Privacy Policy

1. Introduction

This Privacy Policy explains how Go Live AI (Pty) Ltd (Registration: 2025/951591/07), trading as SuperScout, collects, uses, stores, and protects your personal information when you use our AI-powered recruiting platform at www.superscout.co.za.

We are committed to complying with the Protection of Personal Information Act 4 of 2013 (POPIA), the General Data Protection Regulation (GDPR), and other applicable data protection laws. We also align our governance practices with the King IV Code on Corporate Governance.

2. Responsible Party / Data Controller

3. Purpose of Processing

We process personal information for the following purposes:

• CV Analysis & Scoring: Extracting and analysing candidate information from uploaded CVs against job descriptions using AI.
• AI-Powered Chat (Scout): Enabling recruiters to query and compare candidate profiles through our AI assistant.
• AI Voice Screening Interviews: Running voice interviews with shortlisted candidates on behalf of the customer who invited them.
• Account Management: Creating and maintaining user accounts, managing the prepaid credit wallet, and processing payments.
• Service Improvement: Improving platform performance, accuracy, and user experience.
• Communication: Sending service-related notifications and updates.

4. Legal Basis for Processing

We rely on the following legal grounds in accordance with POPIA Section 11 and GDPR Article 6:

• Consent: You provide explicit consent when you create an account, upload CVs, or submit candidate data for analysis.
• Contractual Necessity: Processing is necessary to deliver the services you have requested.
• Legitimate Interest: We process data to improve our services, ensure platform security, and prevent fraud, provided this does not override your rights.
• Legal Obligation: We may process data to comply with applicable laws, regulations, or court orders.

5. What We Collect

Customer / Account Holder Data

• Full name and email address
• Organisation name
• Phone number, if you give it to us, for example in a message to us
• Account credentials (securely hashed)
• Wallet top-ups and transaction history. Payments are handled by PayFast and we never store your card details.
• The job descriptions and CVs you upload

Candidate Data (from uploaded CVs and interviews)

• Full name and contact details (email, phone number, address)
• Employment history and job titles
• Educational qualifications and certifications
• Skills, competencies, and professional summaries
• Voice screening interview recordings and transcripts, where the candidate takes an interview
• Any other information contained within the uploaded CV document

6. AI Processing

Candidate scores, rankings, summaries and interview reports are produced by AI models. They are decision support only: a person at the customer makes every hiring decision.

Customer data and candidate data are not used by us or our AI providers to train models.

7. How Data Is Collected

• Directly from you: When you register an account, update your profile, contact us, or upload documents (CVs, job descriptions).
• Automated means: Through authentication tokens and session data when you interact with the platform.
• From uploaded documents: Our AI extracts personal information from CVs you upload for analysis purposes.

8. Data Storage and Security

We implement robust technical and organisational measures to protect your data, in compliance with POPIA Section 19 and GDPR Article 32:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at Rest: All stored data, including databases and file storage, is encrypted at rest using AES-256 encryption.
• Row-Level Security (RLS): Database access policies ensure users can only access data belonging to their own organisation.
• Private Storage: Uploaded CVs and job descriptions are stored in private, access-controlled storage buckets scoped to your organisation and project.
• Role-Based Access Control: Within each organisation, access is restricted by role (admin, recruiter), ensuring only authorised personnel can view candidate data.
• Authentication: User accounts are protected by industry-standard authentication with secure password hashing.
• Security reviews: We review our database access rules, dependencies and hosting configuration on an ongoing basis.

9. Data Retention

In accordance with POPIA Section 14 and GDPR Article 5(1)(e), we retain personal information only for as long as necessary to fulfil the purposes for which it was collected:

• Account Data: Retained for the duration of your active account and for a reasonable period thereafter to comply with legal obligations.
• Project and Candidate Data: Retained for as long as the project exists in your account. You may delete projects and associated candidate data at any time.
• Payment Records: Retained for the period required by applicable tax and financial regulations (typically 5 years).
• Chat History: Retained within the associated project. Deleting a project removes all associated chat history.

