Draft — pending legal review. This unified version merges the previously lawyer-approved Candidate policy (candidates.jobgen.ai, effective 15 July 2025) with new provisions for the Recruiter and Receptionist products, an Automated Decision-Making Transparency section anticipating the Privacy Act 1988 (Cth) ADM disclosure requirement, and new GDPR/EEA-UK content required now that we serve Business Customers and Candidates in Europe. Only the content carried over from the 15 July 2025 Candidate policy has prior legal sign-off. Everything else — and every place marked [LEGAL INPUT NEEDED] — needs counsel review before this replaces the live policy. (Section numbering below has been corrected to match the Contents list; the previous draft had headings offset by +29 from their cross-references.)
This Privacy Policy explains how JobGen.AI collects, uses, discloses, and protects personal information across all of our products (collectively, the "Platform"): the JobGen.AI Recruiter product (recruiter.jobgen.ai), the JobGen.AI Receptionist product (receptionist.jobgen.ai), and the JobGen.AI Candidate / Career Coach product (candidates.jobgen.ai), together with our marketing website (jobgen.ai). It should be read together with our Terms of Service (Business or Candidate, as applicable) and Data Processing Agreement.
1.1 JobGen Pty Ltd (ABN 71 696 826 561), trading as JobGen.AI ("we", "us", "our"), conducts its business in and from Australia and provides AI-powered recruitment, front-desk, and career-coaching software to recruitment agencies, staffing firms, independent recruiters, and other businesses ("Business Customers"), as well as directly to individual job seekers ("Candidates"), across our Recruiter, Receptionist, and Candidate / Career Coach products (together, the "Platform").
1.2 Depending on which product you use and how your data reaches us, we act in one of three roles:
2.1 This Privacy Policy applies to:
2.2 This Privacy Policy describes the types of personal information we collect and why, how we use and disclose it, our security measures, how you can access or correct it, what to do if you think it is inaccurate, and how to contact us.
3.1 Personal information is data about an individual whose identity is apparent or can reasonably be ascertained from that data.
4.1 We do not require sensitive information but may receive it voluntarily. This may include racial or ethnic origin, union memberships, health or disability information, and sexual orientation — for example, where a Candidate voluntarily discloses it in a resume, or a Business Customer records right-to-work or accessibility information about a candidate.
4.2 Where we receive sensitive information, we handle it in accordance with the Privacy Act 1988 (Cth) and, where applicable, the GDPR or UK GDPR. We will only use or disclose sensitive information for the purpose for which it was provided, or as otherwise permitted by law.
5.1 Candidates (Career Coach product, provided directly by you): name, contact details, employment history, qualifications, resumes/CVs, target roles, and voluntarily provided information, plus the application, interview, and coaching activity you generate — for example, resume diagnostics, mock interview recordings or transcripts, and coaching plan progress.
5.2 Business Customers — account and billing data: name, email, organisation, role, authentication identifiers, and payment details (processed by our payment provider).
5.3 Candidate and business contact data provided or generated by a Business Customer: names, contact details, resumes/CVs, work history, tags, and — where the Business Customer chooses to record it — salary expectations, notice period, and right-to-work status.
5.4 Job organisations: business name, contact information, and HR representatives' details.
5.5 Suppliers and partners: contact information for individuals or representatives.
5.6 Website visitors and newsletter subscribers: name, email, and event attendance details.
5.7 Usage and device data: log data, IP address, device and browser information, feature usage, and credit consumption, collected via cookies and similar technologies.
5.8 Communications data: the content of messages sent or logged through the Platform (email, SMS, WhatsApp, LinkedIn), and call recordings, transcripts, summaries, sentiment, and extracted fields where calls are recorded (including calls handled by the Receptionist product on behalf of a Business Customer).
