Privacy Policy

1. About This Policy

OneStop IT Talents Pty Ltd("we", "us", "our") operates Skilio Hire, an AI-assisted recruitment platform. This Privacy Policy explains how we collect, hold, use, and disclose personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Policy covers two categories of people whose information we handle:

• Platform users — recruiters, HR managers, and team members who have an account on Skilio Hire.
• Candidates — job applicants whose CVs and personal information are uploaded to the Platform by our users.

2. Personal Information We Collect

Platform Users

• Name and email address (via Clerk authentication)
• Organisation name and ABN (if provided)
• Billing details — name, address (processed by Stripe; we do not store card numbers)
• Usage data — features accessed, screening activity, login timestamps
• Communications — support requests and emails you send to us

Candidates

Candidate data is uploaded by our users (recruiters or HR teams acting on the candidate's behalf). This may include:

• Full name, contact details (email, phone, address)
• Employment history, education, qualifications, and skills
• CV and cover letter documents (stored as encrypted files in AWS Sydney)
• Recruiter notes and pipeline status

AI-Generated Assessments (Derived Personal Information)

Our AI system generates the following about each candidate. These outputs are derived personal information under the Privacy Act 1988 and are held and protected with the same obligations as directly collected personal information:

• Overall match score (0–100) against the job requirements
• Sub-scores: skills match, experience, education, seniority alignment
• Matched and missing skills assessment
• Hiring recommendation (shortlist, review, or reject)
• AI confidence level and suggested interview questions

3. How We Collect Information

• Directly from you — when you create an account, set up your workspace, or contact us.
• Via Clerk — our authentication provider collects your email and name when you sign up or sign in with Google.
• Via Stripe — our payment processor collects billing information when you subscribe.
• Through Platform use — usage data is collected automatically as you interact with the Platform.
• From recruiters (for candidates) — candidate CVs and personal information are uploaded by recruiter users. Candidates do not directly interact with Skilio Hire.

Our recruiter-upload model and APP 3 (Collection of Solicited Personal Information)

Because candidates do not upload their own data, we rely on our Platform users (recruiters and HR teams) to meet the collection and notification obligations under APP 3 and APP 5. Specifically, our Terms of Service require that:

• Recruiters must obtain each candidate's prior informed consent before uploading their CV to the Platform.
• Candidates must be notified that their data will be processed by an AI system and that an automated assessment will be generated.
• Candidates must be informed that their CV content will be transmitted to Anthropic (USA) for AI processing (overseas disclosure under APP 8).

If you are a candidate and you were not informed of these matters before your data was uploaded, you may contact us at hello@onestopittalents.com.au to request access to your data or to have it deleted.

4. Why We Collect Personal Information

We collect personal information for the following primary purposes:

• Providing, operating, and improving the Skilio Hire platform
• Processing subscription payments and issuing GST invoices
• Authenticating users and managing account security
• Processing CV screening requests using AI
• Sending transactional emails (trial expiry alerts, batch results, invitations)
• Responding to support requests
• Complying with legal obligations

We will only use your information for a secondary purpose if it is related to the primary purpose, you would reasonably expect it, or you have consented — as required by APP 6.

5. Disclosure to Third Parties

We do not sell, rent, or trade personal information. We disclose information only to the following service providers, solely to deliver the Platform:

Each provider is bound by contractual obligations to protect personal information and may only use it for the specified purpose.

6. Overseas Disclosure (APP 8)

Some service providers listed above (Anthropic, Clerk, Stripe) are located in the United States. Before disclosing personal information to these providers, we take reasonable steps to ensure they are bound by privacy obligations comparable to the APPs through contractual arrangements (data processing agreements).

CV content submitted for AI screening is transmitted to Anthropic's API solely for processing and is not retained by Anthropic for training purposes under our API agreement.

Under APP 8.1, by using the Platform you consent to this overseas disclosure. You acknowledge that the overseas recipient is not required to comply with the APPs in relation to the information.

7. Data Storage and Security (APP 11)

• All data is stored in AWS Sydney (ap-southeast-2) — within Australia.
• CV files are encrypted at rest using AES-256.
• All data in transit is encrypted using TLS 1.2 or higher.
• Access to personal data is restricted to authorised staff and systems.
• CV files are automatically deleted after 90 days via S3 lifecycle policy.
• Platform user accounts can be deleted on request — see Section 9.

In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

8. How Long We Retain Data

9. Automated Decision-Making and Your Rights

Skilio Hire uses AI to generate candidate assessments. We are committed to transparency about how this works and what rights candidates have.

How automated scoring works

• Your CV text is sent to Anthropic's Claude AI model for analysis.
• The AI generates scores based solely on skills, experience, and qualifications — not on name, gender, age, or address.
• A human recruiter reviews all AI outputs before any hiring decision is made.
• The AI recommendation (shortlist / review / reject) is an advisory output, not an automated hiring decision.

Your rights regarding AI assessments

As a candidate, you have the right to:

• Know that AI has been used to assess your application — this should have been communicated by the recruiter.
• Request access to the AI-generated assessment held about you by contacting us at hello@onestopittalents.com.au.
• Request correction if the assessment is based on inaccurate information.
• Request deletion of your data at any time — we will process this within 14 business days.
• Raise a concern if you believe the AI assessment was discriminatory or biased.

10. Access, Correction and Deletion (APP 12 & 13)

You have the right to request access to the personal information we hold about you, and to request corrections if it is inaccurate, incomplete, or out of date.

Platform users can access and update their profile information directly within the Platform settings.

Candidates whose data has been uploaded by a recruiter should contact that recruiter directly in the first instance. If you believe your information has been mishandled, you may also contact us directly.

To request access, correction, or deletion, email us at hello@onestopittalents.com.au. We will respond within 30 days as required by APP 12.

11. Cookies and Tracking

We use the following cookies and browser storage:

• Authentication cookies — set by Clerk to maintain your signed-in session. These are necessary for the Platform to function.
• AI disclosure cookie — records that you have acknowledged our AI usage disclosure. Required for compliance.
• Session storage — used to remember UI preferences within a single browser session.

We do not use advertising, analytics, or tracking cookies. We do not use Google Analytics or any third-party analytics service.

12. Complaints (APP 1)

If you believe we have breached the APPs or this Privacy Policy, please contact our Privacy Officer at hello@onestopittalents.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify Platform users by email and post the updated Policy on this page with a revised effective date. Continued use of the Platform after the effective date constitutes acceptance.

14. Contact Our Privacy Officer