that purpose:
| Provider | What they do | Where |
|---|---|---|
| xneelo | Hosts our servers, databases, files and backups | Johannesburg, South Africa |
| Amazon Web Services | Sends system emails such as sign-in links, and stores encrypted backup copies | Cape Town, South Africa |
| Anthropic | Reads stripped CV text and job ads, and drafts messages | United States |
| Paystack | Takes card and EFT payments from agencies | South Africa and other countries it operates in |
| Meta (WhatsApp) | Sends WhatsApp messages, only for agencies with the add-on and only to people who agreed | Outside South Africa |
If an agency connects its own mailbox (Microsoft 365, Google or another email provider) or job boards, information moves between Mennula and those services because the agency asked for it. Job boards only ever receive job details, never candidate information.
We may also disclose information when the law requires it, for example under a court order. We never sell personal information.
7. Information sent outside South Africa
Everything is stored in South Africa. Some steps send information abroad: stripped CV text to Anthropic, WhatsApp messages through Meta, and payment details through Paystack. We only use providers bound by agreements that protect personal information to a standard similar to POPIA, and we send the minimum each step needs.
8. How long we keep information
| Information | How long |
|---|---|
| Website server logs | 30 days |
| Contact and early-access enquiries | Until we've answered and you no longer want to hear from us, or 24 months, whichever comes first. Sooner if you ask |
| Agency user accounts | While the agency uses Mennula, then 30 days after it leaves. Audit log entries keep a person's name and email for as long as the agency's records exist |
| Billing records and invoices | 5 years, because tax law requires it |
| Phase 1 and demo CVs, text and profiles | Deleted 30 days after each test run. Anonymous feedback is kept |
| Candidate data an agency holds | Deleted automatically after 24 months with no activity, on request, or 30 days after the agency leaves |
| Backups | Overwritten within 35 days |
9. How we protect it
- Servers and backups are in South Africa.
- Each agency has its own database and its own encryption key.
- Files and sensitive fields are encrypted, and all traffic uses HTTPS.
- Only people an agency invites can see its information. Our staff can only look when an agency admin grants access for a set time, and every look is logged.
- We test restoring our backups and have a plan for incidents.
If personal information is accessed by someone who shouldn't have it, we will tell the affected agency without delay, and we or the agency will tell the Information Regulator, through its eServices portal, and the people affected as soon as reasonably possible, as POPIA requires.
10. Cookies
We only use cookies that Mennula needs to work, such as keeping you signed in and protecting forms from abuse. We don't use advertising or tracking cookies, and our website analytics don't use cookies at all.
11. Marketing
We only send product news if you ask for it. Every message tells you who it's from and how to stop, and stopping is free. Saying nothing is never taken as agreement. If we contact a business for the first time to ask whether it wants to hear about Mennula, we do it only once, say who we are, and don't contact you again if you say no or don't reply.
12. Your rights
You have the right to:
- ask whether we hold your information, and for a copy of it;
- ask us to correct, update or delete it;
- object to how we use it, including for marketing;
- withdraw consent you've given;
- not be subject to a decision made only by a computer that significantly affects you;
- complain to the Information Regulator.
You can ask by email to privacy@mennula.com, by WhatsApp on [WhatsApp number], or through the self-service link in any notice we sent you. It's free. We may ask you to confirm who you are. We will reply within 30 days and let you know once a correction or deletion is done. If your information is part of an agency's records, we will pass your request to the agency and help it answer.
For access to other records, see our PAIA manual.
13. Children
Mennula is not meant for people under 18, and we don't knowingly collect their information.
14. Changes
When this policy changes, we update the date at the top and email the agencies that use Mennula. Earlier versions are kept and available on request.
15. Contact and complaints
Our Information Officer: [Information Officer's name], privacy@mennula.com, [phone number], [postal address].
The Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191. Email enquiries@inforegulator.org.za, phone 010 023 5200, website inforegulator.org.za. We'd appreciate the chance to fix a problem first, but you can go to the Regulator at any time.