This Privacy Policy explains how Wavely Pty Ltd (“we”, “us”, “our”, “Jarli”) collects, holds, uses, discloses and protects your personal information when you use the Jarli app and website (together, the “Service”). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we handle your personal information in accordance with them. Please read this policy together with our Terms of Service.
Wavely Pty Ltd is an Australian registered company and the entity responsible for the Service. For any privacy question, request or complaint, contact our Privacy Officer at privacy@jarli.au (or hello@jarli.au). Our contact details are in section 20.
This policy applies to personal information we handle about users of the Service, visitors to our website, and people who contact us. It does not apply to third-party services we link to, which have their own privacy policies.
Under APP 2, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us — except where it is impracticable for us to deal with you that way, or the law requires or authorises us to deal with identified individuals. You can browse our public website and begin an onboarding conversation with Jarli as a guest without creating an account. To save a plan or sync across devices, you will need an account, which requires an email address and a sign-in identifier.
The kinds of personal information we collect depend on how you use the Service. They include:
| Category | Examples |
|---|---|
| Account & identity | Your email address and a unique sign-in identifier
(oid) issued by Microsoft Entra External ID, our identity
provider; a display name or greeting name you choose. |
| Career profile | Your work situation, employment history, skills, goals, timeframe, visa/right-to-work context you volunteer, and preferences — whatever you choose to share while building your profile with Jarli. |
| Sensitive information (wellbeing-adjacent) | Because Jarli supports people through career change — including stressful situations such as redundancy — your conversations may reveal information about your emotional state, wellbeing, financial pressure, or health. Under the Privacy Act some of this may be “sensitive information”. We collect it only with your consent (see section 5) and only to respond to you supportively and appropriately. We do not ask for, and ask that you do not share, information such as your racial or ethnic origin, political or religious beliefs, sexual orientation, or criminal record, as Jarli does not need it. |
| Conversation content | The messages you exchange with Jarli, and the profile, plans, milestones and weekly activities generated for and with you. |
| Notes Jarli keeps | Short notes Jarli takes from your conversations (for example your situation, how you like to work, or something in the way) so it does not have to start from scratch each time you talk. They are linked to your account. You can ask us to show you them or to delete any of them (section 14). |
| Resumes & documents | A resume you paste in or upload (as a Word or PDF file; we keep the original file so you can download it again), and the documents Jarli drafts with you, such as a resume tailored to a role or a cover letter, including earlier versions of them. |
| Job search | If you use Jarli for a job search: the job ads you share, as text or as screenshots (a screenshot is read to get the ad's text and is not kept), the roles you are applying for (role, employer, where each one is up to, and interview dates), your answers in practice interviews and the feedback on them, and notes from conversations after an interview. Jarli may add a role to this list, or update where it is up to, from what you tell it in conversation; it shows these as its guess until you confirm or correct them. |
| Starting a new job | If you tell Jarli you have got a job: the role, the employer and your start date, and anything you share about conversations you are preparing for at work. |
| Reminders | If you turn on reminders in the web app, a push-notification address for your browser, so we can send them. |
| Technical, diagnostic & usage | App and website error diagnostics and product-analytics information — device and operating-system type, app version, approximate region, which screens and pages you visit and how you use the Service, and basic technical logs — used to keep the Service reliable and secure and to understand and improve how it is used. This is configured to avoid capturing your message content; where you are signed in it is linked to an internal account identifier only, not your name or email. We also record how you arrived at the Service — the referring website and, where present, marketing-campaign or ad-click identifiers passed in the link you followed (for example UTM tags, or a Google or Meta click ID) — so we can understand which channels bring people to Jarli and whether our advertising is effective. |
| Correspondence | Information you provide when you contact us for support or make a request or complaint. |
We use product analytics to understand how the Service is used and how people find it (see sections 8 and 15). We do not embed third-party advertising trackers or pixels, we do not sell your personal information, and we do not use your conversations to train third-party AI models for their own general-purpose use (see section 8).
Information about other people. A resume may list referees, and a conversation you are preparing for will involve someone else. Please include only what Jarli needs to help you, such as a manager's role rather than their name, and leave out referees' contact details unless you want them in a document you are drafting.
We collect personal information (APP 3 and APP 5):
Where it is reasonable and practicable, we collect personal information directly from you. If we receive personal information we did not solicit, we will deal with it as required by the APPs.
