Privacy Policy

Employers use Shortlio to create screening questions, collect candidate answers and review applications. The employer determines what it asks and makes every hiring decision. We process candidate information on the employer’s behalf and collect limited employer-account information to operate accounts, subscriptions, security and support.

Depending on how the employer configures an application, candidate information may include:

• name and email address;
• résumé and employment-related information;
• video and audio recordings, written answers and uploaded files;
• transcripts and AI-assisted evidence summaries;
• the time consent was provided and application activity; and
• basic device, browser, security and diagnostic information.

For employer-account users, we may collect work contact details, organisation and team information, roles, questions, notes, subscription and billing status, support communications, product feedback and authentication or diagnostic information. Our payment provider handles payment-card details; Shortlio does not store full card details.

We collect information directly from candidates and account users, from authorised employer team members, automatically when the service is used, and from providers supporting the service.

We use it to provide and secure Shortlio, receive and store applications, transcribe answers, identify evidence against employer-set criteria, send service notifications, administer subscriptions, provide support, investigate faults or misuse, meet legal obligations and improve reliability and usability.

We do not use candidate recordings, answers or résumés to train general-purpose AI models.

Shortlio may use AI services to transcribe answers and prepare evidence-based summaries from what a candidate says, writes or uploads. AI-generated material may contain errors or omit context.

Shortlio does not automatically accept, reject or rank candidates and does not analyse faces, appearance, emotions, accents, body language or personality. Employers must review source material and make every employment decision using human judgment.

Candidate applications may be accessed by authorised members of the employer’s hiring team, an authorised reviewer using a read-only link, and Shortlio personnel or providers where reasonably necessary to operate, secure or support the service. A read-only review hides candidate contact details and private team notes.

We may disclose information where required by law, to investigate fraud or security incidents, protect legal rights, or support a corporate transaction subject to appropriate safeguards. We do not sell candidate personal information.

We use Supabase for database, authentication and file storage; Netlify for hosting and delivery; OpenAI for transcription and AI-assisted summaries; Resend for service email; and Stripe for subscriptions and billing.

Application data and recordings are intended to be stored in Australia where configured. Some providers may process personal information or service metadata outside Australia, including in the United States and other countries where they operate. Privacy laws in those countries may differ from Australian law.

Before beginning an application, candidates are shown how their information will be used, the employer’s selected retention period and that transcription and AI-assisted processing may occur outside Australia. A candidate may ask the employer whether another application method is available if they do not wish to provide a recording; the employer determines whether an alternative is available.

Each employer selects a candidate-retention period between 30 and 365 days, with 90 days as the default. Shortlio shows that period before consent and records it for the application. Candidate contact details, answers, recordings, résumé and uploaded files are automatically deleted when the disclosed period expires. The employer may delete an application sooner.

A later employer setting change applies only to future applications and does not extend the period already disclosed to an existing candidate. Applications started but not submitted are deleted seven days after the candidate’s last activity.

Account, billing, security and legal records may be kept longer where reasonably required. Deleted information may remain in encrypted backups for a limited period until overwritten and is not returned to active use.

We use reasonable technical and organisational safeguards, including encryption in transit and at rest, access controls, private storage, short-lived access links, authentication, logging and automated deletion. No online service can guarantee absolute security. Account users must protect their credentials and promptly report suspected unauthorised access.

Candidates should ordinarily contact the employer they applied to, because that employer controls the recruitment process and can identify the application. Candidates and account users may also email hello@shortlio.co. We may verify identity and coordinate with the employer before completing a request.

We may refuse or limit a request where permitted or required by law and will explain the reason where appropriate.

Email hello@shortlio.co with enough detail for us to investigate. We aim to acknowledge complaints promptly and provide a substantive response within 30 days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner.

Shortlio may use cookies or similar browser storage reasonably necessary for authentication, session security, preferences and service operation. If we introduce non-essential analytics or advertising technologies, we will update this policy and provide any choices required by law.

Shortlio is intended for employment-related screening and employer-account users. Employers must not use it to collect information from a person who cannot lawfully provide the required information or consent without obtaining any additional authorisation required by law.

We may update this policy when our services, providers or legal obligations change. We will publish the revised policy with a new effective date and provide additional notice where a change is material.