Draft for legal review. This document is being reviewed by a legal practitioner and may change before launch. Version 2026-10-draft-2.
This policy explains what personal information Skills Factory collects, why, who it is shared with, how long it is kept and the choices you have. It is written in line with the Cyber and Data Protection Act [Chapter 12:07] of Zimbabwe and applies to the website at skillsfactory.apexa.site, the Skills Factory app and every service described below.
In short: we use your information to make you job-ready, to connect you with people and employers, and to prepare and send job applications only in the way you choose. We do not sell your information. Your CV and applications go only to employers you apply to.
1. Who we are
Skills Factory is operated by Tronix Incorporation (Private) Limited, 2289 Zengeni Crescent, Old Tafara, Harare, Zimbabwe, in partnership with Thuthuka Tech ("Skills Factory", "we", "us"). Tronix is the data controller: it decides how and why your personal information is used and is responsible for it.
AJA (Automated Job Applications) is the AI engine inside Skills Factory that writes tailored CVs and cover letters and sends applications. It is part of Skills Factory, run by the same team under this policy, not a separate service with its own account.
2. What Skills Factory does
- Job readiness: free practical courses, assessments and certificates that anyone can verify.
- Career tools: a career profile, CV builder, CV upload and reading, AI-written and tailored CVs and cover letters, interview preparation and company research.
- Jobs and applying for you: job listings gathered from employers and public job boards in Zimbabwe and beyond, daily matches, and applications prepared and sent on your behalf with your approval or on auto-pilot.
- Professional network: profiles, connections, follows, posts, comments, likes and a feed that adapts to you.
- Communication: one-to-one messages, photos, documents, voice notes and audio and video calls.
- Employers and events: organisations that post jobs and receive applications, and career events you can register for.
3. Information we collect
Information you give us
| Type | Examples |
|---|---|
| Account | Name, email address, mobile number, password (stored only as a one-way scrambled hash), account type, two-factor settings, sign-in with Google. |
| Career profile | Headline, summary, town, country, career stage, target roles, languages, education, work experience, skills, certificates, projects, memberships, referees and their contact details, LinkedIn link, profile photo. |
| Documents | CVs you build or upload, certificates and other documents you attach to your profile or applications. |
| Job search preferences | Job titles, places, categories, salary expectations, auto-pilot settings, daily limits and employers you never want to apply to. |
| Applications | The jobs you apply to, the CV and cover letter used, the recipient address, the date sent and the outcome you record. |
| Training | Courses you enrol in, lessons completed, assessment answers, scores, attempts and certificates issued. |
| Network content | Posts, comments, likes, connections, follows, reports you make and people you block. |
| Messages and calls | Message text, photos, documents and voice notes you send, and a record of calls (who, audio or video, when, how long, missed or declined). |
| Email sending | If you connect Gmail or your own mailbox so applications come from your address: a Google access token or your mailbox settings and app password, stored encrypted. |
| Payments | Plan chosen, amount, currency, payment reference and status from Paynow. We never see or store your card, EcoCash PIN or bank password. |
| Support and consent | Messages to support, and the date and version of each policy you accepted or marketing consent you gave or withdrew. |
Information collected automatically
- Sign-in and security events, such as successful and failed sign-ins, password changes and two-factor use.
- Activity inside Skills Factory that powers personalisation: posts you like or comment on, people you message or engage with, courses you take and jobs you save or apply to.
- Technical details: IP address (kept in scrambled form where we only need it for abuse protection), browser and device type, and error logs with personal details removed where possible.
Information from other sources
- Public job adverts from employer websites and job boards, which can contain the names and contact details of recruiters.
- Your Google account name and email if you choose to sign in with Google.
- Employers, if they record the outcome of an application you sent them through Skills Factory.
4. How we use it and why
| Purpose | Legal basis |
|---|---|
| Create and run your account, profile, CVs, training and network | Performing our agreement with you |
| Match you with jobs and prepare and send applications | Performing our agreement with you, and your instruction for each application or auto-pilot |
| Issue and verify certificates | Performing our agreement with you |
| Personalise your feed, people suggestions and job matches | Our legitimate interest in a useful service; you can switch to a chronological feed |
| Deliver messages, attachments and calls | Performing our agreement with you |
| Process payments and keep financial records | Performing our agreement with you, and legal obligations |
| Keep the platform safe: spam, fraud and scam-job detection, moderation, security logs | Legitimate interest and legal obligations |
| Send service messages, such as application confirmations, certificate notices and security alerts | Performing our agreement with you |
| Send news about courses, events and opportunities | Your consent, which you can withdraw at any time |
| Understand use of the platform and report outcomes to partners, using totals and statistics that do not identify you | Legitimate interest |
5. AI, CV tailoring and applying for you
- To write or tailor a CV, cover letter, interview preparation or company research, we send the relevant parts of your profile and the job advert to an AI model provider (see section 11). We send only what the task needs. We instruct the AI to use only facts from your profile and never invent qualifications or experience, and we check the result for invented facts before it can be sent.