5.9 Call recording — Receptionist product. [LEGAL INPUT NEEDED — PRIORITY BEFORE LAUNCH] The Receptionist product may record calls made to or through a Business Customer's front-desk line. Before this clause is finalised, counsel must confirm and document: (a) the actual real-time consent or disclosure mechanism used before or during a call (for example, an audible notice played at the start of the call, an SMS disclosure sent to the caller, or reliance on the Business Customer's own notice to their callers); (b) how this is handled across Australian jurisdictions, noting that most states require at least one-party consent but some (including NSW under the Surveillance Devices Act 2007 (NSW)) require all-party consent for private conversations; and (c) how this is handled for EEA/UK callers under applicable telecoms and ePrivacy rules. The Data Processing Agreement must also address the Business Customer's own disclosure obligations to their callers.
5.10 Enrichment data: business contact and company information (such as phone numbers, email addresses, and hiring signals) sourced from third-party data providers and surfaced to Recruiters.
6.1 We collect personal information when you set up an account, use the Platform, or communicate with us, and — for Business Customers — when a candidate's, contact's, or caller's information is added to the Platform on the Business Customer's behalf.
6.2 If you provide us with someone else's personal information, you must have the right to share it with us and, where required, have obtained that person's consent.
7.1 If we receive unsolicited personal information, we will assess whether it could have been lawfully collected under the Privacy Act 1988 (Cth). If not, we will destroy or de-identify it as soon as practicable.
8.1 We collect technical data when you use the Platform, including IP address, browser type, pages visited, and downloaded documents. This data is used to operate, secure, and improve the Platform.
9.1 The Platform includes AI-powered features that assist Candidates and Business Customers. These include:
9.2 These features are assistive only and operate under human review. They do not make final employment decisions. See clause 10 for our automated decision-making transparency disclosures.
9.3 Candidates and Business Customers may opt out of specific automation features via account settings or by contacting us at hello@jobgen.ai.
10.1 Australian Privacy Act — APP 1 disclosure (effective 10 December 2026). [LEGAL INPUT NEEDED — verify commencement date and operative wording against the amending Act] From 10 December 2026, the Privacy Act 1988 (Cth) requires APP entities to disclose in their privacy policy certain uses of automated decision-making (ADM) that could reasonably be expected to significantly affect individuals' rights or interests. The following disclosures are made in accordance with that obligation.
10.2 Kinds of personal information used in automated programs. The following types of personal information are used in our automated and AI-assisted programs:
10.3 Kinds of decisions made solely or substantially by automated programs. [LEGAL INPUT NEEDED — confirm against actual product behaviour before publishing] The following decisions are made solely or substantially by automated programs using the personal information described above:
10.4 Kinds of decisions where automated programs do something substantially and directly related to making the decision. The following decisions involve human review but are substantially informed by automated program outputs:
10.5 Human oversight. All decisions that could significantly affect a Candidate's employment prospects or a caller's access to services are subject to human review by the relevant Business Customer or Candidate. Our AI features do not make final hiring decisions.
10.6 GDPR — Article 22. For EEA/UK data subjects, where any automated processing produces a decision that has legal or similarly significant effects on you, you have the right not to be subject to that decision and to request human review. To exercise this right, contact hello@jobgen.ai. See also clause 26.
11.1 Job platforms. With your consent, we may use your personal information to fill in job applications on third-party platforms (such as LinkedIn, Seek, Glassdoor, Naukri.com, or Indeed) and to check third-party job submission status. Login credentials for third-party platforms are only stored with your explicit consent, using secure methods.
11.2 Google account connection (Business Customers). If a Recruiter connects a Google account, we use Google OAuth to access only the Google user data and Gmail permissions the Recruiter authorises:
Google OAuth tokens are encrypted and used only for these features. Recruiters can disconnect Gmail in Platform settings. We do not sell Google user data, use it for advertising, or use identifiable Google user data to train general AI models without explicit consent. Our use of data obtained via Google APIs is limited to the features described in this clause and is not transferred to third parties except as necessary to provide those features.
11.3 Microsoft account connection (Business Customers). If a Recruiter connects Outlook or Microsoft 365, we use Microsoft OAuth and Graph permissions only as authorised:
Microsoft OAuth tokens are encrypted and used only for these features. Recruiters can disconnect Outlook in Platform settings. We do not sell Microsoft user data, use it for advertising, or use identifiable Microsoft user data to train general AI models without explicit consent.
12.1 We use cookies to remember returning users, track page visits, analyse usage via Google Analytics, and understand signed-in product journeys and feature usage through privacy-restrained first-party analytics and PostHog.
12.2 Product journey analytics may be linked to your account and records page categories, active time, navigation paths, and selected product actions. It does not record form contents, search terms, resumes, job descriptions, generated documents, session recordings, or raw click streams.
12.3 You can disable cookies in your browser settings, but this may affect your experience of the Platform.
13.1 We may analyse aggregated and de-identified Platform data to improve our service, understand user behaviour, and monitor usage. This data does not identify individual users.
14.1 Purposes of use. We use personal information to:
14.2 Disclosure. We may disclose personal information to:
14.3 Sub-processors. We share personal information with trusted service providers who help us run the Platform, including providers of hosting and storage, telephony and messaging, call transcription, AI models (such as OpenAI), contact enrichment, payments, accounting export, and authentication. A current list of sub-processors is maintained in our Data Processing Agreement. We do not sell personal information.
15.1 [LEGAL INPUT NEEDED — confirm mechanic and legal basis before publishing] Where you create a Candidate account directly through the Career Coach product, your resume/CV and profile information [may only become visible or searchable to Recruiters using our Recruiter product if you opt in via a setting in your account — OR — is visible or searchable to Recruiters using our Recruiter product by default, and you may opt out via account settings]. This clause must be finalised to match the actual product behaviour. The choice between opt-in and opt-out directly determines the legal basis available for EEA/UK Candidates under clause 19: opt-out visibility requires a legitimate interests assessment; opt-in visibility permits reliance on consent (which must meet GDPR standards — freely given, specific, informed, and unambiguous).
15.2 Where your profile is shared with or made visible to a Recruiter under this clause, that Recruiter becomes a controller of the shared data for their own recruitment purposes, and their use of it is subject to their own privacy notice as well as this Policy.
16.1 We may send you updates or promotional content where you have consented or where we have a legitimate interest in doing so.
16.2 You can opt out at any time by emailing hello@jobgen.ai or clicking "unsubscribe" in any marketing communication.
17.1 We collect data on your interaction with learning content to personalise your experience and improve resource quality. This data is handled in accordance with this Policy.
18.1 We do not use identifiable personal information to train AI models unless you give explicit consent, or the model provider confirms it will not use your data for training.
18.2 Where we use Platform data to improve our AI models absent such consent, we use only de-identified and aggregated data.
18.3 Candidates, Recruiters, and Business Customers can opt out of permitted training uses by emailing hello@jobgen.ai.
19.1 Australian Privacy Act. Where the Australian Privacy Principles apply, we handle personal information in accordance with the Privacy Act 1988 (Cth).
19.2 GDPR and UK GDPR. Where the GDPR or UK GDPR applies (including to Business Customers established in the EEA/UK and to Candidates located in the EEA/UK), we rely on the following legal bases depending on the purpose:
19.3 [LEGAL INPUT NEEDED — PRIORITY BEFORE LAUNCH] EU and UK representative. If JobGen.AI has no establishment in the EEA or UK, Article 27 GDPR and the equivalent UK GDPR provision require designation of a named EU representative and a named UK representative before this policy can be relied on by EEA/UK data subjects. The representative must be established in a Member State where data subjects are located, appointed in writing, and named in this policy with contact details. Failure to appoint is itself a breach of GDPR. Counsel must confirm whether a representative has been appointed and insert their details here:
EU Representative: [Name, address, email — to be inserted]
UK Representative: [Name, address, email — to be inserted]
20.1 We aim to keep personal information accurate and up to date.
20.2 You can request access to your personal information or request corrections if details are inaccurate by emailing hello@jobgen.ai. We aim to respond within 30 days and may deny access in specific circumstances permitted by law (for example, legal restrictions or privacy risks to others).
21.1 We retain account data for as long as your account is active and as required for legal, accounting, or dispute-resolution purposes. When no longer required, we delete, archive, or de-identify it.
21.2 Candidate and business contact data provided by a Business Customer is retained according to that Business Customer's instructions and our Data Processing Agreement. Candidate accounts created directly through the Career Coach product are retained for as long as the account is active, per your own instructions.
21.3 Business Customers on paid plans receive a 30-day export window on termination; data on free, trial, or beta plans is handled as described in our Terms of Service.
21.4 Detailed account-linked product journey events in our first-party analytics database are retained for up to 90 days. We may retain aggregated daily page, action, and navigation statistics for longer, because those summaries do not contain individual journey records. We also retain de-identified and aggregated data, and suppression-list entries needed to honour opt-outs, for longer periods.
21.5 [Proposed default — confirm with counsel.] Beyond the above, we propose retaining an individual Candidate's account data for up to 12 months after the account becomes inactive (no login or usage), before deletion or de-identification, unless you request earlier deletion under clause 22 or we are required to keep it longer by law.
22.1 You may request deletion of your personal information by emailing hello@jobgen.ai. We will respond promptly, unless we are required to retain it for legal reasons, in which case we will explain the basis for retention.
23.1 If a data breach occurs that is likely to result in serious harm (or, for EEA/UK data subjects, a risk to your rights and freedoms), we will notify affected individuals and the Office of the Australian Information Commissioner and/or the relevant EEA/UK supervisory authority, where required by law.
23.2 We maintain an internal data breach response plan and will act promptly to contain, assess, and remediate any breach.
24.1 We use technical and organisational safeguards to protect personal information, including:
24.2 No system is completely secure, and we cannot guarantee absolute security, including during transmission over the internet. If you have concerns about the security of your information, contact us at hello@jobgen.ai.
25.1 Platform data is primarily stored in Australian and United States data centres, and some personal information may be processed in the EU or Asia-Pacific by our service providers. While we use secure providers, overseas entities may be subject to foreign laws and may not, absent the safeguards described below, provide the same protections as Australian privacy law.
25.2 Australian Privacy Act — APP 8. Where personal information is transferred outside Australia, we take reasonable steps to ensure it is handled in accordance with Australian Privacy Principle 8 (cross-border disclosure), including through contractual clauses binding overseas recipients to APP-equivalent protections.
25.3 GDPR/UK GDPR transfers. Where the GDPR or UK GDPR applies and data is transferred outside the EEA/UK (including to Australia or the US), we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), or another lawful transfer mechanism, as the transfer safeguard.
25.4 [LEGAL INPUT NEEDED] Counsel must confirm the current sub-processor list and hosting regions — in particular whether any EEA/UK candidate or Business Customer data is hosted in-region (which would avoid a transfer for that data) — so this clause can name the actual mechanisms in use rather than describe them generically. The sub-processor list in the Data Processing Agreement should be updated at the same time.
26.1 Subject to applicable law, you may request to access, correct, delete, or export your personal information, object to or restrict certain processing, or withdraw consent. To make a request, email hello@jobgen.ai; we may need to verify your identity before responding.
26.2 If you are a candidate, contact, or caller whose data was provided by a Business Customer (a Recruiter or a business using the Receptionist product), we will direct your request to that Business Customer (the controller) and assist them in responding. If you created your own account directly through the Career Coach product, you can make your request to us directly and we will respond as the controller of that data.
26.3 Additional rights for EEA/UK data subjects. If you are located in the EEA or UK, you additionally have the right to:
27.1 The Recruiter and Receptionist products are intended for business use only.
27.2 Neither the Platform nor the Career Coach product is intended for use by persons under the age of 18. Persons under 18 are not permitted to open an account or use the Platform.
27.3 We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18 without appropriate consent, we will take steps to delete that information promptly.
28.1 We may update this Privacy Policy at any time. Updates will be posted on this page and, where changes are material, notified by email or in-platform notice at least 30 days before they take effect.
28.2 Continued use of the Platform after the notified effective date constitutes acceptance of the revised policy.
29.1 To contact us or make a privacy complaint:
JobGen Pty Ltd trading as JobGen.AI
Level 49, Parramatta Square, Sydney NSW 2150, Australia
Email: hello@jobgen.ai
Website: jobgen.ai
29.2 We aim to resolve complaints within 30 days. If you are not satisfied with our response, you may lodge a complaint with: