Privacy policy
- We use your information to match you with work, run hiring fairly, and give every applicant a decision.
- Employers see your profile only when you apply to them, or when you choose to join the talent network. You can leave the network at any time.
- First-stage review is blind: your name, photo, age, gender and address stay hidden until an employer shortlists you.
- An explainable score helps rank applications, but a person makes every rejection. Protected attributes are never used in scoring.
- You can see, download, correct or delete your information.
Who we are
ProvnHR is a hiring platform operated by [Cintelis Pty Ltd] ([ABN 00 000 000 000]), [registered address] ("we", "us"). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
Privacy questions: [privacy@provnhr.com].
What we collect
If you look for work
- Account: name, email, mobile number (optional) and password. Passwords are stored only as a secure hash.
- Where you're based: country, region, postcode and your right to work in Australia (a declaration you make).
- Your profile: résumé, work history, education, skills and years of experience, certifications (name, issuer, ID number, expiry), security clearance level and status only, salary or rate expectations, availability and notice period.
- What you're looking for: employment, contract, freelance or co-founder work, with any freelance details (services, rates, availability) and co-founder details you add.
- Portfolio items you upload or link, with the visibility you choose.
- Applications: the ads you apply to, screening answers, cover letters, messages with employers, interview times, offers and outcomes, including the reasons given.
- Verification: confirmations from credential issuers, clearance sponsors and referees you nominate, and the result.
- Consents: what you agreed to, when, and which version of the wording.
- Optional fairness data: if you separately agree, demographic information used only to check our scoring for unfair outcomes. It is never used to score you.
If you hire
- Your name, work email, role and organisation; the decisions, notes and scorecards you record; and, for billing, your organisation's ABN and billing details.
When anyone uses ProvnHR
- Sign-in records (including how you signed in and whether two-step verification was used), device and browser details, IP address, and an audit log of views, exports and decisions about candidate data.
What we don't collect
- Clearance documents, clearance numbers or correspondence with AGSVA. For a clearance we keep only its level, status, who confirmed it and when.
- Candidate data copied from other job boards. We don't import, scrape or reuse it.
How we collect it
Mostly from you. We also collect information from employers about applications they handle, from credential issuers and registers you ask us to check, from clearance sponsors and referees you nominate, and from sign-in providers if you choose to sign in with them. If we can't collect information we need, for example your right to work, we may not be able to match you with some roles.
Why we use it
- To create your account and keep it secure.
- To show you roles that match what you're looking for, with an explainable fit score.
- To send your application to the employer you apply to, and to run their review, interviews and offers.
- To give every applicant a decision on a deadline, send reminders and overdue notices, and publish employers' on-time rates.
- To verify credentials you ask us to verify.
- If you join the talent network: to let matched employers find you as an anonymous profile and invite you to apply. This is optional and off by default, and you can leave at any time.
- To detect duplicate or fake accounts and automated applications, and to keep the platform safe.
- To bill employers and handle disputes.
- To meet legal obligations.
We use your information only for the purposes you agreed to, or for directly related purposes you'd reasonably expect. We don't sell personal information.
Automated scoring and AI
We tell you which decisions use automated processing and what information it uses.
| Where automation is used | What it does | Who decides |
|---|---|---|
| Fit score | Compares your profile with an ad's structured requirements and shows met, partly met and not met, with the evidence for each. | Ranks applications as a recommendation. Employers can override any ranking, and overrides are logged. |
| Recommended shortlist | Suggests a shortlist with a short summary written only from your profile and application. | The employer. |
| Résumé reading | Turns your résumé into profile fields. | You confirm every field before it's saved. |
| Authenticity checks | Flags signs of duplicate identities, inconsistent dates or copied text. Using AI to help write is not, by itself, flagged. | A flag never rejects an application, and you can dispute it. |
What the fit score uses: skills and years of experience, certifications and whether they're verified, clearance level and status, work rights, location and work mode, availability, and pay or rate expectations. It may recognise related skill names or infer skills from your work history. Inferred matches are labelled and count for less than skills you declared or verified.
What it never uses: your name, photo, age or date of birth, gender, ethnicity, disability or other protected attributes; whether you pay for career tools; and achievements or badges.
People decide. Automation never rejects anyone; a named person records every rejection, with a reason you'll see. Each score keeps a record of the model version and inputs used, so it can be explained and reproduced. You can ask for a review of a score you think is wrong.
Who sees your information
- Employers you apply to see your application for that role. First-stage review is blind: your name, photo, age, date of birth, gender, address and graduation years are hidden until they shortlist you. Your original résumé and cover letter are released at that point.
- Matched employers, only if you join the talent network: they see an anonymous summary (fit, skills met, seniority, location band, availability). They see who you are only if you accept their invitation.
- Never your current employer, or any employer you block. Their matching never shows your profile.
- Verifiers and referees see only what's needed to confirm the claim you asked them to confirm.
- Our service providers, listed below, on our behalf and under contract.
- Others when the law requires it, for example a court order.
Service providers and overseas disclosure
We use these providers. Some are overseas or process data outside Australia:
| Provider | What for | Where |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, sign-in service | United States company. Our database is placed in the Oceania region, but some processing (for example security and request handling) can happen in other countries. [Confirm before launch] |
| Microsoft | Sending email (password resets, notifications) | [Confirm region] |
| Anthropic, PBC | AI processing for résumé reading, ad drafting, summaries and other AI features, when introduced | United States |
| Stripe | Card payments, when introduced | [Confirm] |
| Google, Microsoft | Sign-in, only if you choose it (when introduced) | United States |
We take reasonable steps, including contracts, to make sure overseas providers handle personal information consistently with the APPs.
Security and data breaches
- Data is encrypted in transit and at rest.
- Two-step verification is required for employer, agency and admin accounts.
- Access to candidate data is logged in an audit log that can't be edited.
- We build to ISO 27001-aligned controls.
If we suspect a data breach, we assess it within 30 days. If it's likely to cause serious harm, we notify you and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme.
How long we keep it
- While your account is open, we keep your profile. If you're inactive for 90 days, we stop showing you in matches until you confirm you're still looking.
- If you delete your account, we erase your personal information within 30 days. The exception is records the law requires us to keep: those are kept to a minimum and only for as long as required.
- Audit log entries are kept for 7 years. After an account is deleted, they remain with your identity replaced by an irreversible pseudonym.
- If you never joined the talent network, your applicant data is deleted 24 months after your last application, unless you opt in again.
- Career-tool drafts and practice sessions are private to you and erased with your account.
Your choices and rights
- Access and download: export your full profile and application history as JSON or PDF at any time.
- Correct: edit your profile whenever you like. Changes to skills, certifications, clearance or work history are timestamped, and employers see a flag on applications where these changed shortly before or after you applied.
- Delete: delete your account from your settings.
- Consent: join or leave the talent network at any time. Leaving takes effect immediately for matching and search.
- Visibility and blocking: choose Hidden, Apply-only, Open to invitations or Actively looking, and block named employers.
You can't apply anonymously, because employers need to assess and contact applicants. But invitations from the talent network stay anonymous until you accept.
Questions and complaints
Contact [privacy@provnhr.com]. We'll acknowledge your complaint and respond within 30 days. If you're not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
If you live outside Australia
Your information is handled under Australian law and this policy. When you register, we also name the privacy law of the country you live in (for example the New Zealand Privacy Act 2020 or UK GDPR). The rights that law gives you also apply. [Legal review: country-specific rights and any transfer mechanisms]
Changes to this policy
If we change this policy, we'll update the version and date above. If a change affects what you've agreed to, we'll ask you again before it applies to you.