- AI providers process this information to produce the text and do not get permission from us to use it for advertising. Where a provider offers settings that stop customer content from being used to train its models, we use them.
- When you apply, the CV and cover letter go to the employer's address in the advert. Depending on your settings they are sent from your own Gmail or mailbox, or from the Skills Factory address with replies going to you.
- Auto-pilot applies only to jobs that match your preferences, within your daily limits, and never to employers you have excluded. You can pause it at any time and see every application it sent.
- AI suggestions and match scores are aids, not decisions about you. Employers make their own hiring decisions. You can always review, edit or decline what the AI produces.
6. Training and certificates
- We record your enrolments, lessons completed, assessment answers, scores and attempts so we can show your progress, apply attempt limits and decide whether you passed.
- When you pass, we issue a certificate with a unique code, add it and the course skills to your profile and notify you.
- Certificates are public by design. Anyone who has the code, the link or the QR code can open the verification page, which shows your name, the course, your score, the issue date and whether the certificate is valid or revoked. This is what makes the certificate trustworthy to employers. Only share the code with people you want to verify it.
- We may revoke a certificate obtained by cheating or impersonation, and the verification page will then say it was revoked.
7. Network, feed and personalisation
- You choose who sees your full profile in Settings: everyone on Skills Factory, only your connections and the employers you apply to, or only you. Your name and headline are still shown wherever you post, comment, message or appear in suggestions.
- Posts you share as public can be seen by anyone with a Skills Factory account; connections-only posts are shown only to your connections.
- If you switch on your public portfolio page, anyone with its link can see the details you chose to include on it, even without an account. It is off until you turn it on.
- The For you feed learns from you. It ranks posts using signals such as the people you like, comment on, message and connect with, the skills on your profile, the courses you take and the certificates you earn, along with how recent and popular a post is. Each recommended post shows a short reason, such as "Matches your interests". People suggestions use shared skills, courses, career stage and mutual connections in the same way.
- You can switch to "People I follow" or "Everyone" at any time to see posts in time order without personalisation.
- Blocking someone hides you from each other and stops messages and calls between you. Reports go to our moderators, who see the reported content and the reason; the person reported is not told who reported them.
8. Messages, attachments and calls
- Messages, photos, documents and voice notes are stored on our servers so they are available on all your devices. Attachments are kept in private storage and can be opened only by the people in that conversation.
- Messages are protected in transit with HTTPS encryption. They are not end-to-end encrypted, so authorised Skills Factory staff could access them, but only when a conversation is reported, to investigate abuse, fraud or a security incident, or when the law requires it. Every such access is logged.
- Calls connect your browser or app directly to the other person. Audio and video are encrypted between the devices, and we do not record or store them. Our servers only pass on the technical connection details needed to start the call. Internet connection servers (known as STUN or TURN servers, which may be run by Google or another provider) can see the IP addresses of the two devices so they can connect them; a TURN relay passes on encrypted media it cannot read.
- We keep a call record (who, audio or video, when, how long, missed or declined) in the conversation so both of you can see it.
- Your browser asks your permission before Skills Factory can use your microphone or camera. You can withdraw it in your browser or phone settings.
9. Employers and organisations
- Employers see the applications you send them, including your CV, cover letter and contact details, and any profile information you have made visible to them.
- Employer team members are given access only to their own organisation's jobs and applications. Once an employer has received your application, it is also responsible for how it uses your information under its own privacy policy and the law.
- We do not sell lists of members to employers, recruiters or anyone else.
10. Payments
Paid plans are processed by Paynow (Webdev (Private) Limited), using the method you choose, such as EcoCash, OneMoney, InnBucks or a card. Paynow receives the amount, a reference and the email or phone number needed to complete the payment. We keep the plan, amount, reference, status and dates as financial records.
