Privacy Policy

1. Overview

YourHIRO is a consent-based talent marketplace. This Privacy Policy explains what personal information we collect about you when you use YourHIRO, why we collect it, who we share it with, and the rights you have over it. It is written for a general audience; where a section applies only to one type of user (a Candidate or an Employer), that is called out.

We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and — where relevant — the Spam Act 2003 (Cth). This policy is our APP 1 privacy notice.

If you have questions or want to exercise any of your privacy rights, contact us at [FILL — privacy email, e.g. privacy@yourhiro.com.au].

2. Who we are

We are [FILL — legal entity name, e.g. "YourHIRO Pty Ltd"] (ABN [FILL]), operating the YourHIRO service at yourhiro.com.au and app.yourhiro.com.au (the Platform). "We", "us" and "our" refer to this entity.

3. Definitions

We use the same definitions as our Terms & Conditions. In addition, in this policy:

• Personal Information has the meaning given by the Privacy Act 1988 (Cth) — broadly, information or an opinion about an identified individual, or an individual who is reasonably identifiable.
• Sensitive Information has the meaning given by the Privacy Act 1988 (Cth) — including information about health, racial or ethnic origin, sexual orientation, religious beliefs, criminal record, and genetic or biometric information.
• Sub-processor means a third-party service provider that processes Personal Information on our behalf as part of delivering the Platform.

4. Who this policy applies to

This policy applies to:

• Candidates — individuals who create a YourHIRO account to build profiles and be discoverable by Employers;
• Employers — individuals who use the Platform on behalf of an organisation to discover and engage Candidates;
• Website visitors — anyone who visits yourhiro.com.au or app.yourhiro.com.au without creating an account; and
• People you tell us about — for example, referees whose details you enter into your profile.

It does not apply to information handled by third parties whose services we link to but do not operate (see section 13).

5. The consent model — how contact details are handled

5.1 The Platform is employer-initiated. Employers browse Candidate profiles and may express interest.

5.2 A Candidate's contact details (email address and phone number) are never displayed to an Employer unless and until the Candidate expressly consents to be contacted by that specific Employer. Profiles viewed before consent are presented with contact details withheld by a technical control that removes them from the data returned to the Employer's session.

5.3 Each consent applies only to the specific Employer it is given to. Consent to one Employer is not consent to any other, and cannot be inferred, aggregated, or reused.

5.4 A Candidate may decline an expression of interest without giving a reason to the Employer. A Candidate may also end an Engagement at any time.

5.5 A Candidate may revoke a previously given consent. Revocation applies from that point forward. Practically, revocation:

• (a) removes the Employer's Platform-based access to the Engagement (including any in-Platform messaging surface); but
• (b) does not — and cannot — retract contact details already revealed to that Employer; and
• (c) does not restrict any contact occurring off-Platform after a lawful reveal.

We describe this openly because we want Candidates to understand what consent to contact actually means before they give it.

5.6 We maintain an auditable, append-only record of each Consent Event (grant, decline, revoke). We retain these records for the audit and legal purposes described in section 12.

5.7 We require Employers to accept obligations restricting how they may use contact details and other Candidate information (see section 6.2 of the T&Cs). We monitor Platform activity for signs of misuse; however, once contact details have been received by an Employer, we cannot technically prevent misuse outside the Platform. That is the honest limit of any consent model.

6. What personal information we collect

The information we collect depends on how you use the Platform. Categories are grouped below.

6.1 From Candidates

Some of the information above may be Sensitive Information (for example, if you mention a health condition in a personal summary, or upload a document containing racial or ethnic origin). We do not require you to provide Sensitive Information, we do not ask for it, and we recommend you do not enter it into free-text fields. Where you choose to enter Sensitive Information, we handle it as described in this policy; by entering it you consent to that handling.

6.2 From Employers

6.3 Automatically, from your device

When you use the Platform we automatically collect:

• Device and technical information — device type, browser type and version, operating system, IP address, and time zone;
• Usage information — pages viewed, features used, actions taken, session duration, and referring URL;
• Cookies and similar technologies — see section 14.

6.4 From third parties

We may receive information about you from:

• Our authentication sub-processor (Clerk) — for account-related signals such as email verification status and sign-in method;
• Our payment sub-processor (Stripe, Employer accounts only) — payment method verification and transaction outcomes;
• Our email sub-processor (Resend) — delivery, bounce, and reputation signals for emails we send you;
• A referee you have nominated — when they respond to a reference request; and
• Publicly available sources (limited use for verification of Employer organisations only) — for example, ABN Lookup or company website content.

6.5 About other people

When you enter information about another person into the Platform — for example, referee details on your profile — you confirm that you have that person's authority to do so and that they are aware their details are being shared with us for the purpose described. If you enter someone's details without their knowledge or consent, that is a breach of section 6 of the T&Cs.

7. Why we collect and use it

We collect and use the information above to operate the Platform. Specifically:

We do not use your Personal Information for any purpose that is materially different from these without either your consent or another lawful basis under the APPs.

What we do not do:

• We do not sell your Personal Information.
• We do not trade or rent contact lists.
• We do not disclose Candidate contact details to Employers other than through the consent model.
• We do not use your Personal Information to train AI models, and we do not permit our AI sub-processors to do so (see section 8).
• We do not perform automated decision-making that produces legal or similarly significant effects on you without human involvement.

8. How we use AI, and what data goes into it

The Platform uses artificial intelligence for the specific, limited purposes below. In each case we use commercial AI APIs and do not permit those providers to use your Personal Information to train their models.

Where the content check flags a possible mismatch between an uploaded document and its profile entry, the flag is a soft warning shown only to the Candidate at upload time; the Candidate may continue the upload or replace the file, and no record of the flag is kept.

Our AI sub-processor is listed in section 10.

9. Direct marketing

9.1 If we send you marketing communications about YourHIRO — for example, product announcements or feature updates — we will do so only:

• (a) with your consent; or
• (b) where the Spam Act 2003 (Cth) otherwise permits, including because there is an existing account relationship and the communication is relevant to that relationship.

9.2 Every marketing email includes an unsubscribe link. You can also opt out at any time by contacting us (see section 17).

9.3 Unsubscribing from marketing does not stop us from sending you service messages — account notifications, security alerts, changes to these policies, or operational notices — which we may continue to send while your account is active.

10. Who we share your information with

We share Personal Information only where necessary to operate the Platform, comply with law, or protect our or others' rights.

10.1 Sub-processors

We use the following sub-processors to deliver the Platform. Each is bound by contractual privacy and security terms.

[CONFIRM] Supabase (Singapore, project region ap-southeast-1) and Railway (Singapore, moved from US West) were verified against the live account on 2026-08-23. Clerk, Stripe, Resend, Vercel and Anthropic locations must still be verified against each provider's current data-region setting for our account before publication. This table is APP 8 disclosure and must be accurate. If any of these change, the policy must be updated within a reasonable time and users notified.

10.2 Recipients other than sub-processors

We may also disclose Personal Information to:

• Employers whom a Candidate has consented to be contacted by — the specific contact details and any Engagement content, in accordance with section 5;
• Referees you have nominated — a reference request identifying you as the Candidate;
• Legal, regulatory, and law-enforcement authorities — where required by law or in response to a valid legal request, and only to the extent required;
• Our professional advisers (for example, lawyers or accountants) where necessary for advice and bound by professional confidentiality;
• A successor entity — in the event of a merger, acquisition, restructure, or sale of the business, in which case we will require the recipient to honour this policy or provide equivalent protection.

10.3 What we require of recipients

Where we disclose Personal Information to a sub-processor or other recipient, we take reasonable steps to ensure they handle it in accordance with the APPs, or an equivalent standard, and only for the purpose disclosed. For sub-processors listed above, this is covered by written data processing terms.

11. Overseas disclosure (APP 8)

As shown in section 10.1, some of our sub-processors process Personal Information outside Australia. In particular:

• Singapore — Supabase (database and files, including your profile content and uploaded documents) and Railway (backend application hosting);
• United States — Clerk, Stripe, Resend, Vercel, Anthropic.

By using the Platform, you consent to your Personal Information being disclosed to these overseas recipients for the purposes described in this policy. This is important because it means, under APP 8.2, you are choosing to receive our services on the basis of that overseas disclosure, and section 16C of the Privacy Act 1988 (Cth) may operate differently than if you had not consented. We describe this openly so that your consent is informed.

We take reasonable steps to ensure our overseas sub-processors handle your Personal Information in a manner consistent with the APPs, including by requiring written data processing terms.

12. How long we keep it

We retain Personal Information for as long as we need it for the purposes described in this policy, then we delete or de-identify it. In practice:

• Active account data — kept while your account is active.
• Uploaded documents — kept while the profile item they are attached to exists, or until you delete them.
• Engagement content — kept while both parties have the Engagement open on the Platform; retained thereafter for a reasonable period for dispute resolution and safety purposes.
• Consent Events — retained for an extended period after account closure for audit, legal, and dispute purposes, as an append-only record of what consents were granted, declined, and revoked.
• Billing records — retained for the period required by Australian tax and financial-record law (currently 5 years for most records).
• Marketing suppression list — if you unsubscribe, we retain the fact you have unsubscribed so we do not re-contact you.
• Backups — Personal Information may persist in encrypted backups for a short period after deletion from active systems; these backups are overwritten on our normal cycle.

If you close your account, we delete or de-identify your Personal Information within a reasonable period, subject to the retention needs above.

How to ask for deletion today. You have the right to ask us to delete your account. Self-service deletion inside the Platform is currently switched off while we correct our deletion process. To ask for deletion, email privacy@yourhiro.com.au from the email address on your account. YourHIRO staff will check that the request comes from you and handle it, subject to the retention needs above.

[LAWYER] Self-service deletion is disabled at the server (it answers "deletion disabled") until the deletion pipeline's recorded defects are fixed. Confirm the response time to commit to for a staff-handled deletion request, and whether this interim process needs anything further before publication.

13. Third-party links and services

The Platform may contain links to third-party websites (for example, an Employer's own website linked from their profile). Those sites have their own privacy practices; we do not control them and are not responsible for how they handle your information. Review their privacy policies separately.

14. Cookies and similar technologies

14.1 We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Platform, and understand how the Platform is used. We use:

• Strictly necessary cookies — required for the Platform to function (for example, to keep you signed in). These cannot be turned off in our interface.
• Analytics cookies — help us understand aggregate usage of the Platform. [FILL — name the analytics provider if used, e.g. Vercel Analytics, PostHog. If none, remove this row.]
• Third-party cookies from sub-processors — for example, Clerk sets cookies used by its authentication system.

14.2 You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent parts of the Platform from working.

15. Security

15.1 We use technical and organisational measures to protect Personal Information, including: encryption in transit (TLS); access controls; owner-scoped short-lived signed URLs for uploaded documents (documents are not publicly accessible and are only downloadable via a signed URL issued to the owner); role-based backend access; and audit logging.

15.2 No system is perfectly secure. If we become aware of a data breach that is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme (Part IIIC of the Privacy Act 1988 (Cth)).

15.3 Keep your account secure by using a strong, unique password and not sharing your login. Notify us immediately at [FILL — security email] if you suspect unauthorised access.

16. Your rights

You have rights under the Privacy Act 1988 (Cth) and the APPs. In summary, you can:

• Access Personal Information we hold about you (APP 12);
• Correct Personal Information that is inaccurate, out of date, incomplete, or misleading (APP 13);
• Withdraw consent where our handling relies on your consent (including revoking consent to an Employer under section 5);
• Object to direct marketing and unsubscribe at any time (see section 9);
• Ask us to delete your account — self-service deletion is currently switched off, so send the request to privacy@yourhiro.com.au and YourHIRO staff will handle it; section 12 describes what deletion does to your data; and
• Complain to us and, if unsatisfied, escalate to the OAIC (see section 18).

Some rights are subject to exceptions under the Privacy Act 1988 (Cth) — for example, we may decline an access request that would unreasonably reveal another person's Personal Information (such as a referee's confidential response). Where we decline a request, we will explain why.

To exercise any of these rights, contact us using section 17. We do not charge a fee for handling a rights request unless it is manifestly excessive; if we do charge, we will tell you in advance.

17. How to contact us

You can contact us about this policy or your Personal Information at:

• Email: [FILL — privacy@yourhiro.com.au]
• Postal address: [FILL — business address]

We aim to respond to privacy requests within 30 days. Complex requests may take longer; if so, we will keep you informed.

18. Complaints

18.1 If you believe we have handled your Personal Information in breach of this policy or the Privacy Act 1988 (Cth), please contact us first at [FILL — privacy email]. We take complaints seriously and will investigate.

18.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• Web: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

19. Changes to this policy

We may update this policy from time to time — for example, if we add a new feature, change a sub-processor, or in response to legal change. When we make a material change, we will notify you by email or through the Platform, and update the effective date at the top. Continued use of the Platform after the effective date means you have read the updated policy. If a change is one you cannot accept, you can close your account.

20. Children

The Platform is not intended for people under 18, and we do not knowingly collect Personal Information from anyone under 18. If we discover we have collected Personal Information from a person under 18 without appropriate authority, we will delete it. If you believe a person under 18 has provided us with Personal Information, contact us at [FILL — privacy email].

Draft prepared as a working document for YourHIRO. This draft was prepared with AI assistance and is not legal advice; it must be reviewed, amended, and approved by qualified Australian legal counsel before publication or reliance. Where the T&Cs and this policy overlap (in particular section 5 of this policy and clause 4 of the T&Cs), the two documents must be maintained together.