Shortlistr Privacy Policy

You can also submit a privacy rights request through the Privacy & Data area of Shortlistr or the public Privacy Rights page when available.

2.1 Account and identity information

• name and email address;
• country or location;
• account type, organisation membership and subscription information;
• authentication and session information;
• profile photograph where provided; and
• for Employer and Agency users, organisation name, business email, job title, location, team membership and profile information.

At launch, Shortlistr supports email/password and magic-link authentication. Authentication is provided through our application platform provider.

2.2 Candidate profile and Career Memory

• employment history, employers, job titles and dates;
• skills, seniority, industries, qualifications and education;
• salary information and career preferences;
• preferred roles, locations and work preferences;
• resumes, cover letters and other career documents;
• LinkedIn and portfolio links;
• Candidate-entered recruiter or interview feedback and notes;
• Career Memory summaries and related career information; and
• other information the Candidate chooses to add to their profile.

Shortlistr does not intentionally ask Candidates to provide sensitive information such as health information, disability, race or ethnicity, religion, sexual orientation, union membership, criminal history or political views as part of the standard Candidate profile.

2.3 Application Tracker and browser extension

The Application Tracker may store company and role information, job descriptions and URLs, salary or benefit information, recruiter or agency details, application stage and dates, interview dates, notes, documents, follow-up reminders, Candidate-entered feedback and public company research.

The Shortlistr browser extension helps Candidates save jobs from supported job and career sites. When the extension is open, it may read the current job page to identify information such as the job title, employer, location, job description, salary, canonical URL, named contact and structured job-posting metadata. It does not read passwords, cookies, browsing history, other tabs or values typed into application form fields.

Unsaved job-page information is processed locally in the browser first and discarded when no longer needed, except limited URL/company/title information used for duplicate checking. Full job information is stored when the Candidate chooses Add to Application Tracker.

Planned autofill features are Candidate-controlled. Shortlistr does not automatically submit job applications.

2.4 AI Interview Coaching

Shortlistr’s AI Interview Coach provides conversational interview practice tailored to the role, level and interview stage. The coach may use the Candidate’s resume, Career Memory, role description, employer, interview stage, practice responses and prior coaching information.

The coach may process Candidate voice/audio, session transcripts and AI-generated feedback. Interview audio has zero-day retention and is not kept after the session. Transcripts and any derived personal information are deleted from our voice provider’s systems (ElevenLabs) within 7 days. Candidate-specific transcripts and feedback are available in the Candidate’s Shortlistr profile, remain Candidate-controlled and are deleted within 30 days of account deletion, subject to lawful retention exceptions.

2.5 Job Match, tailored resumes and cover letters

Job Match is a Candidate-only tool that compares evidence in a selected resume against a job’s stated requirements and, where applicable, compares the estimated work environment with the Candidate’s WorkPrint preferences. It does not predict employability, interview likelihood or hiring probability.

Job Match runs only when the Candidate chooses to run it. Results may include capability and WorkPrint/Thrive alignment, requirement-level evidence, gaps and conflict information.

Shortlistr may create tailored resume and cover-letter drafts using Candidate-provided career information and the relevant job description. Generated drafts may be stored in the Candidate’s account, edited, versioned, downloaded and deleted.

AI drafting features are designed to anchor claims to Candidate-provided information. Some flows include automated fabrication or claim-integrity checks, while other flows rely on generation controls and Candidate review. Candidates remain responsible for reviewing generated material before use.

2.6 Candidate reviews, CEI and moderation

When a Candidate submits a hiring-experience review, Shortlistr may store the authenticated account identifier, role and hiring-stage information, review content, CEI responses, timing/outcome information, integrity and moderation signals, flags, audit records and Right of Reply history.

Approved reviews may display the job title, hiring stage, review content, CEI information, outcome, company name/logo and a published Right of Reply. The Candidate’s name, email and direct account identifier are not intended to be publicly displayed with an anonymous review.

Shortlistr privately retains identity information where required for review integrity, moderation, privacy rights, legal compliance and platform protection. Automated moderation and integrity systems may detect and route risk, but final legal or consequential decisions remain subject to human controls.

2.7 AI agents that help run Shortlistr

Shortlistr is developing specialist AI agents with separate purposes, credentials and access boundaries. Public descriptions will only be published where the corresponding technical controls are live.

Eve is Shortlistr’s knowledge-base agent. Eve drafts and maintains help content from release notes, allowlisted customer-facing code, approved published guides, aggregate guide ratings and a synthetic demonstration environment. Eve is designed not to access production user accounts, profiles, applications, reviews or messages. A Shortlistr administrator must approve content before it is published.

