Privacy Policy

1. About this policy

Neni RMC Pty Ltd (“CV Advantage”, “we”, “us”, “our”) provides online software that helps people improve their CVs and cover letters, research roles and candidates, and prepare for job interviews (the “Service”), available at cvadvantage.com.au and related subdomains.

We are based in Australia and we are committed to protecting your personal information. This policy explains what personal information we collect, how and why we handle it, who we share it with (including overseas), how long we keep it, and the choices and rights available to you.

The Service is designed for and marketed to users in Australia. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By creating an account or using the Service, you acknowledge the practices described in this policy. If you do not agree, please do not use the Service.

2. Who this policy covers

The Service is used in two ways, and the personal information involved differs:

• Individual (candidate) users — people who sign up to improve their own CV, cover letter or interview preparation. The personal information handled is usually your own.
• Organisation (company) users — businesses whose administrators and members use the Service to prepare interviews for, and evaluate, job candidates. In this case the account holder may upload personal information about other people (the candidates being assessed).

Where an organisation uses the Service to process information about candidates, the organisation is responsible for that information (for example, for having a lawful basis to collect it and for telling those candidates how it is used). CV Advantage handles that information on the organisation’s behalf to provide the Service. If you are a candidate whose information has been uploaded by an organisation, please contact that organisation in the first instance; we will assist them in responding to your request.

This policy also covers visitors to our website and people who contact us for support or sales.

3. Personal information we collect

Depending on how you use the Service, we may collect the following categories of personal information.

3.1 Account and identity information

• Name and email address.
• Password (stored only as a securely hashed value — we never store your password in plain text).
• The organisation you belong to and your role within it (for organisation accounts), and invitation/onboarding details.

3.2 Content you (or your organisation) provide

• Uploaded documents — CVs / résumés and cover letters (uploaded as PDF or Word files, whose text we extract to analyse).
• Job descriptions and role details.
• Interview material — interview questions, your interview responses and any transcripts, notes, and prepared answers.
• Reports generated by the Service (interviewer-mode candidate evaluations and candidate-mode readiness reports).

This content frequently contains personal information — for example employment history, education, contact details, and information about the candidate being assessed. It may occasionally include sensitive information (for example, if a CV mentions health, religion or membership of a professional body). Please do not upload sensitive information unless it is necessary, and, for organisation users, unless you have the individual’s consent to do so.

3.3 Information we obtain from public online sources (web research)

Some features research a candidate or role using publicly available online sources and search results. To do this we use third-party search and data-collection services (see Section 8). The information returned may include publicly available professional details about a named individual. This information is used only to support the report or preparation you have requested.

3.4 Billing and transaction information

• Purchases of credits/tokens, plan details, and transaction history.
• Payment card details are collected and processed directly by our payment processor, Stripe — we do not store your full card number. We receive limited billing metadata (such as the last four digits, card brand, expiry, billing name/country, and a payment reference).

3.5 Support and communications

• Messages, enquiries and feedback you send us, and our responses.

3.6 Device, log and usage information

• Standard server and access logs, including IP address, browser/user-agent, pages and features used, timestamps, and error/diagnostic data.
• Authentication session cookies used to keep you signed in (see Section 11).

We do not currently use third-party advertising or analytics tracking SDKs. If this changes, we will update this policy first.

3A. Sensitive information (APP 3)

Some information you provide — particularly in a CV or cover letter — may be sensitive information under the Privacy Act (for example, information about health, racial or ethnic origin, religious beliefs, sexual orientation, or trade-union or professional-body membership).

• We collect sensitive information only where you choose to include it in a document you upload. We do not seek it out.
• Our lawful basis is your express consent. When you create an account, you expressly agree to our Terms of Service and this Privacy Policy. If you run a free check without first creating an account, we display a notice at the point of upload that your upload is subject to these terms and to short-term retention (see below), and we obtain your express consent to those terms when you create an account to unlock your full report. By uploading content — including where you use the Service to assess another person — you confirm that you are authorised to provide it.
• Free checks and short-term retention. If you run a free check without creating an account, we retain the uploaded CV and job description only long enough for you to return and unlock the full report — currently up to 3 days — after which the uploaded content is automatically deleted if you have not created an account to claim it. To prevent repeated free checks of the same CV, we retain a one-way, irreversible cryptographic fingerprint (a salted hash) derived from the CV; this fingerprint cannot be used to reconstruct the CV, your name, or your contact details, and is not used for any purpose other than preventing abuse of the free check. If you choose to type your email address into “keep my report,” we store that address against the report and use it only to email you the link to your own report and a single expiry reminder. It is deleted with the report at the retention horizon described above, or carried across to your account if you create one, and is never used for marketing or shared with anyone else.
• We instruct our AI provider to disregard protected attributes when assessing a candidate, and not to reproduce them in the report or scorecard.
• Please avoid uploading sensitive information that is not necessary for the assessment.

4. How we collect personal information

We collect personal information:

• Directly from you — when you register, upload documents, enter interview responses, purchase credits, or contact us.
• From your organisation — when an administrator invites you or uploads information about candidates.
• Automatically — through server logs and session cookies when you use the Service.
• From third parties — from our payment processor (transaction confirmations) and from public online sources via our web-research providers (Section 3.3).

Where it is reasonable and practicable, we collect personal information directly from the individual it concerns. Where an organisation provides us information about a candidate, we rely on that organisation to have collected it lawfully.

5. Why we collect, hold, use and disclose personal information

We handle personal information for the following purposes:

• To provide the Service — create and manage accounts; analyse uploaded CVs, cover letters and job descriptions; generate interview questions, feedback and reports; and run the web-research features.
• To improve output quality and the Service — diagnose problems, monitor performance, and improve accuracy and reliability. We do not use your uploaded content to train third-party AI models (see Section 6).
• To secure accounts and prevent misuse — authentication, fraud prevention, abuse detection, and protecting the integrity of the Service.
• To process payments — sell and reconcile credits/tokens and handle refunds and disputes.
• To provide support — respond to your enquiries and requests.
• To comply with the law — meet our legal, regulatory, tax and record-keeping obligations, and respond to lawful requests.
• To send communications — service and transactional messages (always), and marketing where you have consented (see Section 12).

6. How we use artificial intelligence (AI)

A core part of the Service uses AI to analyse the content you provide and to generate suggestions, questions, feedback and reports.

• AI provider. We send relevant content (such as CV text, job descriptions and interview responses) to our AI provider, Anthropic (the “Claude” models), which processes it to generate outputs. This involves an overseas disclosure (see Section 9).
• No model training on your content. We do not permit your uploaded content to be used to train our AI provider’s models. Content is processed to return a result to you, subject to the provider’s limited retention for abuse-monitoring and legal purposes.
• Automated, but you stay in control. AI outputs are suggestions only. They can be inaccurate, incomplete or unsuitable. You remain responsible for reviewing, editing and approving any final CV, cover letter, answer, report or decision. Do not rely on an AI output without checking it.
• No solely-automated decisions with legal effect. We do not use AI to make a decision that produces a legal or similarly significant effect about you without human involvement. Where an organisation uses reports to help evaluate candidates, a human at that organisation makes the hiring decision.

7. Who we do NOT sell to

We do not sell your personal information, and we do not disclose it to third parties for their own advertising or marketing.

8. Third parties we share information with (sub-processors)

We share personal information with trusted service providers who help us operate the Service. They may only use it to perform services for us, under contract, and consistent with this policy. Our key providers are:

We may also disclose personal information:

• to professional advisers (lawyers, accountants, auditors) under confidentiality;
• to a buyer or successor in connection with a sale, merger or restructure of our business (subject to this policy);
• where required or authorised by law, court order, or a lawful request from a government or regulatory authority; and
• to protect the rights, safety or property of CV Advantage, our users or the public.

Note: the specific providers above may change as the Service evolves. We maintain an up-to-date list and will update this policy when our sub-processors change materially.

9. Overseas disclosure (APP 8)

Our application and database are hosted in Australia, in DigitalOcean’s Sydney region. However, to provide the Service we also use AI, payments, communications and web-research providers that are located, or store and process data, outside Australia. Based on our current providers (Section 8), personal information may be disclosed to or accessed from recipients in:

• the United States (AI processing, payments, email, search data, authentication); and
• the European Union (web-data collection).

Before disclosing personal information overseas, we take steps that are reasonable in the circumstances to ensure overseas recipients handle it consistently with the Australian Privacy Principles — for example by using reputable providers who offer contractual data-protection and security commitments. Some countries to which information is disclosed may not have data-protection laws substantially similar to Australia’s, and it may be more difficult to enforce your rights against a recipient in those countries. By using the Service you consent to these overseas disclosures for the purposes described in this policy.

10. Data security (APP 11)

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• encryption of data in transit (HTTPS/TLS);
• passwords stored only as securely hashed values (never in plain text);
• authenticated, access-controlled accounts with tenant separation between organisations;
• restricting internal access to personal information on a need-to-know basis;
• using reputable infrastructure and sub-processors; and
• monitoring and logging for security purposes.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for the content you choose to upload.

If a data breach occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

11. Cookies and session tracking

We use a small number of strictly necessary cookies to operate the Service — principally an authentication/session cookie that keeps you signed in and secures your session. These are required for the Service to function and cannot be switched off through the Service. We do not currently use advertising or third-party analytics cookies. Your browser can be configured to block or delete cookies, but the Service may not work correctly without the session cookie.

12. Direct marketing (APP 7)

We may send you marketing communications about the Service where you have consented or where otherwise permitted by law. Every marketing message includes an easy way to unsubscribe, and you can opt out at any time by using that link or by contacting us (Section 19). We will always send you service and transactional messages (for example, account, security, billing and support notices) even if you have opted out of marketing, because these are necessary to provide the Service. We do not use or disclose your information to third parties for their own direct marketing.

13. Your rights and choices (APP 12 & APP 13)

Subject to the Privacy Act, you may:

• Access the personal information we hold about you;
• Correct information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• Delete your uploaded content and request closure of your account;
• Withdraw marketing consent at any time; and
• Ask questions or make a complaint about how we handle your information.

You can manage much of your information directly in the Service (for example, deleting uploaded documents and reports, or updating account details). For other requests, contact us using Section 19. We will verify your identity before acting on a request. We will respond within a reasonable time (generally within 30 days). Access is usually free; if a request is complex or costly we may advise you of any reasonable charge first. If we refuse access or correction, we will tell you why and how to complain.

If you are a candidate whose information was uploaded by an organisation, that organisation controls how your information is used. Please direct access, correction and deletion requests to that organisation; we will help them respond.

14. International users

The Service is intended for use in Australia and is not marketed to individuals in the European Economic Area or the United Kingdom. If you access the Service from outside Australia, you do so on your own initiative and are responsible for compliance with local laws. We handle your personal information under this policy and Australian law regardless of where you access the Service from. If you believe another data-protection regime (such as the EU or UK GDPR) applies to our handling of your information, please contact us (Section 19) and we will consider your request in good faith.

15. Children

The Service is intended for users aged 16 and over and is not directed at children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, please contact us and we will delete it.

16. Data retention

We keep personal information only for as long as it is needed for the purposes in this policy, then delete or de-identify it. In practice:

• Account information is retained while your account is active.
• Uploaded content, interview data and reports are retained while your account is active or until you delete them, whichever is sooner. When you delete an item or close your account, we delete or de-identify the associated content within a reasonable period, subject to backups being cycled out.
• Billing and transaction records are retained for as long as required to meet tax, accounting and legal obligations (generally up to 7 years).
• Support communications and security logs are retained for as long as needed for support, dispute handling and security.

We may retain limited information for longer where necessary to comply with the law, resolve disputes, prevent fraud/abuse, or enforce our agreements. This approach is consistent with APP 11.

17. Third-party links

The Service and our website may contain links to third-party sites we do not control. This policy does not apply to those sites; please review their own privacy policies.

18. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make a material change, we will take reasonable steps to notify you (for example, by email or an in-app notice). Continued use of the Service after a change takes effect means you accept the updated policy.

19. How to contact us and make a complaint

If you have a question, request or complaint about privacy, contact our Privacy Officer:

• Email: privacy@cvadvantage.com.au
• Post: Neni RMC Pty Ltd, 1 Northcote Avenue, Balwyn VIC 3103, Australia

We will acknowledge your complaint and aim to respond within a reasonable time (generally within 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992

This policy is provided by Neni RMC Pty Ltd. It is not legal advice. We recommend having it reviewed by a qualified Australian privacy lawyer before publication.