Privacy Policy

1. Information We Collect

We collect personal information that you provide to us, that is generated as you use the platform, and (in limited cases) that others provide about you.

Account information

When you register, we collect your name, email address, suburb or general location, and your role on the platform (worker or employer). Passwords are stored only as a one-way cryptographic hash — we never have access to your plaintext password.

Accounts created when you apply

You can apply for a role without signing up first. When you do, we create a free Tavro worker account for you using the name and email address you gave on the application form, plus your answer to when you can start. We do this so the venue can reply to you and so you can track the application — an application with nowhere to send the answer is not much use to either side.

We tell you this on the form before you apply, and again in the email we send you straight afterwards. That email includes a link to set a password, and you can delete the account and everything in it at any time from your profile settings. Deleting the account also withdraws the application.

We record the time you agreed to these terms. We do not send you marketing because you applied — job alert emails are off by default and you turn them on yourself if you want them.

Worker profile information

Workers may choose to provide additional information to build their profile and improve visibility to employers. This may include:

• Contact details (phone number), a profile photo, and a short biography
• Current or recent role, years of experience, skills, and preferred roles
• Work history, career goals, and portfolio images
• Certifications and licences (such as RSA/RCG), and any renewal dates you add
• Work rights / visa type, weekly availability, preferred locations, and minimum pay preference
• A résumé or CV document, if you choose to upload one

This information is voluntary — you control what you add, and you can edit or remove it at any time from your account.

Information about other people (references)

If you add a professional reference, you provide us with that referee's name and, optionally, their title, company, and contact details (email and phone). You should only provide a referee's details if you have their consent to do so. At your request, we may send the referee a one-time email so they can confirm the reference — see "How we use your information" below.

Employer (venue) information

Employers provide venue information including venue name, description, type, team size, location, logo, photos, and social links, along with the contact details of the account holder. Venue profile information appears on your public venue page.

Job listings, applications, and messages

Roles you post (title, description, category, pay, location, start date), the applications you submit or receive (including any cover note and status history), and messages exchanged between employers and workers on the platform.

Usage and device information

As you use the platform we collect information such as pages viewed, features used, and events (for example, job views and applications), together with technical data such as your device type, browser, and approximate location derived from your IP address. Some of this is collected via cookies and similar technologies, subject to your consent — see our Cookie Policy. We also collect diagnostic and error information to keep the service secure and reliable.

2. How We Use Your Information

We may also use your information to send you service-related communications (such as application updates), to enforce our Terms of Service, and to comply with our legal obligations. We do not sell your personal information, and we do not use it for third-party advertising.

3. Who Can See Your Information

Worker profiles

When you set your profile to "open to work", your public profile — name, job title, skills, certifications, work history, availability, and portfolio — is visible to visitors and employers. Your email address, phone number, pay preference, résumé, and reference contact details are not shown on your public profile.

Your résumé is stored privately and is made available only to employers whose jobs you have applied to. A referee's contact details are only released to an employer who has recorded a hire of you through Tavro. Where a referee confirms a reference, a "verified" indicator may be shown, without revealing their contact details.

Employer profiles

Your public venue profile — venue name, description, type, and open roles — is visible to all visitors, including people who are not signed in.

Messages

Messages are visible only to the two participants in a conversation.

4. How We Protect Your Information

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• Encryption of data in transit using industry-standard TLS (HTTPS)
• Access controls that restrict each account to its own data, enforced at the database level
• Private storage for sensitive documents such as résumés, released only via short-lived, access-controlled links to authorised recipients
• One-way hashing of passwords, and least-privilege access for our systems and personnel
• Prompt anonymisation and deletion of data when an account is closed (see "Data retention")

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. If we become aware of a data breach likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

5. Service Providers

We use reputable third-party service providers to help us operate the platform. These providers act on our behalf, process information only as necessary to deliver their service to us, and are bound by confidentiality and data-protection obligations. We do not sell your personal information to any third party.

Our providers fall into the following categories:

• Cloud infrastructure & security — hosting, database storage, authentication, and file storage
• Email delivery — transactional messages such as application updates and account emails
• AI-assisted features — drafting assistance for job descriptions only; personal information is not included in these requests
• Analytics — aggregate and session-level analytics to understand how the platform is used (subject to your consent — see our Cookie Policy)
• Error & performance monitoring — diagnostic logging to identify and resolve technical issues

6. Overseas Disclosure

Some of our service providers may store or process personal information outside Australia, including in jurisdictions such as the United States. Where this occurs, we take reasonable steps to ensure the recipient handles your information in a manner consistent with the Australian Privacy Principles.

By using Tavro, you acknowledge that your personal information may be handled overseas on this basis. We do not publish the specific identity or location of our infrastructure providers for security reasons; if you have a specific query about overseas handling, contact us using the details below.

7. Data Retention

We may retain limited information for longer where required to comply with a legal obligation, resolve disputes, or enforce our agreements.

8. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate information — most profile information is editable directly from your account settings
• Delete your account and associated data — available via Account Settings; data is permanently purged within 30 days
• Withdraw consent to optional processing, such as analytics cookies, at any time
• Complain — to us in the first instance, and to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe your privacy rights have been breached

To exercise any of these rights, contact us at hello@tavro.com.au. We will respond within a reasonable time and may need to verify your identity first.

9. Children

Tavro is intended for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, please contact us and we will delete it.

10. Cookies

See our Cookie Policy for details on the cookies we use and how to manage them.

11. Changes to This Policy

We may update this policy from time to time. We will notify registered users of material changes by email with at least 14 days' notice before those changes take effect, and update the "Last updated" date above.

12. Contact

For any question about this policy or how we handle your information, contact us at hello@tavro.com.au.