Privacy & POPIA notice

ThinkActuary (Pty) Ltd is a South African company operating ThinkActuary Passport, a professional identity service for actuaries. We are the responsible party (data controller) for the personal information you provide through this service, within the meaning of the Protection of Personal Information Act 4 of 2013 (POPIA).

• Account data from Google sign-in — your name, email address, and profile picture.
• Passport content you create — qualifications, exam history, ASSA membership number, skills, interests, work history, references, and any other fields you fill in.
• Photos you upload or capture for your Passport. If you choose to generate a studio-style headshot, your selected source photos are sent to Google's Gemini model strictly to produce your own headshot and not retained for training.
• Operational logs (IP address, device, timestamps) kept briefly for abuse prevention and security monitoring.

• To run the service — show you your Passport, render your public profile if you make it Public, and power the Builder. Lawful basis: performance of the agreement you enter into by signing up (POPIA s11(1)(b)).
• To keep Passport trustworthy and secure — monitor abuse, investigate suspicious activity, and protect the integrity of public profiles. Lawful basis: legitimate interest in operating a safe professional identity service (POPIA s11(1)(f)).
• We do not sell your data, run ad targeting, or share your Passport with third parties other than the sub-processors below.

• Private by default: a new Passport is Private until you choose to make it Public.
• Your public link is controlled by you: when you switch to Public, the public page shows only the profile fields intended for sharing. Contact details are shown only when you enable those fields.
• Recruiter sharing is paused: we do not publish your Passport into recruiter search or send it to recruiters through Passport.
• ASSA membership numbers are not public profile content: they help ThinkActuary understand your actuarial context and are kept inside your Passport record.
• You can correct or delete: edit your Passport at any time, switch it back to Private, or delete your account from the Builder.

• Privacy: Public vs Private — a Private Passport has no public URL.
• Delete: from the Builder → Privacy & account → Delete account. This erases your Passport and Firebase auth record.

Passports are stored in Google Cloud Firestore and photos in Firebase Storage. Headshot generation calls Google Gemini with your source photos. Hosting is on Vercel.

These providers may process data outside of South Africa (primarily in the European Union and the United States). They are bound to protect personal information at a level that POPIA regards as adequate through their standard contractual terms (POPIA s72). You consent to this cross-border transfer by continuing to use the service.

• All traffic is served over HTTPS with HSTS enabled.
• Authentication is handled by Firebase Auth (Google sign-in). We never see or store your Google password.
• Access to Passports is enforced by Firestore security rules: only you can edit yours, and your profile is only visible to others if you set it to Public.
• AI endpoints require a valid Firebase session token and cap request sizes to prevent abuse.
• The image proxy allow-lists upstream hosts, enforces size caps and blocks non-image responses.
• Content Security Policy, X-Frame-Options, Referrer-Policy and Permissions-Policy headers are applied to every response.
• User-provided links are validated against a safe scheme allowlist before being rendered.

You may at any time:

• Ask us what personal information we hold about you.
• Correct or update anything that's wrong.
• Ask us to delete your account and Passport (self-service in the Builder, or by email).
• Lodge a complaint with the Information Regulator (South Africa) at inforegulator.org.za.

Contact our Information Officer for any privacy request:

privacy@thinkactuary.com

If we make material changes to this notice we'll highlight them in-app and update the "Last updated" date above.