Privacy Policy

1. Who we are

GetShortlisted is operated by Corvidae Limited (New Zealand) ("we", "us", "our"). This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you use our website and services (the "Service").

This policy is written for a global English-speaking audience. Because we are based in New Zealand, we align our practices with the New Zealand Privacy Act 2020 and the Privacy Principles.

2. What we collect

2.1 Information you provide

We collect information you provide directly when you use the Service:

• Account details: Name, email address, and authentication via Google, Microsoft, LinkedIn, or Apple (depending on your sign-in method)
• CV/resume content: Work experience, education, skills, projects, and other professional information you choose to input
• Referee information: Names, contact details, and professional relationships of referees you add to your CV (stored securely and excluded from AI processing by default)
• Job information: Job descriptions and notes you add for roles you are targeting
• Contact details (optional): Phone number, location/address, and profile links you choose to store
• Communications: Messages you send via contact forms or support channels

2.2 Information collected automatically

• Usage Data: Pages visited, features used, time spent on the platform
• Device Information: IP address, browser type, operating system
• Cookies and similar technologies: See section 9

2.3 Sensitive information

Please avoid entering sensitive information (for example: health information, biometrics, or government identifiers) unless it is necessary for your CV and you are comfortable doing so. If you include this information, you consent to us processing it to provide the Service.

3. How we use your information

We use personal information to operate, maintain, and improve the Service, including to:

• Provide, maintain, and improve our CV optimization services
• Generate professional wording for your CV based on your input
• Personalize your experience and match content to your English proficiency level
• Process your applications and track their status
• Send you service updates, notifications, and support messages
• Respond to your inquiries and provide customer support
• Analyze usage patterns to improve our services
• Detect, prevent, and address technical issues or fraudulent activity
• Comply with legal obligations

Where required by applicable law, we will obtain your consent for certain processing (for example, non-essential cookies) and you can withdraw consent at any time.

4. AI processing

The Service uses AI features powered by OpenAI to help improve your CV wording and generate suggestions. When you choose to use these features, you are asking us to process certain content you provide.

• You choose what gets sent: Only the content you select for optimization is submitted for AI processing
• PII minimisation: We aim to exclude obvious contact details and referee details from AI prompts where feasible
• OpenAI processing: Your selected CV content is sent to OpenAI's API for processing. OpenAI's data usage policies apply to this processing (they do not use API data to train models)
• Referee protection: Referee names and contact details are excluded from AI processing by default to protect their privacy
• No training on your content: We do not use your personal information to train our own models
• Human review: You review and approve all AI-generated suggestions before you export or use them

Important: AI output can be inaccurate or inappropriate. You are responsible for verifying content, ensuring it is truthful, and deciding what you submit to employers.

5. When we share information

We do not sell your personal information. We may disclose personal information only in the situations below:

• With Your Consent: When you explicitly authorize us to share information
• Service providers: We work with trusted third-party service providers including:
  • Amazon Web Services (AWS) - Hosting and infrastructure in New Zealand
  • OpenAI (AI processing for CV enhancement)
  • Google (Analytics and OAuth authentication)
  • Microsoft, LinkedIn, Apple (OAuth authentication)
  All service providers are bound by confidentiality and security obligations.
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets (you will be notified)
• Protection: To protect our rights, property, or safety, or that of our users

Data location: Your core data (CV content, account information, and application data) is stored on AWS infrastructure located in New Zealand. However, some service providers operate services outside New Zealand (for example, OpenAI in the United States, Google services in various regions). When we disclose personal information overseas, we take reasonable steps to ensure it is protected in a manner consistent with this policy and applicable laws.

6. Security

We implement appropriate technical and organizational measures to protect your personal information:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure data centers with physical security measures
• Employee training on data protection

However, no method of transmission over the Internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

7. Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this policy. You can delete your account and data at any time through your account settings. After deletion, we may retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention, legal compliance).

8. Your rights

Depending on where you live, privacy laws may give you rights in relation to your personal information. In New Zealand, you generally have the right to request access to and correction of your personal information.

• Access: Request a copy of your personal information
• Correction: Update or correct inaccurate information
• Deletion: Request deletion of your personal information
• Portability: Receive your data in a structured, commonly used format
• Opt-Out: Unsubscribe from marketing communications
• Object: Object to certain processing activities
• Withdraw Consent: Where processing is based on consent

To exercise these rights, contact us at [email protected].

If you are not satisfied with our response, you may be able to complain to your local data protection authority. In New Zealand, this is the Office of the Privacy Commissioner.

9. Cookies and analytics

We use cookies and similar tracking technologies to enhance your experience:

• Essential Cookies: Required for the platform to function, including authentication and session management
• Analytics Cookies (Google Analytics): We use Google Analytics to understand how users interact with our Service. Google Analytics collects information such as page views, session duration, and user behavior. This data is anonymized where possible.
• Authentication Cookies: When you sign in via Google, Microsoft, LinkedIn, or Apple, authentication tokens are stored to maintain your session
• Preference Cookies: Remember your settings and preferences

You can control cookies through your browser settings and opt out of Google Analytics using the Google Analytics Opt-out Browser Add-on. However, disabling essential cookies may affect functionality.

10. International users

If you access the Service from outside New Zealand, you understand that your information may be processed in New Zealand and in other jurisdictions where our service providers operate. We take reasonable steps to protect information transferred internationally.

11. Children's privacy

Our services are not intended for individuals under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last Updated" date. Your continued use of our services after changes indicates acceptance of the updated policy.

13. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: