Privacy policy

What we collect

• Account details — name, email, password (stored hashed), country, time zone and language. If you sign in with Google, we receive your Google account name and email.
• Career information — your CV (the file and the text we extract from it), work history, qualifications, licences and registrations, skills-assessment and English-test results, job preferences and auto-apply rules (such as locations, minimum salary, work mode and whether you need sponsorship), and portfolio items you add.
• AI interviews — your answers as text. If you choose voice, your speech is turned into text as you talk; we keep the transcript, not a recording of your voice. We also keep the scores and evidence produced from your answers. We compare key claims you make in an interview (for example a role, an employer, how long you worked there or a licence) with your CV, checks and references, using the words of your answers only. A difference is shown to you and to employers as something to verify, you can explain it in your own words, and it never changes your interview score.
• Employer video interviews — if every participant agrees when they join, the call is recorded and transcribed so AI can draft interview notes for the employer. If anyone declines, nothing is recorded.
• Identity and work rights — the result of an identity check by our verification provider (Didit), your name as it appears on your ID, the ID’s expiry date, its issuing country and your birth year (both restricted, see below), and, for onshore visa holders, VEVO work-rights confirmation. We do not store ID images or document numbers (only a one-way salted code that stops duplicate accounts). If you add a profile photo, we keep that photo.
• Checks and references — results of checks you agree to against official registers and assessing authorities, and the contact details of referees you give us. We only contact a referee at an official address at their employer’s own domain.
• Visa journey — if you work with a migration agent through GoingAbroad, the case status and the profile fields you choose to share. For documents your agent uploads, we keep only the document type, dates and shortened reference numbers, not the file.
• Employers and agents — business details (including ABN), team members, jobs, hiring decisions, and for migration agents their MARN or practitioner number.
• Messages and requests — messages in the app, support requests and reports you send us.
• Usage and security data — sign-in events, device and browser information, audit logs, and error reports (with personal details removed).

We do not ask for, and do not use in matching or scoring, protected attributes such as race, religion, sex, age, disability, marital status or pregnancy. The issuing country and birth year from identity checks are restricted: we use them only to prevent fraud, to match names, and to show the English-test, police-check and skills-assessment steps that apply to your passport — never in matching, ranking, interview scoring or anything an employer sees.

Sensitive information

Some information is “sensitive information” under the Privacy Act. We collect it only with your consent and only where it is needed:

• Biometric information (face match) — the identity check compares a short live selfie video with the photo on your ID, and later checks that the same person is present at the start of your AI interviews and that your profile photo matches your ID. We ask for a separate identity consent before the check starts. Didit holds the images and the face data for these checks under its own retention settings; we do not hold them. If you can’t do a selfie check (for example because of a disability or your device), you can use a document-only route with text-only interviews.
• Health information — we don’t ask about your health. You may choose to tell us about a disability when asking for the document-only route or an adjustment, and visa documents handled by your migration agent may include a health examination; we record only the document type and dates of those.
• Registrations and memberships — professional registrations (for example with AHPRA) and memberships of professional bodies that you add to your profile or ask us to verify.

You can withdraw a consent at any time by contacting us. Withdrawing the identity consent stops new identity checks. We need a verified ID before we can put you forward to employers.

How we use it

• To vet your profile (CV screening and an AI interview), suggest the occupations you fit, recommend matching jobs, and apply for you automatically when you meet a job’s requirements and your rules. You can cancel any application within 24 hours, before the employer sees it.
• To show employers the candidates who were submitted to their jobs, with evidence, so a person at the employer can decide.
• To verify claims against official registers you consent to (never open-web or social-media searches about you).
• To run the hiring and visa-journey timeline, send notifications, bill employers and agents, prevent fraud and keep the service secure.

Automated decisions

We use computer programs, including AI models and fixed rules, to make some decisions about candidates and to help employers make others. From 10 December 2026 the Privacy Act requires us to describe these decisions here. Read the AI notice for more about what the AI does and doesn’t do.

Information these programs use: your CV and profile (work history, qualifications, licences, registrations, skills), your interview answers and transcripts, your job preferences and auto-apply rules (location, salary, work mode, sponsorship need), work-rights and verification results, and identity-check results. Before profile and CV information is sent to an AI model for matching or CV review, we remove your name, email and phone number. The identity check uses biometric information (see Sensitive information). These programs never use protected attributes, nationality or whether you pay for Prep.

Decisions made by computer programs alone (no person at GoingAbroad looks at them first unless you ask for a review):

• CV screening — whether your profile moves on to the AI interview or gets “add this” tasks first. It never rejects you, and it re-checks automatically when you update your profile.
• Interview scoring and vetting — an AI model scores your interview answers against a fixed competency rubric, and rules then decide whether you are vetted or get feedback, practice and a retake. Being vetted is what lets us put you forward to employers. Vetting expires after 12 months, and auto-apply pauses after 90 days of inactivity.
• Auto-apply — which jobs we apply to for you and which we skip (for example rules not met, a must-have requirement not met, a weekly or per-job cap, or work rights not confirmed), and, when a job has more matching candidates than its cap, which applications are submitted first (by match score). Skipped jobs show the reason in the app.
• Identity checks — whether your ID check, the presence check at the start of an interview and the profile-photo match pass. Repeated failed presence checks switch interviews to text mode and can pause your account for a check; an ID already verified on another account is blocked.
• Register checks — the result of an automated check of a claim against an official register or assessing authority.