Upon account deletion or request, all personal data will be securely destroyed or anonymised unless retention is required by law.

10. Candidates

This section is for people whose CV was uploaded to SuperScout by a recruiter, or who applied for a role through a SuperScout application link. More detail is on our page for candidates.

• Who is responsible: The customer (the hiring organisation) that uploaded your CV is the responsible party for your information. SuperScout acts as an operator and processes it only on their instructions.
• What we do with it: Your CV is used only to screen you for the role it was uploaded for. We process it with AI to produce scores and summaries, which are shown only to that customer.
• How long data is kept: Your data is kept until the customer deletes the project or their account. We delete it sooner if you ask us to.
• Your rights: You can ask what we hold about you and ask for it to be corrected or deleted by emailing info@go-liveai.com, or by contacting the recruiter directly.

Voice screening interviews

A customer can invite a shortlisted candidate to an AI voice screening interview. The candidate receives an email with a personal link and starts the interview themselves in a web browser, using their microphone. SuperScout does not phone the candidate.

• The interview runs on the customer's behalf, using questions the customer chose.
• Before it starts, the interview page tells the candidate they will speak to an AI interviewer and that the interview is recorded and shared with the hiring team. The candidate can decline by simply not starting it.
• The interview is recorded and transcribed, and Scout produces a scored report for the customer.
• Recordings and transcripts are stored with the customer's project and deleted with it.

11. Your Rights as a Data Subject

Under POPIA (Sections 23 to 25) and GDPR (Articles 15 to 22), you have the following rights:

• Right of Access: Request confirmation of whether we hold your personal information and obtain a copy of it.
• Right to Rectification: Request correction or updating of inaccurate or incomplete personal information.
• Right to Erasure (Right to be Forgotten): Request deletion of your personal information, subject to legal retention requirements.
• Right to Restrict Processing: Request limitation of how your personal information is processed.
• Right to Object: Object to the processing of your personal information on grounds relating to your particular situation.
• Right to Data Portability: Receive your personal information in a structured, commonly used format.
• Right to Withdraw Consent: Withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact our Information Officer at info@go-liveai.com. We will respond within 30 days as required by POPIA, or without undue delay (and within one month) as required by GDPR.

12. Third-Party Service Providers

We engage trusted third-party processors to deliver our services. These include:

• Supabase: Database, authentication and file storage.
• Google: Gemini AI models that read CVs and job descriptions to produce scores and summaries.
• ElevenLabs: AI voice screening interviews, including interview recordings.
• PayFast: Payment processing.
• Lovable: Website hosting and analytics, and delivery of our emails (sign-up and account emails, application acknowledgements and interview invites).

Some of these providers store or process data outside South Africa. Where that happens we rely on the provider's contractual data protection commitments as permitted by section 72 of POPIA, and your candidate data is never used by us or our AI providers to train their models.

13. Cross-Border Data Transfers

Some of our service providers may process data outside of South Africa. In such cases, we ensure compliance with POPIA Section 72 and GDPR Chapter V by:

• Ensuring the recipient country provides an adequate level of data protection, or
• Implementing appropriate safeguards such as standard contractual clauses, or
• Obtaining your explicit consent for the transfer where required.

14. Cookies and Session Management

Our marketing pages do not set cookies of their own. When you sign in, SuperScout keeps your login session in your browser's local storage so you stay signed in securely. Your light or dark theme choice is also remembered in local storage.

We use Lovable's privacy-focused analytics to count page visits and understand how the site is used. This analytics tool is a required part of our hosting platform and does not serve advertising. We do not use advertising cookies or sell your data.

15. Children's Privacy

SuperScout is a business-to-business recruitment tool and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child, we will take immediate steps to delete it in accordance with POPIA Section 35 and GDPR Article 8.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on this page with a revised "Last updated" date.
• Sending an email notification for significant changes that affect your rights.

We encourage you to review this policy periodically.

17. Contact Us & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Complaints

If you are not satisfied with our response to your concern, you have the right to lodge a complaint with the relevant supervisory authority: