Privacy Policy

1. Information We Collect

Candidate Application Information

When you submit a candidate application through our website, we collect the following information:

• Full name, email address, and phone number
• Your current location and the role you are seeking
• Your postcode, which we use to gauge how practical each role's location would be for you
• How you usually get to work (public transport, car, motorbike or moped, bike, e-bike or e-scooter, walking, or any of these), which we use with your postcode to estimate your journey time to each role
• Years of experience in the hospitality industry
• The level you have held (learning the ropes, solid on your own, lead a section or shift, or run the whole area), which we use alongside your CV to judge seniority (optional)
• Certificates you hold, chosen from a list with an optional expiry month. You declare these yourself, we do not verify them, and we ask to see them at interview. We consider them only when a role asks for them (optional)
• Languages besides English and a level for each, which we use only when a role asks for a language (optional)
• Your salary or pay expectations, and whether you are seeking full time or part time work, which we use to gauge how practical each role would be for you
• A written statement describing your career background and what you are looking for in your next role
• CV or résumé (uploaded as a PDF or Word document, or provided as a LinkedIn profile URL)
• Qualifications and certifications (uploaded documents or images, optional)
• Portfolio photographs of your work (up to three images, optional)
• Your public Instagram handle, where provided as an alternative portfolio link (optional)
• Any information you voluntarily include regarding visa or sponsorship requirements

Account Information (Candidates and Clients)

If you sign in to your Cookatoo account, we collect and hold the following. We do not use passwords: you sign in with a one time code sent to your email.

• Your sign in email address and when you signed in
• The settings you choose, such as the roles, areas, pay and travel distance you prefer, and your alert choices
• The roles you view, say you are interested in, or hide
• Photos you add to your portfolio, and their captions
• Your answers to introduction requests from venues, and a record of exactly what you agreed to share and when
• If you turn on notifications, a device address supplied by your browser's push service
• For clients: your organisation and contact name, and the briefs and introductions linked to your account. When you ask for an account we also collect your position, organisation address, phone number and ABN, which we use to check the organisation before we approve the account, to invoice you and to fill in our terms of business and data sharing agreement for you. Before you sign our terms you can also describe your venue or venues in your account: the name, location, website, a description, its size, when it trades, any awards, and what you offer your team beyond pay. We use this so that when you hire you only answer questions about the role

Employer and Business Enquiry Information

When a business submits an enquiry through our website, we collect the contact person's name, email address, phone number, business or venue name, region, and hiring timeframe. In the course of follow-up communications, we may also collect further details of the role or roles they are seeking to fill.

Additional Recruitment Information

In the course of the recruitment process, we may also collect employment history, right to work documentation (including VEVO checks where applicable), references provided by former employers, and other information relevant to assessing suitability for a role. Where references are requested, we send a secure tokenised link directly to the referee nominated by the candidate. This means we may receive personal information about a candidate from a third party who did not submit information to us directly.

Age Requirement

Our services are intended for individuals aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us and we will delete it promptly.

Website Usage Information

We collect anonymised information about interactions with our website, including pages visited, time spent on pages, and general device and browser information, for the purpose of improving user experience. This data does not identify you personally.

2. How We Collect Your Information and Why

• Directly from you: We collect information when you submit a candidate application, make a business enquiry, use our live chat, or communicate with us by any means.
• CVs sent to us by email: If you email your CV to us directly rather than applying through the website, we add it to our candidate database and assess it in the same way as a website application.
• From third parties: We may receive information from references, former employers, or background screening agencies as part of the recruitment process.
• From social media platforms: As part of our recruitment activities, we may review publicly available profiles and information on LinkedIn, Facebook, Instagram, X (formerly Twitter), and WhatsApp to assess candidate suitability or identify potential candidates. We only collect information that is publicly available or that you have shared with us directly through these platforms.
• Legitimate interests: We collect and process personal information to conduct recruitment activities, assess candidate and client suitability, facilitate placements, and comply with our legal obligations under Australian law.

3. How We Use Your Information

• Candidate assessment: We use application information (including written statements, CVs, portfolio photographs, qualifications, and social media handles) solely to assess your suitability for permanent hospitality roles. Portfolio materials are reviewed by our recruitment team and are never published or shared publicly.
• Merit scoring and fit: Candidates are scored on merit. Personality and team fit differ from venue to venue and depend on human judgement, which can be affected by bias and cannot be measured with complete accuracy, so we may not always get it right. We take precautions to reduce that risk, including fairness audits of our scoring and a personal review of every shortlist, and we use feedback after interviews and trial shifts to improve future matches.
• Candidate presentation: With your explicit consent, we may share your profile with prospective employers. We never share your CV or your written application statement with a client. We will always speak with you before presenting you to any client.
• Availability check-ins: We periodically send availability check-in messages to candidates in our database via email and WhatsApp, asking whether they are actively looking, open to opportunities, or settled in a role. These check-ins occur no more than once every 8 weeks. You may opt out at any time by selecting the relevant option in any check-in message or by contacting us directly.
• Introductions through your account: We may show a client an anonymous profile of you for a role: your area, your years of experience, your most recent role and the type of venue, your availability, and your work rights category. It never includes your name, contact details, past venue names, scores or our written summary. If the client is interested, we ask you through your account, and the request names the venue so you know exactly who you are agreeing to share with. Only if you say yes are your name, contact details, location, work history (the employers, roles, venue types and years) and the portfolio photos we have approved shown to that one client, for that one role. Your CV file and your written application statement are never shown to the client. If you say no, nothing is shared and the client is only told that you are not available. We keep a record of your answer and the wording you agreed to. When a client later offers you interview or trial times, you will see where to go, what to bring and the times offered, and your chosen time is shared with that client. You can take your yes back at any time from your account: the venue then can no longer see your details, any interview or trial time is cancelled, and we record that you withdrew. Details a venue has already seen or copied cannot be taken back, so tell us if you are worried.
• Free February (1 to 28 February 2027): During this trial only, a client taking part may see more in the anonymous profile we show them for a role. As well as your area, years of experience, most recent role and venue type, availability and work rights, it may show your average length of stay in past roles, your notice period, your visa type and expiry month, an overall match score for the role with scores for each part of the match, and a short written list of strengths and gaps drawn from your CV and profile and prepared with the help of AI. It still never includes your name, contact details or the names of your past venues. During the trial, if a client is interested, we may ask for your permission by email, with a link to say yes or no, instead of in your account, and we may do so without speaking with you first. Nothing is shared unless you say yes, and the request names the venue. Only if you say yes are your name, contact details, location, work history and the portfolio photos we have approved shown to that one client, for that one role. After 28 February 2027 introductions return to the process described above.
• Alerts: We send alerts only if you turn them on in your account, by notification on your device or by email. They are limited to 10 a week for introductions and shortlists and 2 a week for new roles, they never contain a venue, client or person's name, and you can pause or stop them at any time.
• Employer matching: We use employer enquiry information to identify and propose suitable candidates for their vacancies.
• Job advertising: When advertising a role on behalf of a client, we may include publicly available details about the client's business in the job description, such as their Instagram handle, website URL, or venue name. We will only include information that is already publicly available or that the client has provided to us for this purpose.
• Communication and direct marketing: We use your contact details to correspond with you about your application or enquiry, and to keep you informed of relevant opportunities. If you no longer wish to receive marketing communications, you may opt out at any time by clicking the unsubscribe link in any email or by contacting us directly.
• Website improvement: We use anonymised usage data to analyse trends and improve the performance and content of our website.
• CV checker analytics: We record, in aggregate analytics only, that a CV check was completed and which role family was chosen, so that we can see whether the tool is useful.

4. Information Sharing and Third-Party Services

We do not sell your personal information. We share it only as described below.

• Prospective employers (candidates only): With your prior consent, we may share your name, contact details, work history and approved portfolio photos with client businesses for the purpose of facilitating a placement. We do not share your CV or your written application statement. Through your account, this happens only after you say yes to that specific role.
• Cookaburra Ltd (sister company, United Kingdom): We may share personal information with our sister company Cookaburra Ltd, based in the United Kingdom, where relevant to recruitment activities or business operations. Any such sharing is conducted under confidentiality obligations and in accordance with the Australian Privacy Principles.
• Supabase (account sign in and account data): Your sign in, account settings, alert choices, introduction records and consent records are stored with Supabase, a service operated by Supabase, Inc., a US based company. The data is stored in Sydney, Australia. Portfolio photos are stored as private files on Vercel Blob (see below). Supabase's privacy policy is available at supabase.com/privacy.
• Resend (sign in emails): When you ask for a sign in code, your email address and the code are sent through Resend, an email delivery service operated by Resend, Inc., a US based company. Our account sends from servers in Tokyo, Japan. Resend keeps a delivery record (the address, the time and whether the email was delivered) for a short period. Resend's privacy policy is at resend.com/legal/privacy-policy.
• Browser push services (notifications): If you turn on notifications, the message is delivered through the push service of your browser or phone (for example Google, Apple, Mozilla or Microsoft). They receive the message and a device address, not your name or account details.
• Mailchimp (email marketing): When a business submits an enquiry through our website, their email address and enquiry details may be added to our Mailchimp audience for follow-up communications. Mailchimp is operated by The Rocket Science Group LLC (Intuit), a US-based service. Mailchimp's privacy policy is available at mailchimp.com/legal/privacy.
• Scratchy AI Chat (website chatbot): Our website features Scratchy, an AI-powered chat assistant. Messages you send through the chat are processed via the Anthropic API (Claude) to generate responses. Anthropic, Inc. is a US-based company. Conversation records are stored securely on our servers for up to 30 days, after which they are automatically deleted. Active chat session tokens expire after 4 hours of inactivity. No personally identifiable information is collected through the chat unless you voluntarily provide it. When a visitor starts an enquiry, our team is notified through WhatsApp. The notification includes the visitor's message and any name or email address they choose to give us, and a member of our team may then reply to the chat directly. Anthropic's privacy policy is available at anthropic.com/privacy.
• AI-powered job description generation (employers): When an employer completes our role brief questionnaire, the answers provided are sent to the Anthropic API (Claude) to generate a draft job description. This information includes business details and role requirements supplied by the employer, such as venue name, location, and role specifics. No candidate personal information is involved in this process. The generated job description is stored on our servers and returned to the employer for review and editing. Anthropic, Inc. is a US-based company. Anthropic's privacy policy is available at anthropic.com/privacy.
• Social media platforms: We maintain business profiles on LinkedIn, Facebook, Instagram, X (formerly Twitter), and WhatsApp. If you interact with us through these platforms, the relevant platform's privacy policy applies to that interaction. These platforms are operated by US-based companies (Meta Platforms, Inc.; LinkedIn Corporation; X Corp) and your information will be subject to their respective terms and privacy policies.
• WhatsApp (candidate communications): We use WhatsApp to send availability check-ins and notifications to candidates who have provided their phone number. Messages are sent from our business WhatsApp account. WhatsApp is operated by Meta Platforms, Inc., a US based company. Meta's privacy policy is available at facebook.com/privacy/policy.
• Calendly (appointment scheduling): Our website uses Calendly to allow clients and candidates to book discovery calls. Calendly collects names, email addresses, and scheduling information. Calendly is a US-based service. Calendly's privacy policy is available at calendly.com/privacy.
• Granola (meeting recording): We use Granola to record and transcribe sessions with clients and candidates. Audio recordings and transcripts may contain personal information discussed during these sessions. Granola is a US-based service. We will inform participants before recording any session. Granola's privacy policy is available at granola.ai/privacy.
• Slack (internal communications): We use Slack for internal team communications. Personal information relating to candidates or clients may be referenced in Slack channels as part of our recruitment workflow. Slack is operated by Slack Technologies LLC (Salesforce), a US-based company. Slack's privacy policy is available at slack.com/privacy-policy.
• Streak (CRM and email management): We use Streak, a Gmail-integrated CRM platform, to manage candidate and client pipelines, track email communications, and store contact information. Streak may process personal information including names, email addresses, phone numbers, and the content of email communications. Streak is a US-based service operated by Streak Technologies Inc. Streak's privacy policy is available at streak.com/privacy.
• Artificial intelligence tools: We may use AI-powered tools including Grok (xAI Corp), Claude (Anthropic), and Dia (The Browser Company) to assist with tasks such as drafting communications or summarising information. Where personal information is used in conjunction with these tools, we take care to use only what is necessary. These tools are operated by US-based companies and are subject to their respective privacy policies. Our team may also use an AI assistant (Claude, by Anthropic) connected to our candidate and employer records to help staff search records, summarise pipeline activity and prepare follow up messages. Records shared this way may include names, contact details, work history and notes. Anthropic is a US based company, so this is a disclosure of personal information overseas, and we take reasonable steps to protect it in line with APP 8. A member of our team reviews every output, and no placement, rejection or ranking decision is made by AI alone.
• Meta Pixel and Conversions API (Facebook advertising): Our website uses the Meta Pixel to track conversions from Facebook and Instagram advertising campaigns and to support remarketing. The Meta Pixel collects information about your visit to our website and shares it with Meta Platforms, Inc., a US-based company. We also use the Meta Conversions API, which sends certain data directly from our servers to Meta. It is sent when a candidate submits an application, when an employer submits an enquiry, and when someone books a call through our calendar. For a candidate who applied, it is also sent later if a member of our team marks that candidate as qualified or placed, so that Meta can see which adverts lead to real results. We do not send the application event for a candidate that our screening rates as not suitable. This server side data includes your hashed email address and, where you gave them, your hashed phone number and hashed name, together with your IP address, browser user agent and, where available, identifiers set by the Meta Pixel or taken from the advert you clicked. Your email address, phone number and name are hashed using SHA-256 before transmission. Your IP address and browser user agent are sent as they are. If you arrive from a Facebook or Instagram advert, the advert click identifier in the link is also kept in your browser's session storage for the length of your visit and sent to Meta with your form submission, so that Meta can match the visit to the advert. If you arrive from one of our adverts, we also keep the advert's campaign name, advert ID and placement in your browser's session storage for the length of your visit and, if you apply, save them with your application so that we can see which adverts lead to applications. We use them only to measure our advertising. Meta's privacy policy is available at facebook.com/privacy/policy.
• Google Analytics (website analytics): Our website uses Google Analytics to collect anonymised data about how visitors interact with our website, including pages visited and time spent on pages. Google Analytics uses cookies and may transfer data to Google LLC servers in the United States. You can opt out of Google Analytics tracking via your browser settings or the Google Analytics opt-out browser add-on.
• Microsoft Clarity (behaviour analytics): Our website uses Microsoft Clarity to record anonymised user sessions, including clicks, scrolls, and mouse movements, to help us improve the website experience. Session recordings may incidentally capture information entered into forms. We have configured Clarity to mask sensitive form fields. Clarity is operated by Microsoft Corporation, a US-based company. Microsoft's privacy policy is available at privacy.microsoft.com/privacystatement.
• Google Workspace (email): We use Google Workspace to send and receive email communications, including form enquiries and candidate applications submitted through our website. Emails and their attachments are processed and stored by Google LLC, a US-based company. Google's privacy policy is available at policies.google.com/privacy.
• Xero (accounting and payroll): We use Xero to manage our accounting, invoicing, and payroll obligations. Information relating to placed candidates and client businesses (such as names, contact details, financial information, and where applicable, Tax File Numbers) may be stored in Xero. Tax File Numbers are treated as sensitive information and are collected and held only as required by law. Xero is a New Zealand-based company and may process data outside Australia. Xero's privacy policy is available at xero.com/au/legal/privacy.
• Vercel Blob (CV storage): CVs uploaded through our website or added by our team are stored as private, encrypted files on Vercel Blob, a file storage service operated by Vercel, Inc. Storage nodes for this service are located in Sydney, Australia. CV files are accessible only via authenticated, time-limited API routes and are never publicly accessible. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.
• Upstash Redis (candidate database): Candidate profile information, including name, email address, phone number, location, postcode, how you usually get to work, region, applied role, your written application statement, a structured summary of the work history extracted from your CV (employers, roles, and dates), and AI-generated suitability scores, is stored in Upstash Redis, a managed global cloud database service hosted on AWS infrastructure. The primary database node is located in Sydney, Australia (AWS ap-southeast-2) and data is replicated across additional global regions for availability and performance. Upstash's privacy policy is available at upstash.com/trust/privacy.pdf.
• Journey time service (Google Routes): If you told us how you usually get to work, we estimate how long your journey to a role would take. We send your postcode and the role's venue postcode or location to the Google Routes API (Google LLC, a US based company) and get back a journey time for the way you travel. No name, email address, phone number or other personal details are sent. The journey time is used only as one input to how well a role suits you, and a long journey never rules you out of a role on its own.
• Cultural fit questionnaire (Premium roles): For Premium placements, after we have spoken with you and before we put you forward, we may email you a short working style questionnaire. Your answers, our notes from our call with you, and the venue's own description of its culture are used to prepare a short summary for the client. The answers are sent to the Anthropic API (Claude) to help draft that summary. Anthropic is a US based company, so this is a disclosure of personal information overseas, and we take reasonable steps to protect it in line with APP 8. A member of our team reviews and approves the summary before it is shared, and nothing is scored automatically or used to rank you. The questionnaire does not ask about protected characteristics. You can ask to see, correct or delete your answers by contacting us.
• Retention check in feedback (Premium roles): For Premium placements, our 4, 12 and 20 week check in emails include a short private feedback form for the candidate and for the client. Candidates tell us how the role is going and what their experience of the venue is against our published Standard. Clients tell us how the placement is going and how the venue is doing against the Standard. Candidates choose whether their answers may be shared with the venue. The default is that they are not, and we will not share their answers or anything that could identify them unless they say yes. Our team reads the answers to prepare for the check in call, and we may send them to the Anthropic API (Claude) to help draft a private preparation brief. Anthropic is a US based company, so this is a disclosure of personal information overseas, and we take reasonable steps to protect it in line with APP 8. A member of our team reads and checks the brief, and nothing is scored automatically or used to rank anyone. You can ask to see, correct or delete your answers by contacting us.
• AI-powered candidate scoring: CVs submitted through our website, emailed to us directly, or added by our recruitment team are processed by the Anthropic API (Claude) to generate a numerical suitability score against our active job descriptions and to extract key contact details (name, email address, phone number, and location) and a structured summary of your work history (employers, roles, and dates). Your written application statement, where provided, is also sent to Anthropic and is used to inform the written assessment (the summary, strengths, and gaps); it does not affect the numerical score. We separately use your stated location, postcode, availability, salary or pay expectations, and preference for full time or part time work to estimate how practical each role would be for you, which forms one part of the overall match score. The AI-generated score, a brief written summary, the strengths and gaps identified, and extracted contact details are stored in our candidate database. These scores support, but do not replace, human judgement: a member of our recruitment team always reviews a candidate before they are presented to any client. Where a recruiter reviews and manually adjusts a score, we also record the adjusted score, a written reason for the adjustment, and the date it was made. We periodically run fairness audits on the automated scoring to check that it is not influenced by characteristics unrelated to job suitability. The CV document is stored separately on Vercel Blob. Anthropic, Inc. is a US-based company.
• Free CV checker: Our website offers a free CV checker. When you use it, we read your CV on our servers to give you feedback, and we do not save the file, its text or the feedback. The basic checks (such as contact details, dates and length) run on our own servers. The full review sends the text of your CV, but not the file itself, to the Anthropic API (Claude) to produce written feedback. Anthropic, Inc. is a US-based company, and Anthropic's privacy policy is available at anthropic.com/privacy. Your CV and its feedback are not shared with employers, are not added to your candidate profile, and are not used to score or rank you. If you later apply, you upload your CV again on the application form.
• Vercel Analytics: Our website uses Vercel Analytics for anonymised, aggregate website performance data. No personally identifiable information is collected by this service.
• Employer acknowledgements: When an employer proceeds with our services, we collect a digital acknowledgement of our terms of business via a secure, tokenised link sent by email. We record the fact of acknowledgement, the timestamp, and the employer's email address. This information is stored on our servers and used only for our own records.
• Placement records and Notice of Employment: When we place a candidate, we record the placement details, which may include the candidate's name and address, the employer, the role, the start date, the employment type, the award or classification, and the agreed salary or wages. From these details we can generate a Notice of Employment document. These records are retained for our own records and to meet our obligations under Australian workplace law, and the Notice of Employment may be provided to the candidate and the employer.
• Other service providers: We may share information with other trusted service providers who assist us in business operations (e.g., IT support, background screening) under confidentiality obligations.
• Legal compliance: We may disclose personal information when required by law or in response to lawful requests from government authorities.

Application and enquiry forms submitted through our website are processed by our own servers. CVs are stored on Vercel Blob with storage nodes in Sydney, Australia. Candidate profiles and scores are stored in Upstash Redis, a global database with its primary node in Sydney, Australia (AWS ap-southeast-2). Where personal information is otherwise transferred outside Australia (for example, to Cookaburra Ltd in the United Kingdom, or via Google Workspace, Google Routes, Google Analytics, Meta Pixel, Microsoft Clarity, Calendly, Granola, Slack, Streak, Mailchimp, Anthropic, Xero, AI tools, or social media platforms), we take reasonable steps to ensure it is handled in accordance with the Australian Privacy Principles.

5. Portfolio Materials and Creative Work

Photographs, documents, and other portfolio materials submitted as part of a candidate application are used only for internal assessment purposes. They are not published, displayed publicly, or shared with any party other than prospective employers (with your consent). You may request deletion of your portfolio materials at any time by contacting us.

6. Data Security

We employ reasonable industry-standard security measures to protect your personal information from unauthorised access, use, or disclosure. However, no transmission or storage method is 100% secure. We encourage you to contact us immediately if you believe your information has been compromised.

7. Notifiable Data Breaches

We are subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth). If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individual(s) and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. We maintain an internal data breach response procedure to ensure we meet our obligations under the NDB scheme.

8. Privacy Act 1988 (Cth) and Australian Privacy Principles Compliance

Two Birds Group Pty Ltd complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and other applicable data protection laws and regulations.

9. Data Retention

We retain personal information for as long as necessary to fulfil the purposes outlined in this Policy, or as required by law. In practice:

• Website chat: conversation records are deleted automatically after 30 days, and chat session tokens expire after 4 hours of inactivity.
• Free CV checker: your CV and the feedback are not stored. The cookie and the scrambled (hashed) form of your IP address used to limit full reviews expire after 3 days (the cookie itself is cleared after 30 days at most).
• Employer role briefs: unfinished brief links expire after 14 days. Completed briefs, live vacancies, and the role specific match scores and rankings generated for them are deleted automatically after 90 days. Venue details saved to speed up future briefs, including those you add to your account before your first brief, are deleted after 12 months.
• Candidate profiles and CVs: kept while we may still consider you for opportunities, and deleted when you ask us to. You may request deletion at any time by contacting us.
• Cultural fit questionnaires: your answers and any summary are deleted automatically 12 months after the questionnaire was sent.
• Retention check in feedback: answers and any preparation brief are deleted automatically 12 months after the check in email was sent.
• References: the contact details of referees we ask for a reference, and any replies they send, are deleted automatically 24 months after the last activity on that request, which is normally the date of the last reply.
• Account records: if you delete your account, your sign in, settings, alert choices, interest in and hidden roles and portfolio photos are deleted straight away. If you delete your account, any details a venue could see stop being shown to them at once. A short record of what you agreed to share (the date, the wording, the venue and an internal reference, but not your name, email or contact details) is kept without your sign in, as evidence that we asked properly. Logs of alerts we sent are deleted after 90 days, and closed introductions and the list of roles you have viewed are deleted after 12 months. The venue details and roles a client saved are deleted with the account. A client's signed agreement and briefs are kept as business records.
• Placement records: kept for as long as we need them to meet our legal, tax, and record keeping obligations.

10. Your Privacy Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights:

• Right of access (APP 12): You may request access to the personal information we hold about you. We will respond within a reasonable timeframe and no later than 30 days. There is no charge for making a request.
• Download and delete in your account: If you have an account, you can download a copy of the information your account holds, and delete your account, from the Account tab at any time. Internal assessments we make while recruiting (such as match scores, written summaries and recruiter notes) are not in the download, but you can ask us about them under APP 12, and we may decline access only where the Privacy Act allows. If you ask us to delete your recruitment record as well, we will do so within 30 days unless the law requires us to keep it.
• Right to correction (APP 13): You may ask us to correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Right to opt out of direct marketing (APP 7): You may opt out of receiving direct marketing communications from us at any time by clicking the unsubscribe link in any email, selecting the opt-out option in any availability check-in, or contacting us directly.
• Right to erasure: While not a formal right under the APPs, we will delete your personal information on request where we are not required by law to retain it.
• Rights in relation to automated scoring: We use automated scoring to help assess and rank candidates, but a member of our team always reviews you before any decision to put you forward. You may ask us to explain how a score was reached, to have it reviewed by a person, or to contest it.
• Right to complain: You may lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal information.

There is no charge for exercising these rights. We will respond to requests within a reasonable timeframe and no later than 30 days.

11. Cookies

Our website uses cookies and similar technologies for the following purposes:

• Consent: A cookie records whether you have accepted or declined our cookie notice.
• Analytics: Google Analytics and Microsoft Clarity use cookies to collect anonymised data about how visitors interact with our website, including pages visited, session duration, and user behaviour.
• Session recording: Microsoft Clarity records anonymised session replays (clicks, scrolls, mouse movements) to help us improve the website.
• Advertising: The Meta Pixel (Facebook) uses cookies to track conversions and support advertising on Facebook and Instagram.
• Advert tracking: If you arrive from one of our adverts, your browser's session storage holds the advert's campaign name, advert ID and placement until you close the tab. They are sent with your application if you submit one. Meta's advert click identifier from the link is held in the same way and sent to Meta with a form submission.
• Chat assistant: Scratchy, our AI chat assistant, sets one cookie that is strictly necessary for the chat to work and is not used for tracking. It proves that a saved conversation belongs to your browser and is kept for up to 30 days. A session token is also stored in your browser's session storage to maintain chat continuity during your visit. Conversation records are stored on our servers for up to 30 days.
• CV checker: If you use the free CV checker, we set one strictly necessary cookie that holds a random ID with no personal information. Together with a hashed (scrambled, one way) form of your IP address, it lets us limit how many full reviews run for one person (two in any 3 days), to prevent misuse and control costs. It is not used for tracking or advertising and is kept for up to 30 days.
• Account: If you sign in to your account, strictly necessary cookies keep you signed in, and a small service worker file lets the account work as an installed app and show notifications you have chosen. They are not used for tracking and the service worker stores no pages or personal information on your device.
• Booking: Calendly sets cookies when you use the booking widget to schedule a call.

You can control cookies through your browser settings. Declining cookies via our cookie notice will prevent analytics, session recording, and advertising cookies from being set. Some functionality (such as live chat and booking) may be affected if cookies are disabled. For more information, see the privacy policies of the respective third-party services listed in section 4.

12. How to Complain

If you have any concerns about our use of your personal information, please contact our Privacy Officer in the first instance using the details in section 13. We will endeavour to resolve your concern promptly.

If you remain unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

13. Contact Us

To exercise your rights, request deletion of your data, or raise a privacy concern, please contact our Privacy Officer:

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when it was last revised. We encourage you to review this Policy periodically.