11. Who we share information with
We share personal information only as described in this policy and only as much as each purpose needs.
| Recipient | What and why |
|---|---|
| Employers you apply to | Your application, CV, cover letter and contact details. |
| Other members | Your profile, posts, comments and messages, as your visibility settings and conversations allow. |
| The public | Certificate verification details for anyone holding the code, and your public portfolio page only if you switch it on. Otherwise profiles and posts are shown only to signed-in members, as your settings allow. |
| AI model providers (such as SambaNova, Groq, Google, Mistral, Cohere or OpenRouter) | The profile facts and job advert needed to write a CV, cover letter or similar text. |
| If you connect Gmail, to send applications from your address; if you sign in with Google, to confirm your identity. | |
| Email and messaging providers | To deliver emails, and WhatsApp alerts if you turn them on. |
| Paynow | To process payments. |
| Hosting and infrastructure providers | To store and run Skills Factory on secured servers, and the STUN or TURN servers used to connect calls. |
| Training and programme partners | Statistics that do not identify you; or, if you join a partner programme, the information its terms describe, with your agreement. |
| Authorities | When the law requires it, or to protect someone's safety, always checked against the law first. |
| A buyer or successor | If Skills Factory is reorganised or sold, under the same protections, and you will be told. |
Service providers may use your information only to provide their service to us.
12. Information outside Zimbabwe
Some providers, such as AI, email, Google and hosting services, process information in other countries. We use them only where the transfer is allowed under the Cyber and Data Protection Act and the provider protects information to a standard comparable to Zimbabwean law. We send them only what the task needs.
13. How long we keep it
| Information | How long |
|---|---|
| Account, profile, CVs, applications, training, certificates, posts and messages | While your account is open. Deleted when you delete your account. |
| Uploaded files and message attachments | Until you remove them or delete your account. |
| Messages you received | Messages the other person sent stay in their account until they delete theirs. |
| Payment and invoice records | Six years, as required by Zimbabwean tax law, even after your account is deleted. |
| Security and audit logs | Up to two years, then deleted or made anonymous. |
| Reports and moderation decisions | As long as needed to keep the platform safe and handle appeals, then deleted. |
| Backups | Deleted information may remain in encrypted backups until they are replaced in the normal cycle. |
14. How we protect it
- All traffic uses HTTPS. Passwords are stored as one-way hashes. Email passwords and access tokens are stored encrypted.
- Uploaded CVs, documents and attachments are kept in private storage and served only to people allowed to see them.
- Staff access is limited to what each role needs, requires two-factor authentication and is logged.
- You can turn on two-factor authentication for your own account.
- No system is perfectly secure. If a breach is likely to put you at risk, we will tell you and the Data Protection Authority as the law requires.
15. Your rights and choices
Under the Cyber and Data Protection Act you have the right to:
- Know and access: download a copy of your information at any time from Settings, then "Download my data".
- Correct: edit your profile, CVs and settings at any time, or ask us to correct anything else.
- Delete: delete your account from Settings. Your profile, CVs, uploaded files, applications, training records, certificates, posts and messages are deleted, apart from the records in section 13 that we must keep.
- Object and restrict: switch off personalisation by using the chronological feed, pause auto-pilot, exclude employers, make your profile private and turn off WhatsApp alerts.
- Withdraw consent: unsubscribe from news using the link in any email or in Settings, and disconnect Gmail or your mailbox at any time.
- Not be subject to automated decisions: AI drafts and match scores never decide whether you are hired; you can review and stop any application.
- Complain: to us first, and to the Data Protection Authority (the Postal and Telecommunications Regulatory Authority of Zimbabwe, POTRAZ).
We answer requests within 30 days and may need to confirm your identity first.
16. Cookies and similar technology
- Essential cookies keep you signed in, protect forms from forgery (CSRF) and remember "keep me signed in". Skills Factory cannot work without them.
- Preference storage in your browser remembers simple choices, such as a dismissed banner.
- We do not use advertising cookies or sell browsing data to advertisers. If we ever add analytics that are not strictly necessary, we will ask you first.
17. Young people
Skills Factory is for people aged 16 and over. If you are under 18, please use it with the knowledge of a parent or guardian. We do not knowingly collect information from children under 16 and will delete it if we find we have.
18. The waiting list
If you joined the waiting list, we collected your name, email, optional mobile number, which option describes you, optional institution or employer, town and interests, your consent choices and a scrambled IP address and browser type to protect the form from abuse. We use these only to confirm your email, invite you at launch, plan the launch and, if you asked, send news. Every waiting-list email has a removal link that permanently deletes your details. We keep them for up to six months after launch, or until you remove yourself or create an account.
19. Changes to this policy
We will update this policy when our services change. The date and version are shown at the top. If a change materially affects how we use your information, we will tell you by email or in the app before it takes effect and, where the law requires, ask for your consent again.
20. Contact and complaints
Privacy questions, requests and complaints: support@skillsfactory.apexa.site. Post: Data Protection, Tronix Incorporation (Private) Limited, 2289 Zengeni Crescent, Old Tafara, Harare, Zimbabwe. If you are not satisfied with our answer, you may complain to POTRAZ as the Data Protection Authority.