Privacy policy

Candidates: name, email, phone, location, work history, skills, projects, seniority, rate or salary expectation, availability, work-rights status and any security clearance, plus the CV you upload and the text extracted from it.

Employers: company name, ABN, industry, website, and the name, email and seat role of each person on the account.

Everyone: authentication records, session metadata, and an audit trail of significant actions.

We do not collect sensitive information as defined in the Privacy Act — including health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or union membership. There is nowhere to enter it, and we do not extract it from CVs.

To operate a two-sided hiring marketplace: to build your profile, to rank roles for you and you for roles, to let employers search and shortlist, to track application status, to send the alerts you have asked for, and to bill employers.

A computer program substantially assists the ordering of candidates and roles. Our automated decision-making notice sets out what information it uses, what it never uses, how the ranking is produced, your right to an explanation, and how to opt out. That notice forms part of this policy.

Your profile is visible to employers with an open role you match, unless you have turned visibility off. Your email and phone number are never disclosed until an employer spends a contact-reveal credit — and you are notified each time, with a permanent record on your privacy page.

We use a small number of specialist service providers for hosting, email, document storage, model inference and payment processing. Each kind of service, what it handles and where it operates is set out on who can see your data — kept in step with the running configuration, so it cannot drift from what is actually deployed. We do not sell personal information, and we do not disclose it for advertising.

Our platform and database run in an Australian cloud region — your profile, applications and records are stored in Australia.

Email we send you, and the copy we keep of a CV you upload, are handled through Google Workspace under Google's standard terms of service — with the same protections Google provides to organisations worldwide, including encryption in transit and at rest and Google's independently certified security controls. Our agreement with Google does not permit your information to be used for advertising or to train models.

Where any provider operates outside Australia, we take reasonable steps to ensure it handles your information consistently with the Australian Privacy Principles, as APP 8 requires, and we remain accountable to you for it.

Passwords are stored using scrypt with a per-user salt and are never recoverable. Sessions are server-side and can be revoked centrally. Access to production data is restricted, and significant actions are recorded in an append-only audit log. We maintain readiness under the Notifiable Data Breaches scheme.

Candidate data is retained for 24 months after your last activity unless you delete it sooner. You can delete your account and data at any time from your privacy settings. Audit records that an action occurred are retained with your identity removed.

A nightly job enforces this. Thirty days before the window closes we email you, and visiting the link in that email is enough to keep the record. Activity means something you did — a sign-in, an application, answering one of our emails — so an internal edit on our side does not quietly extend how long we keep it.

You can view and correct your profile at any time, and download everything we hold about you as a structured file from your privacy settings. No form, no waiting period. If you have no account, ask us here and we will email you a link that does the same things.

If you never signed up. Where a CV reaches us from somebody other than you, we hold a profile you have no account for — and access, correction and deletion have to work anyway. Our collection notice sets out what we hold and where it came from, and the email we send carries a link that lets you correct, hide or delete the record without signing in to anything.

Protected attributes are excluded from collection, storage and ranking. Employers cannot search or filter on them; attempts are blocked and recorded. We monitor ranking outcomes in aggregate for disparate impact using non-identifying data.

Use our complaints form — it takes a minute, needs no account, and gives you a reference. Every complaint is recorded, seen by our team, and answered; we aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.