This policy explains what data we collect, how we use it, and what control you have over it. We've written it in plain language because you deserve to understand it.
Kiteline is operated by sortYa Pty Ltd, ABN 62697841008, located in Brisbane, QLD, Australia. We are the data controller for personal information collected through this platform.
Everything on this page applies to everyone with a Kiteline profile. Some parts only apply if you choose to:
Each of these asks for your agreement first, and links back here.
We comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). In addition, we have designed this platform to align with the European Union's General Data Protection Regulation (GDPR) as a standard of best practice — even where not strictly required — because we believe you deserve strong privacy protections regardless of where you are.
Under GDPR, every use of your personal data requires a legal basis. Here is the basis we rely on for each type of processing:
We use your career history to build a structured profile that our AI system uses to match you to relevant roles. This processing uses AI language models provided by third-party services (OpenAI, Anthropic). Your data is transmitted to these services solely for processing your request and is not used to train their models — this is guaranteed by their API data usage policies, which explicitly prohibit using API inputs for model training.
Your data is never used to train AI models. It is never sold to third parties. It is never shared with companies without your explicit consent.
A career summary — seniority, domain, key strengths
An AI-generated assessment of fit for their specific role
Whether you're open to contract or permanent work
Your name or contact details
Your photo or personal identifiers
Your full CV or complete career history
Your personal preferences and salary expectations
Which other companies have viewed your profile
None of the above is shared until you explicitly consent to an introduction. At that point, you decide what to share and with whom.
Some events and companies run their own pool on Kiteline. When you join one with its invite code, a copy of your profile is added to that pool's search, so the companies with access to it (the event's participating companies, or the company that owns a private pool) can find you there. They see you the same way as in the main pool — no name or contact details until you agree to an introduction.
You can set yourself to Hidden in any pool, or leave it, from your Preferences page. Leaving removes your profile from that pool's search; you can rejoin with the same code.
Some recruitment firms we work with use Kiteline to keep their own list of candidates up to date. They can only search that list — never Kiteline's candidates — so a recruiter finds out you're on Kiteline only if you link with them.
You can link your Kiteline profile with a recruiter in three ways: by registering through their invite link, by claiming a profile they prepared from a CV you gave them, or by accepting their request to link. You always agree first.
Your profile and CV, and your contact details
Updates you make — your profile is shared with them again each time it changes
Your work rights, notice period, work type, preferred locations and arrangement
The preferences we read from what you told us (for example "not in mining") — used to match you to their roles
The words you wrote in your preferences — only what we read from them
Which companies searched for you in the main pool, or your matches with them
Other recruiters you're linked with
The recruiter can keep their own notes about you (for example from a call). Those are theirs and aren't shown to you. We read them only to filter their own searches, and anything resting on age, health, family, ethnicity, religion or other protected characteristics is set aside and never used.
Unlinking. You can unlink at any time from your Account page. Updates stop straight away. The recruiter keeps the last copy they received, under their own data retention policy — they are responsible for it as a separate organisation, and you can ask them directly to delete it. Linking doesn't change who else can see you on Kiteline: to everyone else you stay anonymous, in the main pool unless you set yourself to Hidden. A recruiter can't use Kiteline to find out who else is on it, or show other recruiters your profile.
A profile prepared for you. If a recruiter prepares a profile from your CV and sends it to you, nothing is visible to companies until you claim it. If you don't claim it, it's deleted from Kiteline after 180 days; the recruiter keeps the CV you gave them.
A recruiter you're linked with may ask whether they can represent you for a specific role. You'll see the role description and what they tell you about the company, and you answer yes or no. Nothing is sent to the company because of this request unless you say yes.
A note from the recruiter on why they think you suit the role (we check it for discriminatory content before it's sent)
Your level, years of experience, main domain and core skills
Your name — only if the recruiter chooses to include it; introductions are anonymous by default
Your contact details — the recruiter organises any next step with you
Your CV, unless you and the recruiter arrange that outside Kiteline
What the company receives is a copy made at that moment; it keeps it even if you later change your profile or unlink. We keep a record of each introduction — which recruiter introduced which candidate, to which company, for which role, and when — so there's a clear trail if questions come up later. If you change your mind, tell the recruiter.
We use a small number of essential cookies to keep you logged in and maintain your session while you use the platform. These are strictly necessary for the service to function — there is no option to disable them while using an account.
We do not use advertising cookies, social media tracking pixels, or any third-party cookies that follow you across other websites. We may introduce analytics cookies in the future to understand how people use the platform. If we do, we will update this policy and provide you with the ability to opt out.
We use OpenAI's and Anthropic's APIs to extract structure from your career history, translate your preferences into matching rules, and rank candidates against job descriptions. Your CV content and preferences are transmitted to these providers solely to process these requests.
Under their API data usage policies, data submitted via the API is not used to train their models. We do not use any other AI provider for processing your personal data at this time.
We take reasonable steps to keep your data within Australian jurisdiction. Your primary data — CV files, personal details, and career history — is stored in Australia at all times.
We take the security of your personal information seriously and maintain appropriate technical and organisational safeguards to protect it from unauthorised access, disclosure, alteration, or loss. Specifically:
No system is completely immune to risk, but we are committed to maintaining security practices proportionate to the sensitivity of the data we hold, and to reviewing and improving them over time.
When your CV content and preferences are processed by OpenAI and Anthropic, this data is transmitted to servers operated by these providers, which may be located outside Australia (including the United States).
These transfers are protected by Standard Contractual Clauses (SCCs) as recognised under GDPR, and by the providers' API data usage policies which prohibit retention of input data beyond the immediate processing request. Your data is transmitted in encrypted form (TLS) and is not stored by these providers after processing is complete.
You have the following rights over your personal data. You can exercise most of these directly from your Account page, or by emailing us. We will respond to any request within 30 days.
Active profiles are retained for as long as your account exists and you remain active on the platform.
If your account has had no activity for 12 months, we will send you an email reminder before taking any action. You can either log in to reset the clock, or let your profile be deleted. If we receive no response within 30 days of that reminder, your profile and all associated data will be permanently deleted.
On deletion — whether initiated by you or through inactivity — your CV files, personal details, and career history are permanently removed within 24 hours. An anonymised record containing only your account creation date, last activity date, and deletion date is retained for platform analytics. This record contains no personally identifiable information.
In the unlikely event of a data breach that affects your personal information, we will notify the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme. If the breach is likely to result in serious harm to you, we will notify you directly as soon as practicable — and no later than 72 hours after becoming aware of the breach — with details of what happened, what data was affected, and what steps you should take.
Kiteline is a professional career-matching platform. It is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from someone under 18, we will delete it promptly.
We use the following third-party providers to operate the platform. Each processes data solely on our behalf and under our instructions:
We maintain Data Processing Agreements with each provider. If we add new providers in the future, this list will be updated.
We may update this policy from time to time. If we make material changes that affect how your data is used, we will notify you by email before the changes take effect. The "last updated" date at the top of this page always reflects the most recent version.
If you believe we have not handled your personal information properly, please contact us first — we want to make it right. If you are not satisfied with our response, you have the right to lodge a complaint with:
Office of the Australian Information Commissioner (OAIC)
www.oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
For any questions about your data, this policy, or to exercise any of your rights, contact us at: kiteline@sortya.com.au