Draft for review. This policy is a starting template and must be reviewed by a qualified privacy adviser before publication.
Who we are
Critical AI ("we", "us") provides recruitment services for cyber security and AI security roles in Australia, AI security advisory, and the Critical Hive AI interview platform. Contact us through the contact form. We don't publish an email address, so automated scrapers can't harvest it.
What we collect
- Contact details such as your name, email, phone and location.
- Career information you share: CV, skills, work history, qualifications, security clearance status, work rights and salary expectations.
- Interview information: your answers, a selfie captured at the start of the interview, transcripts, recruiter notes and interview integrity signals. We do not record or store video of the interview, and we do not collect photo ID through Critical Hive.
- Live camera checks: a small number of still frames from your camera are checked by AI during the interview (for example that a face is visible and the feed is live) and then discarded. Only the result of each check is kept.
- Invitation emails: your name and email address, used to send your interview invitation and reminders from Critical AI's email domain, or from the hiring organisation's own mail server if they connect one. If the organisation connects its applicant tracking system (such as Workday), your name, email and recruiting stage come from that system, and your interview result (score, summary and a report link, never the transcript or any video) is sent back to it.
- Skills information: your skill scores and short evidence quotes from a scored interview. If you agree when the interview ends, the organisation can keep them to consider you for other roles, and you can ask them to remove them. If the organisation turns it on, you can also choose to publish a link to a summary of your own skills; you choose what it shows and can switch it off.
- Interview booking: your name, email and the time you choose for a conversation with a person. If the organisation connects a calendar, an event for that time is added to the host's calendar. We read only whether the host is busy, and we send no candidate email address to the calendar provider.
- Business contact details for clients and Critical Hive customers.
- Website usage information collected through standard server logs.
How we use it
- To match candidates with roles, and to represent candidates to employers with their permission.
- To run and assess interviews, including with AI as described below.
- To provide the Critical Hive platform to our customers.
- To respond to enquiries and meet our legal obligations.
Use of AI and automated processing
We use computer programs, including AI, to help find candidates, run structured interviews and summarise answers against a role's skills. These programs may substantially assist decisions about whether a candidate progresses. A person reviews the results and makes every decision; we do not make solely automated decisions to reject candidates. The kinds of personal information used are the information described above that is relevant to the role. Candidates can ask for an interview with a person instead. See how we use AI.
Disclosure
We disclose candidate information to prospective employers only with the candidate's permission for a specific role. We use service providers, such as cloud hosting and AI model providers, under contracts that restrict how they use information. We don't sell personal information.
Storage and security
We protect personal information with access controls, encryption and monitoring appropriate to a security business, and keep it only as long as needed for the purposes above or as required by law. Organisations using Critical Hive set how long candidate data is kept. Candidate records, and the names and email addresses in related invitations and logs, can be deleted once that period passes, either when an administrator confirms it or automatically if they switch that on. Records can be placed on legal hold.
Overseas disclosure
Some service providers may process information outside Australia. Where this happens we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles. [List countries before publication.]
Access, correction and complaints
You can ask to access or correct your personal information, or make a complaint, through our contact form. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner.