Privacy Policy

Last updated: 26 August 2026

Introduction

This privacy policy sets out how Versadox Pty Ltd (ACN 700 043 634) ("Versadox", "we", "us", "our") collects, stores, uses, discloses and protects your personal information.

It applies to versadox.com, app.versadox.com, our mobile applications, and any related services (together, the Platform).

Versadox is a career analysis platform. To do what it does, it necessarily handles information about your work history, education and professional background — including documents you upload, such as resumes and LinkedIn profile exports. We treat that as sensitive material and this policy explains exactly what happens to it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

By using the Platform, you consent to the collection, use and disclosure of your personal information as described here. If you do not agree, please do not use the Platform.

We may update this policy from time to time by posting an updated version on versadox.com. Where a change is material, we will notify registered users by email before it takes effect.

What we collect

Information you give us

Account information — your name, email address, and password (stored only as a cryptographic hash; we never see or store your password in readable form).

Profile and career information — your employment history, education, skills, certifications, languages, volunteer work, projects, interests, career goals and target roles, and any other information you enter into the Profile Builder.

Documents you upload — resumes, cover letters, and LinkedIn profile exports (PDF). These frequently contain further personal information: contact details, addresses, dates, referee names and contact details, and sometimes more.

Job listings and descriptions you paste in for comparison.

Feedback — ratings and comments you choose to submit.

Correspondence — anything you send us by email or through the Platform.

Information collected automatically

Device and browser type, IP address, approximate location derived from IP, pages viewed, features used, timestamps, and referral source. This is collected through Google Analytics and our own logging. See our Cookies Policy for detail.

Sensitive information

Resumes and career documents sometimes contain sensitive information as defined by the Privacy Act — for example health information, disability, racial or ethnic origin, religious or political affiliation, membership of a professional or trade association, or criminal record.

We do not ask for sensitive information and we do not require it. Where you include it in a document you upload, you expressly consent to us collecting and handling it for the purpose of providing the analysis you have requested. You can avoid this by removing such information from documents before uploading them.

How we use your information

We use your personal information to:

create and administer your account;
generate the analysis you ask for — Versadox Score, LinkedIn Review, Resume Audit, Job Comparison and related recommendations;
store your profile and your recent uploads so you can return to them;
send you service messages: email verification, password resets, and notices about your account or material changes to this policy;
respond to your enquiries and provide support;
monitor, secure, debug and improve the Platform;
comply with our legal obligations and enforce our terms.

We use de-identified and aggregated data — data from which you cannot reasonably be identified — to understand how the Platform is used and to improve it. For example, the distribution of scores across all users, or which features are most used.

We do not sell your personal information. We do not use your resume, profile or uploaded documents to train artificial intelligence models, and we do not permit our providers to do so (see below).

We will only send you marketing email if you have opted in, and every such message includes an unsubscribe link. Service messages are not marketing and cannot be opted out of while you hold an account.

Artificial intelligence and automated processing

This is the most important section of this policy, and we would rather over-explain it than leave you guessing.

What is sent, and to whom

To produce your analysis, the Platform sends the text content of your profile, your uploaded documents, and any job description you provide to Google's Gemini API, operated by Google LLC. Google's systems generate the analysis, which is returned to us and shown to you.

What Google may and may not do with it

We use the Gemini API on a paid tier. Under Google's terms for paid API services, prompts and responses are not used to improve or train Google's models or products, and are not made available to human reviewers for that purpose.

We consider this a requirement of operating this Platform, not an optional upgrade.

What we ask of you

Do not upload documents containing information you would not be comfortable being processed in this way — for example, another person's confidential information, or commercially confidential material belonging to an employer.

Automated decision-making

The Platform uses automated processing to generate scores, ratings, comparisons and recommendations about you, based on the information you and your documents provide.

These outputs are indicative, not authoritative. They may be incomplete, inaccurate, or unsuitable for your circumstances. They are not professional, career, recruitment, legal or financial advice, and they do not guarantee any employment outcome.

You have the right to request human review of any automated output that affects you. Email team@versadox.com and we will respond within a reasonable time.

Who else handles your information

We use the following service providers. Each processes personal information only to enable us to provide the Platform.

Supabase — Purpose: Database, authentication, file storage · Where data is held: Asia Pacific (Seoul, South Korea)
Google LLC (Gemini API) — Purpose: AI analysis of document and profile text · Where data is held: United States
Cloudflare — Purpose: Website and application hosting, content delivery, security · Where data is held: Global edge network
Loops — Purpose: Transactional email (verification, password reset) · Where data is held: United States
Google Analytics — Purpose: Usage analytics · Where data is held: United States

We may also disclose personal information:

to professional advisers, insurers, or auditors, under confidentiality;
where required or authorised by Australian law, a court, or a regulator;
to prevent or investigate suspected fraud, security incidents, or serious threats to safety;
to a purchaser or successor in the event of a sale or restructure of our business, subject to that party being bound by terms at least as protective as these.

Overseas disclosure

Your information is stored outside Australia. Our primary database and file storage are hosted in South Korea. AI processing, email delivery and analytics occur in the United States and other jurisdictions.

We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles, including through contractual terms with each provider. However, once information is held overseas it may be subject to the laws of that jurisdiction, and Australian Privacy Principle 8.1 protections may not be enforceable in the same way.

By using the Platform, you consent to this overseas disclosure.

How long we keep it

Account and profile data — Retention: While your account is open
Uploaded documents (resumes, LinkedIn PDFs) — Retention: The three most recent per document type. Older uploads are automatically deleted, file and record together.
Analysis results — Retention: The three most recent per feature type
Analytics and logs — Retention: Up to 26 months
Records we must keep by law — Retention: As long as the law requires

When you delete your account, we delete your profile, career data, uploaded documents and analysis results. Residual copies may persist in encrypted backups for up to 30 days, after which they are overwritten. De-identified aggregate data that cannot be linked to you may be retained.

Security

Your data is stored in a database with row-level security: policies enforced at the database level so that a signed-in user can only ever read or write their own records. Uploaded documents are held in a private storage bucket with the same per-user restriction — they are not publicly addressable and cannot be reached by guessing a URL.

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. Passwords are hashed. Administrative access is limited to those who need it.

No system is perfectly secure. We cannot guarantee absolute security, and you provide information to us at your own risk. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Your rights and choices

Access — you may request a copy of the personal information we hold about you.

Correction — you may correct most of your information directly in the Platform. For anything you cannot change yourself, contact us.

Deletion — you may delete your account at any time from Profile & Settings. This is a real deletion, not a deactivation flag.

Export — you may request a copy of your data in a portable format.

Marketing opt-out — unsubscribe from any marketing email, or contact us.

Human review — of any automated output, as described above.

We may need to verify your identity before acting on a request. We will respond within a reasonable time, and always within 30 days. If we refuse a request, we will explain why in writing.

Children

The Platform is not intended for anyone under 16, and we do not knowingly collect personal information from anyone under 16.

Anyone aged 16 or 17 may use the Platform only with the consent and supervision of a parent or guardian.

If you believe we have collected information from a child under 16, contact us and we will delete it.

Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us first at team@versadox.com. We will investigate and respond within a reasonable time, and always within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

oaic.gov.au
1300 363 992
GPO Box 5218, Sydney NSW 2001

Contact us

Versadox Pty Ltd (ACN 700 043 634) Email: team@versadox.com Web: versadox.com

This policy was last updated on 26 August 2026 and replaces all previous versions, including those published at versadox.com.au.