Decisions where a computer program helps a person decide:

• Hiring decisions are made by employers. People at the employer decide who to shortlist, interview, reject or make an offer to. To help them, we show an AI match score and evidence for each requirement, the AI interview report and scores, and claims to verify, and they can sort candidates by match score. An employer can agree with or override a match assessment, with a reason.
• Suggested occupations — we suggest the occupations you fit; you confirm them, pick another suggestion, or contest them.
• Employer interview notes — AI drafts notes from a recorded employer interview (only with everyone’s consent) for the interviewers to review.

Automated flags. Small programs we run on our own servers flag possible prompt injection in CVs and interview answers, possible duplicate CVs, and the topic and urgency of support messages. A flag never changes your score, ranking or vetting result; a duplicate-CV flag is looked at by a person.

Ask a person to review a decision

• Sign in and choose Request a review on your vetting result, a verification check, your suggested occupation, a profile-photo or presence check, or a job we skipped for you. A person on our team reviews the evidence. You can follow progress, add information and see the outcome in My requests. We aim to finish within 10 business days.
• For any other automated decision, use the contact form and choose “Request a review of an AI result”, or email hello@goingabroad.com.au. It is handled the same way.

Asking for a review never counts against you.

Who we share it with

• Employers — only after you are vetted and an application is submitted (after your 24-hour cancel window), or if you choose to be searchable: your vetted profile, match evidence and interview report. Never whether you pay for Prep, your ID details, nationality or birth year.
• A migration agent you choose — only the fields you agree to share.
• Referees you name — enough to ask them to confirm your work history.
• Service providers who process data for us (listed below).
• Regulators or law enforcement where the law requires it.

We never sell personal information.

Service providers and overseas disclosure

We host the platform and its database and file storage in Australia (Sydney). These providers receive personal information to provide parts of the service:

• Anthropic (Claude AI models) — United States. CV reading and review, interview questions, live interviewer turns, interview scoring, matching, occupation fit, register checks and other AI features. Some requests reach Claude through OpenRouter (United States), which we configure to route only to Anthropic and to exclude providers that collect data. No prompt content is stored in our AI logs.
• Didit — identity document, liveness and face-match checks (country to be confirmed).
• Deepgram (speech-to-text, United States) and Fish Audio or Cartesia (the interviewer’s voice; Cartesia is in the United States, Fish Audio’s location to be confirmed) — voice interviews only. Your audio is streamed for transcription and not recorded by us.
• Daily.co — employer video interviews and, with consent, their recordings and transcripts (United States). Recordings are deleted once notes are made, or after the employer’s chosen period of up to 90 days.
• Stripe — payments and invoices (United States).
• Email delivery (Amazon SES; region to be confirmed) and Google sign-in if you use it (United States).
• Cloudflare (network security, global) and Sentry (error reports with personal details removed; United States).

The likely overseas countries are the United States and, for some providers, other countries we are still confirming. We send each provider only what its feature needs.

When you create a candidate account we ask for your separate, express consent to send your information to these overseas providers, because GoingAbroad can’t vet you, interview you or apply for you without them. As that consent explains, if you give it, Australian Privacy Principle 8.1 does not apply to those disclosures: we will not have to make sure the overseas recipients handle your information in line with the Australian Privacy Principles, and you may not be able to seek redress under the Privacy Act if they mishandle it. If you don’t want this, you can close your account at any time.

Security

Data is encrypted in transit, access is role-based and audited, and employer interview transcripts are encrypted at rest. If an eligible data breach occurs we notify you and the OAIC under the Notifiable Data Breaches scheme.

How long we keep it

• Your account and profile — while your account is open. After an account is closed there is a 30-day grace period; then your documents (and the text, AI reviews and search data derived from them) are deleted and your account is anonymised. Extracted CV text of a closed account is removed straight away.
• Documents you delete — removed from storage after 30 days. Only your three most recent CV reviews are kept.
• Identity check — kept while your account is open. When it is closed, your ID name, birth year and expiry date are removed after the grace period; the one-way duplicate-account code is kept for 2 years to prevent fraud.
• Interview media — any stored interview audio is deleted after 12 months and video after 90 days. AI voice interviews are not recorded.
• AI interview transcripts and assessments — kept while your account is open. When it is closed, the transcript, any claims taken from it and the written assessment (scores with quoted evidence, summary and feedback) are deleted after the 30-day grace period.
• Copies of your data you ask for — the download link works for 72 hours, then the file is deleted.
• Verification results — deleted 30 days after they expire.
• Records we must keep — invoices, payments, placements, signed offers, consent records, privacy requests and audit logs are kept for legal and financial reasons (audit logs for 7 years).

Your choices and rights

• Access or correct most of your information from your profile, or ask us for a copy of the information we hold about you.
• Ask us to correct information you can’t change yourself, such as your name once it is locked to your verified ID.
• Tell us you’re no longer looking at any time, which stops new applications.
• Close your account. For candidates this takes effect straight away (we stop applying, withdraw open applications, cancel any subscription and end any Prep pass or unused add-on); employer and agent accounts are closed by our team.
• See the consents you have given and turn marketing email on or off. Consents GoingAbroad needs to work (terms, privacy, AI processing and overseas handling) are withdrawn by closing your account. Vetting and auto-apply can’t run without AI; where a step has another route you can choose it instead (for example a text interview instead of voice, which avoids speech-to-text).

Signed in, you can do all of this from Privacy & data in your account menu: download a copy of your data (we email you a link), ask for a correction, manage consents or close your account. You can also use the contact form and choose “Privacy request”, or email hello@goingabroad.com.au. We may need to confirm your identity first. We respond within 30 days and, if we refuse a request, we tell you why and how to complain.

Questions and complaints

Email hello@goingabroad.com.au or use our contact form. Please make a complaint to us in writing first; we aim to respond within 30 days. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.