Privacy policy

Merit is operated by [COMPANY LEGAL NAME] (ABN [ABN]) ("Merit", "we", "us"). Merit is a marketplace where customers book one-on-one career consultations with recruiters and industry professionals. This policy explains what personal information we collect, why, who can see it, how long we keep it, and the choices you have. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

• Account details: your name, email address and role (customer or consultant). Passwords are stored only as one-way cryptographic hashes; we cannot read them.
• Your resume: the PDF you upload so a consultant can prepare for your session. Resumes are sensitive career information and get the strictest handling we have (see below).
• Booking details: who you booked, when, any notes you add, and the session's outcome (completed, cancelled, refunded).
• Payment records: payments are processed by Stripe. We record the amount, currency and payment status, and a Stripe reference. We never see or store your card number.
• Technical logs: standard request logs (including IP addresses) kept for security, rate limiting and abuse prevention.
• Usage and analytics: how Merit gets used (the pages you open, the things you click, and errors the app runs into), collected through PostHog, our analytics provider. Once you are logged in this is linked to your account, including your email address, so we can follow up on problems you hit. It also includes session recordings: a replay of your visit, reconstructed in the browser, which we use to find broken and confusing steps. What you type into a form, including the notes you write for your consultant, is masked on your device and never reaches the recording. Other on-screen content is not masked, so assume anything else visible while you use Merit may appear in one.

Your resume is private by default. It is visible only to: (a) you; (b) a consultant you have booked, for the purpose of preparing for and running your consultation; and (c) Merit staff where strictly needed for support or troubleshooting. Consultants cannot browse resumes; access exists only through a booking, and links to the file are time-limited. We never sell or share your resume with anyone else.

• You can delete your saved resume at any time from your profile. The file is removed from storage immediately (deletion is blocked only while an upcoming booking still needs it).
• When you replace your resume with a new upload, the old file is deleted immediately unless an upcoming booking still references it.
• Resumes that are no longer your saved resume are automatically deleted 30 days after upload.
• If your account is changed to a consultant account, your saved resumes are deleted immediately; consultants do not have resumes on Merit.
• Every resume is automatically deleted at most 365 days after upload, even if it is still your saved resume; you can simply upload a fresh copy when you next book.
• Deleting your account deletes all your resume files immediately.
• Booking and payment records are retained as financial records after cancellation or account deletion, as Australian law requires.
• Analytics events and session recordings are held by our analytics provider and deleted automatically after a set period; recordings are kept for a much shorter time than events.

You can delete your account at any time from your profile. We delete your resumes, your login credentials, any notes you added to bookings and, for consultants, your profile text, and we anonymize your account: your name and email are removed from our records and your access ends immediately. Booking and payment history is retained in de-identified form ("Deleted user") because it is part of other people's financial records. Account deletion is blocked while you have upcoming bookings (cancel them first) or, for consultants, while a payout is still on its way to you.

Merit uses one strictly necessary cookie: an httpOnly session-refresh cookie that keeps you logged in. It is not readable by page scripts.

PostHog, our analytics provider, sets an additional cookie and stores data in your browser's local storage. It recognises your browser between visits so that repeat visits are not counted as new people, and so a session recording can be tied to the rest of your activity.

We also load the Google tag (gtag.js) for Google Ads conversion measurement. It sets cookies that let Google tell us whether a visit that started from one of our ads led to a signup or booking. We use it only to measure our own advertising; we do not send your name, email address or resume to Google, and we do not use it for remarketing or to build advertising profiles.

We disclose personal information only to service providers that make Merit work: Stripe (payment processing and consultant payouts), our email delivery provider (booking confirmations, reminders and other service emails; see below), PostHog (product analytics, session recordings and error reporting, which receives your account ID, role and email address), Google (advertising conversion measurement via its cookie, as described above, never your account details), and our hosting and storage providers. Some of these providers process data outside Australia; PostHog, for example, processes on servers in the United States; where they do, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. We do not sell personal information.

We use your email address to run the service: account emails (verification, password reset), booking emails (confirmations, reminders shortly before a session, payment and dispute outcomes) and a small number of follow-ups: a reminder to upload your resume before an upcoming session, a one-time nudge if you created an account but never booked, and an invitation to book again after a completed session. If you would rather not receive the follow-ups, contact us at [CONTACT EMAIL] and we will turn them off for your account. We do not send third-party marketing.

You can access and correct your account details on your profile page, and delete your resume or your whole account there too. For anything you cannot do yourself, including a copy of the personal information we hold about you, contact us at [CONTACT EMAIL] and we will respond within a reasonable period. If you believe we have mishandled your personal information, please contact us first; you can also complain to the Office of the Australian Information Commissioner (oaic.gov.au).

We will update this page when our practices change and revise the "Last updated" date above. Material changes will be flagged to you by email or in the product.

[COMPANY LEGAL NAME] (ABN [ABN]), [CONTACT EMAIL].