Tom is Shortlistr’s planned customer-support agent. Tom will answer from approved help content and use only the information required for the support case being handled. Tom’s final data scope, retention periods, human-handoff rules and provider configuration remain under design review and will be disclosed before launch.

Ripken is being redesigned as an internal business-intelligence assistant. Its intended purpose is to help authorised Shortlistr staff understand platform usage, volumes, subscriptions, churn and feature adoption. Ripken is not intended to communicate with users. The extent to which it will operate solely on aggregated/de-identified information versus limited account-level operational data remains under review and will be documented before launch.

No Shortlistr AI agent is intended to receive access to the protected identity mapping used to identify authors of anonymous reviews.

2.8 Employer and Recruitment Agency information

• account holder name, business email and role;
• organisation details, locations and employee numbers;
• team-member profiles and profile photographs;
• messages exchanged through eligible Marketplace/business messaging features;
• service, fee-range and commercial information; and
• sample terms or other documents voluntarily made available.

Employers and Agencies cannot upload Candidate personal information into Shortlistr as part of the current product design.

2.9 Payments and subscriptions

Shortlistr uses Stripe to process paid subscriptions. Card details and billing information entered at checkout are provided directly to Stripe’s hosted payment environment. Shortlistr does not receive or store full card numbers or CVV.

Shortlistr may provide Stripe with name, email, an account or billing reference, selected plan and billing period. We may receive and retain customer/subscription identifiers, invoice information, plan/billing status and transaction status.

Our application platform also receives certain Stripe webhook events used to support payment processing and revenue analytics. The broader Base44 Stripe connector is not currently authorised.

2.10 Communications, analytics and security information

We collect information associated with service communications, reminders, moderation notices, product updates, referrals, surveys and research, as well as limited technical, product-usage and security information required to operate and protect the Services.

Marketing consent is separate from service communications and is unticked by default. Non-essential analytics are disabled unless the user has provided the relevant consent.

Authentication tokens are stored in browser local storage rather than an authentication cookie.

• directly from you when you register, create a profile, upload information, use a feature, contact support or submit a review;
• from your browser when you deliberately use the Shortlistr extension;
• from your activity within Shortlistr;
• from Employers and Agencies providing their own business information;
• from payment, email, cloud, AI and other service providers supporting the Services; and
• from publicly available sources used for company or job research.

• create and manage accounts and authenticate users;
• provide Candidate, Employer and Agency Services;
• operate Application Tracker, WorkPrint, Job Match, Career Memory, resume, cover-letter and interview-coaching features;
• operate the browser extension and Candidate-controlled application assistance;
• process subscriptions and billing;
• provide customer support and human escalation;
• publish and moderate Candidate reviews and calculate CEI and related experience signals;
• prevent fraud, abuse, manipulation and unauthorised access;
• send service communications and, where consented, marketing communications;
• measure and improve Shortlistr using appropriate analytics;
• produce genuinely anonymised or aggregated benchmarks, reporting and insights; and
• comply with legal obligations and protect users, Shortlistr and the integrity of the Services.

Shortlistr uses AI-enabled features including the AI Interview Coach, Job Match, resume and cover-letter assistance, specialist operational agents, and automated moderation/integrity systems.

AI may process information you provide or information already held in your Shortlistr account where required for the feature you choose to use. We aim to minimise the information sent to AI systems and to apply purpose-specific access controls.

Candidate-facing AI tools do not make hiring or employment decisions on behalf of Employers or Recruitment Agencies.

Shortlistr uses third-party AI and platform providers. Base44, our application platform provider, has confirmed that Shortlistr data sent to external AI model providers through its platform, including OpenAI, Anthropic and Google Gemini, is not used to train those providers’ models. ElevenLabs, our voice provider for interview coaching, has also confirmed that it does not use Shortlistr data to train its models.

Base44’s terms permit it to use customer data, including data processed through Shortlistr, to develop and improve Base44’s own internal AI/ML models. Base44’s Data Processing Addendum treats this as part of providing the Services. The training and retention treatment for each provider is set out in our Subprocessor Register.

Some Shortlistr features produce scores, classifications, rankings or automated recommendations. Shortlistr is assessing these features against applicable transparency requirements for automated decision-making and decision-support.

The review includes CEI and recruiter-level CEI, Silent Rejection Risk Score, Job Match and ATS-related resume scoring, review moderation/integrity outcomes, and automated dormancy/application lifecycle processes.

Where a feature is subject to a specific legal disclosure requirement, Shortlistr will describe the kinds of personal information used, the role of automated processing and the kinds of decisions or outcomes involved.

• to service providers that host, secure, analyse, communicate, process payments for or otherwise support Shortlistr;
• to AI and voice providers where required to deliver a feature you choose to use;
• to professional advisers, auditors, insurers or legal advisers where reasonably necessary;
• where required or authorised by law, court order, regulator or valid legal process;
• where reasonably necessary to investigate fraud, abuse, security incidents or unlawful conduct;
• in connection with a business transaction, subject to appropriate confidentiality and legal requirements; or
• with your consent or at your direction.

We do not sell personal information. Where Shortlistr commercialises aggregated benchmarking or reporting, the information must be de-identified so that individuals cannot reasonably be identified.

Shortlistr is designed so Candidate reviews are anonymous by default on public and Employer/Agency-facing surfaces. Identity information linking a Candidate to a review is retained only where required for verification, integrity, moderation, privacy rights, legal compliance and platform protection.

Anonymity cannot be guaranteed if the circumstances described in a review make the reviewer reasonably identifiable to another person.

Shortlistr uses browser storage and may use cookies or similar technologies to operate the Services, remember privacy choices and, where consent is given, understand product usage.

Strictly Necessary functionality is active by default. Analytics, Functional and Marketing technologies are off by default unless the user chooses to enable them.

Shortlistr is based in Australia but uses service providers in Australia, the United States and other jurisdictions. Certain analytics data is stored in Google Cloud infrastructure in Australia, while our application platform, payments, communications, voice and AI providers may process information overseas.

When we disclose personal information to recipients outside Australia, we do so in line with Australian Privacy Principle 8. We assess material providers and use contractual terms that require them to protect personal information and use it only to provide their service. The location of each provider is listed in our Subprocessor Register.

Shortlistr keeps identifiable personal information only for as long as reasonably required for the purpose for which it was collected or as required/permitted by law.

• Candidate account, Career Memory, resumes, cover letters, Tracker data and related Candidate content: deleted or irreversibly anonymised within 30 days of a verified account-deletion request, subject to lawful retention exceptions;
• Interview-coaching audio: not retained after the session (zero-day retention), with transcripts and derived personal information deleted from our voice provider within 7 days;
• Interview-coaching transcripts and feedback: Candidate-controlled while active and deleted within 30 days of account deletion;
• security/authentication events: generally 90 days where justified;
• identifiable product analytics: up to 24 months where justified, with identifiers deleted or anonymised on valid deletion requests;
• CEI, benchmarks and aggregate reporting: may be retained indefinitely where genuinely anonymous;
• billing/subscription records: only as required for accounting, tax, chargeback, dispute or legal purposes;
• moderation, integrity, privacy and compliance records: only as long as reasonably necessary for the relevant purpose; and
• legal-hold records: for the duration of the applicable hold.

When a verified account-deletion request is submitted, account access is intended to be disabled immediately and the deletion/anonymisation lifecycle completed within 30 days. We may retain the minimum information required for an active legal hold, fraud/security investigation, privacy complaint, dispute or financial-record obligation.

Shortlistr uses administrative, technical and organisational controls designed to protect personal information. These include authenticated access, role-based permissions, least-privilege integrations, separation of reviewer identity information, audit trails for sensitive actions, security monitoring and incident-response processes.

Where we rely on provider certifications or controls, we describe them as provider controls rather than Shortlistr certifications.

Depending on your location and applicable law, you may have rights to request access to, correction of, deletion of, restriction of or objection to processing of personal information, or to request data portability.

• data export;
• account deletion;
• Career Memory and document deletion;
• interview-coaching history deletion;
• review deletion/request workflows;
• marketing and notification settings; and
• cookie/consent settings.

Requests can be submitted through the Privacy Rights page or to trust@shortlistr.io. We may need to verify identity before actioning a request.

We may send marketing or promotional communications where you have opted in or where otherwise permitted by law. Marketing consent is separate from service communications and is not pre-selected by default.

Privacy concerns can be submitted through the Privacy Rights page or to trust@shortlistr.io. We will review concerns and respond within a reasonable period, taking into account any response period required by applicable law.

We may update this Policy as Shortlistr develops, providers change or legal requirements evolve. Material changes will be reflected in the published version and, where appropriate, notified to users.