Privacy and POPIA

What we collect, and why

No account, if you only search

Browsing and searching this site requires no account, and we never ask who you are.

Counts of what the site is used for

Purpose: to know whether the site is useful, not just visited. We count, per day, how many source PDFs are opened, email alerts confirmed and WhatsApp channel links followed, and where the visit started (for example "Google" or "ChatGPT"). Cookie: one first-party cookie, gp_src, holding only that word for where the visit started. It has no identifier and is deleted when you close your browser. Stored: the daily counts, never who did what.

How pages are used, through Microsoft Clarity

Purpose: to see where the site is confusing — which parts of a page people reach for, and where a search goes nowhere. Microsoft Clarity records how a visit moves through the page (clicks, scrolling, and the path taken between pages) and can replay it as an anonymous session. Lawful basis: our legitimate interest in keeping the site usable. Cookies: it sets two first-party cookies, _clck to recognise a returning browser and _clsk to group one visit together. They hold identifiers, not your name or address. Who processes it: Microsoft, as our processor, under the Microsoft Privacy Statement. Where it does not run: not on the admin pages, not on your account pages or the saved list, and not on the pages a link in an email takes you to. On the alerts form, the form itself is marked so that Clarity records that the form was used but never what you typed in it. It is not used to identify you. Clarity also tries to sync an advertising identifier with Bing; our content security policy blocks that request, so it does not happen, and nothing here feeds advertising. If you would rather not be recorded at all, any content blocker, or a browser setting that blocks third-party scripts, will stop it.

Your email address and saved search, if you sign up for alerts

Purpose: to send you a weekly email listing new posts matching your saved search. Lawful basis: your explicit consent, which we record with a timestamp and the exact wording you agreed to. We also record which posts we have already sent you, so we do not send the same one twice.

Your email address and message, if you send feedback

Purpose: to understand what would make the site more useful, and to email you when something you asked for goes live (and, occasionally, about related govposts updates). Lawful basis: your consent, which we record with a timestamp and the version of the wording you agreed to. We ask you to confirm your address, and only confirmed addresses get launch emails. Stored: your email, your message, the optional name and province you give, the page address you sent it from (without its query string), the address of the page that referred you, your browser's user agent, and a salted one-way hash of your IP address (never the address itself), used only to stop spam and erased by our nightly housekeeping once it is more than 24 hours old. Who processes it: your message is read by an AI model (Anthropic) to sort and prioritise it, and spam checking uses Cloudflare Turnstile. Your email is never shown publicly; the "What's new" page shows only how many people asked. Kept: until you ask us to delete it. If you never confirm your email address, we erase it and your name after 30 days; the feedback itself is kept. Every email has an unsubscribe link.

Your details, if you ask for a developer key

Purpose: to issue and manage the free widget and API keys on /developers: sign-in links, notices about your keys, and stopping abuse. Lawful basis: your consent, recorded with a timestamp and the version of the terms you agreed to. Stored: your name, email, organisation and its type, website, the domains you register, what you said you would use it for, and daily usage counts for your keys. Keys and sign-in links are stored only as one-way hashes. Where your widget is installed, we record the address of the page it appears on (never a visitor's details) and check that page weekly for our link. Never shown publicly, and never used for marketing. Kept: until you delete your account from the dashboard, which removes all of it at once.

Your account details, if you create an account

Purpose: to let you save jobs and track your applications. Passwords are stored only as a salted PBKDF2 hash — we cannot read them. Your application tracking notes are visible only to you. Failed sign-in attempts are recorded against a hash of the email address for up to two days, to stop password guessing.

How long we keep it

• Unverified signups: reminded to confirm at most three times (3, 7 and 14 days after signing up), then never again, and deleted after 30 days if you never confirm your address.
• Unsubscribed addresses: deleted within 30 days of unsubscribing.
• Active alert subscriptions: kept until you unsubscribe.
• Accounts: kept until you delete the account. Deletion removes your saved jobs and application tracking permanently.
• Records of sent alerts: deleted with the subscription they belong to.

Cookies

• vb_session, account sign-in: keeps you signed in. It is deleted when you sign out or delete your account, and after 30 days at the latest. Expired sessions are also erased from our database each night.
• gp_src, where your visit started: described above. Deleted when you close your browser.
• _clck and _clsk, Microsoft Clarity: described above.
• gp_theme, your dark or light choice: set only when you switch theme, and kept for a year.
• gp_tenders_seen, for the site operator: set only on the admin tenders page, and kept for a year.

Who we share it with

We do not sell or rent your information, and we never share your email address or your account. Our service providers process it on our behalf: Cloudflare (hosting, security and Turnstile spam checks), Resend (email delivery), Anthropic (AI sorting of feedback text, and of public circular text when we extract job details), and Microsoft Clarity, as described above. These providers may process it outside South Africa, under their own terms, as section 72 of POPIA permits.

Your rights

Under POPIA you may ask us to:

• tell you what personal information we hold about you;
• correct anything that is wrong;
• delete it;
• stop using it — every alert email has an unsubscribe link, and your mail app's own Unsubscribe button works too.

To exercise any of these, use the unsubscribe link in any alert email, or contact us at the address below. You may also complain to the Information Regulator (South Africa).

About the job data

Job listings on this site are extracted from the DPSA Public Service Vacancy Circular, a public document. We are not affiliated with the DPSA or any department. Where the circular does not state something, we say so rather than guess — and every job page links to the exact page of the original PDF so you can check it yourself.