Privacy Policy

1. Who we are

Rio Management Pty Ltd (Sydney, NSW, Australia) operates Rio Recruiting, a multi-tenant SaaS recruiting workspace. For personal information we collect about account holders and for platform operations, we are the organisation responsible for that information under the Australian Privacy Principles (Privacy Act 1988 (Cth)). For candidate, prospect, and client data you upload, your organisation is typically the controller; we process that data as a service provider to deliver the product.

2. What we collect

Depending on how you use the service, we may process:

• Account and organisation details - names, work emails, passwords or Google sign-in identifiers, organisation name, and membership roles.
• Client and project records - client company details, logos, project and role information you enter.
• Candidate and prospect profiles - contact details, notes, assessments, checklist answers, screening data, and related recruiting fields.
• Documents and uploads - CVs, applications, and other files you attach to candidates or projects.
• Personal talent profiles - every recruiting user also has a personal talent profile (career fields and resumes or cover letters you upload for yourself), separate from organisation candidate and prospect records. Talent-only accounts use the same profile model without an organisation. See the Talent Privacy Policy and Talent Terms.
• Usage and audit logs - actions in the product (for example create, update, agent runs) for security, support, and accountability.
• Billing and plan metadata - plan type and related admin records (Standard is free during early access).

3. How we use information

We use personal information to provide and improve Rio Recruiting: authenticate users, host organisation workspaces, store and display recruiting records, send transactional email (invites, notifications), run optional AI features you trigger, keep audit trails, secure the service, and communicate about the product. We do not sell candidate or client data.

4. AI features and subprocessors

Optional AI assists (for example job-ad drafts, document extract, scoring, insights, reports, and talent profile fill from a resume or cover letter via extract-talent-profile) may send relevant prompts and content you provide - which can include personal information - to third-party model providers so the feature can generate a draft output. Our current AI provider for these features is Google Gemini. Content is sent only when you (or a user in your organisation) run an AI action. Outputs are drafts for your review; see our Recruiting Terms, Talent Terms, and Talent Privacy Policy.

We also use infrastructure and service providers as needed to host, authenticate, email, and operate the platform (for example cloud hosting and Google sign-in where configured). Providers process data only to deliver those services.

5. Retention

We retain organisation and account data while your organisation uses the service and for a reasonable period afterwards as needed for backups, dispute resolution, legal obligations, and audit integrity. You (or your org admin) may delete records within the product where that function exists. Deleting the last org admin account may archive the organisation; some audit records may be retained. Ask us if you need help with a deletion request.

6. Security

We apply access controls, tenant separation by organisation, encrypted transport (HTTPS), and operational practices appropriate for an early-access SaaS product. No method of transmission or storage is completely secure; please choose strong passwords and limit access to authorised users.

7. Your rights

Under the Australian Privacy Act, individuals may request access to, or correction of, personal information we hold about them, and may complain about our handling of that information. If you are a candidate or other individual whose data was uploaded by a customer organisation, we may refer your request to that organisation as the primary controller. Contact us using the details below; we will respond in a reasonable time. You may also contact the Office of the Australian Information Commissioner (OAIC).

8. Overseas disclosure

Some subprocessors (including Google for Gemini and, where used, authentication) may process data outside Australia. By using AI features or those services, you acknowledge that relevant content may be processed in other countries subject to those providers’ safeguards and applicable law.

9. Changes

We may update this Privacy Policy as the product matures. The “Last updated” date at the top will change when we do. Material changes will be communicated to org admins where practical.

10. Contact

Privacy questions or requests: sabrina@riomanagement.com.au. Rio Management Pty Ltd · Sydney, NSW · Australia.