We collect and use your personal information to:
Consent for sensitive information. We collect sensitive information only where you consent and it is reasonably necessary for the supportive purpose above. You do not have to share this kind of information to use Jarli. When you choose to share it in your conversations, you consent to us collecting it and handling it for these purposes. You can withdraw your consent at any time by deleting your account (section 13) or contacting us; withdrawing consent does not affect handling that has already occurred.
Jarli is an AI-assisted service. To provide it, we use artificial-intelligence models to process your personal information and to make or substantially support decisions, without a human reviewing each one. This section sets out the information about those decisions that the Privacy Act requires (Australian Privacy Principles 1.7 to 1.9).
Your career profile, conversation content, wellbeing-adjacent information you share, your stated goals and constraints, your responses to and progress through activities, the notes Jarli keeps, and, if you use them, your resume, the job ads you share, the roles you are applying for and your answers in practice interviews.
These decisions are guidance and support only. They are general in nature, are not legal, financial, medical, employment or migration decisions, and do not by themselves determine your legal rights or entitlements. AI output can be inaccurate, incomplete or out of date, so you should use your own judgement (see our Terms). If you would like a person at Wavely to review how Jarli has handled your information or a plan it produced, contact privacy@jarli.au and a member of our team will help. Jarli does not apply for jobs or contact employers for you, and nothing it produces is sent to anyone unless you send it yourself.
No one at Wavely reads along while you talk to Jarli. A small number of authorised people at Wavely can view your conversations, your profile and the other information Jarli holds about you, such as your plan, your activities and any resume you have saved, and only:
If we find that Jarli got something wrong for you, we may contact you about it. We do not look at your conversations for any other reason, and never to market to you.
We may send you service-related messages (for example account, security or important change notices), which are not marketing and which you cannot opt out of while you hold an account. We will only send you marketing or promotional messages where you have consented or where the law otherwise permits, and every such message will include a simple way to opt out (APP 7). You can also opt out at any time by contacting us. We do not disclose your personal information to third parties for their own direct-marketing purposes.
We disclose personal information only to service providers that help us run Jarli, under contractual obligations to protect it and use it only for the purposes we specify. Our key providers (sub-processors) are:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic (Claude) | Our primary AI provider. The models that power Jarli’s conversations, plans and activities. Your conversation content is processed to generate responses. Under our terms with Anthropic, your content is not used to train their models for general use. | Overseas (United States) |
| OpenAI | Used in two ways. (1) Fallback AI provider: if our primary provider is temporarily unavailable, we automatically route your request to OpenAI so you still get a reply, and the same conversation content is processed to generate the response. (2) Search and matching: during normal use we send short phrases derived from your plan — such as your target role and the kind of learning resource you need — to OpenAI to turn them into a numerical representation, so we can find relevant career information and resources. This happens routinely, not only during an outage; it does not send your conversation content. Under our terms with OpenAI, your content is not used to train their models. | Overseas (United States) |
| Microsoft Azure | Cloud hosting, database and sign-in (Microsoft Entra External ID). | Australia (Australia East) |
| New Relic | Error, crash and performance diagnostics for our apps, website and servers: the type and message of an error and where in our code it occurred, crash reports, app, browser and device details (such as app version, operating system, device model and browser type), a random identifier for each installation of the app, approximate location derived from your IP address, the addresses, response codes and timings of requests, and a limited set of technical log entries. Configured to avoid capturing your message content, career information or documents, and session replay (screen recording) is not enabled; where you are signed in, linked to an internal account identifier only, not your name or email. | Overseas (United States) |
| PostHog | Product analytics — how the Service is used (for example screens and pages visited, device type and approximate region) to help us understand and improve it. Configured to avoid message content; usage is linked only to an internal account identifier, not your name or email. | Overseas (European Union) |
| Browser push services | Only if you turn on reminders in the web app: the push service run by your browser's maker (for example Google, Apple or Mozilla) delivers them. The reminder's content is encrypted so the push service cannot read it. | Depends on your browser; may be overseas (for example the United States) |
| Resend | Delivers the messages you send us through the contact form on our website to our inbox. | Overseas (United States) |
| Cloudflare (Turnstile) | When switched on, checks that a website form is being filled in by a person, not an automated program. It processes technical information such as your IP address and browser details. | Global network; may be overseas |
We may also disclose personal information: where you have consented; where required or authorised by law, a court/tribunal, or a regulator; to protect the safety of you or others; or in connection with a sale, merger or restructure of our business, in which case the recipient will be bound to handle it consistently with this policy. We keep the list of providers in this policy current and, where appropriate, will take reasonable steps to notify you of a material change to the providers who handle your personal information. This list may change as our Service evolves.
Some of our providers process personal information outside Australia — our AI providers (Anthropic, and OpenAI both as a fallback and for the search and matching described in section 8) in the United States, our diagnostics provider (New Relic) in the United States, our product-analytics provider (PostHog) in the European Union, our website email and form-checking providers (Resend in the United States, and Cloudflare), and, if you turn on reminders, your browser's push service. By using Jarli you acknowledge that your information — including conversation content, the resumes, job ads and screenshots you share, and, where relevant, sensitive information — may be disclosed to and processed by these providers overseas. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, including through contractual data-protection commitments. Where we rely on your consent for an overseas disclosure, APP 8.1 accountability may not apply to that disclosure.
We do not use government-related identifiers (such as a tax file number, Medicare number, or driver-licence number) as our own identifier of you, and we do not ask you to provide them. Any such number you happen to mention in conversation is treated as ordinary content and is not used to identify you.
We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date, complete and relevant (APP 10). Much of your profile is information you provide and can update yourself in the app. When your situation changes, Jarli shows you what it wants to change in your profile and makes the change only once you confirm it, and you can correct the roles on your job-search list yourself. The notes Jarli keeps from your conversations are not currently shown in the app; you can ask us for them, or to correct or delete any of them, at any time (section 14). If you believe information we hold is inaccurate, please tell us.
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11), including: encryption in transit (HTTPS); secure credential storage on your device; verified authentication; access controls and least-privilege on our systems; and hosting with a reputable cloud provider in Australia. No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards.
Notifiable Data Breaches. We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we experience a data breach that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable after we become aware of it, as required by law, and take steps to contain and remediate the breach.
We keep your personal information only for as long as we need it for the purposes described in this policy, or as required by law, after which we destroy or de-identify it. In general, we retain your account and profile information while your account is active, and for a limited period afterwards to handle any wind-down, dispute or legal-hold requirements; we keep diagnostic logs for a short period only.
You can delete your account at any time in the app (Profile → Delete account), by emailing hello@jarli.au, or — without installing the app — via our account-deletion page. When you delete your account we delete your account and sign-in identifiers, your email address, your career profile, plans and weekly activities, your resumes and the documents drafted with you, your job-search list and reminders, the feedback from your practice interviews, and the notes Jarli keeps, and we erase the text of your conversations with Jarli. We action deletion requests promptly and within 30 days.
After deletion we keep only:
We keep these to maintain, secure and improve the Service, and we do not try to re-identify anyone from them.
You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 12 and APP 13). Much of your information is available to you directly in the app, including your plan, your resume and the documents drafted with you, and your job-search list. The notes Jarli keeps from your conversations are not currently shown in the app, so ask us for them. To make a request, contact privacy@jarli.au. We will respond within a reasonable time (generally within 30 days). We may need to verify your identity first. Access is usually free; if a request is complex we may charge a reasonable cost-based fee and will tell you before proceeding. If we refuse access or correction, we will explain why and how you can complain.
Our website and app use a small number of cookies and similar technologies that are necessary to keep you signed in, remember your preferences, and keep the Service secure and working. We use product analytics (PostHog) to understand how the Service is used — such as which screens and pages are visited, device type and approximate region — so we can improve it. This is configured to avoid capturing your message content; where you are signed in, usage is linked to an internal account identifier only, not your name or email. We also record how you arrived — the referring site and any marketing-campaign or ad-click identifiers in the link you followed — to measure the effectiveness of our own marketing. We do not embed third-party advertising or cross-site tracking pixels, and we do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, though some features may not work without the necessary ones. Because we do not track you across other websites, our website does not currently respond to browser “Do Not Track” or Global Privacy Control signals.
Jarli is intended for adults. It is not directed at, and is not intended for, people under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us and we will take reasonable steps to delete it.
Jarli may point you to third-party websites, resources and learning materials that we do not control. This policy does not cover those third parties; their handling of your information is governed by their own privacy policies, which we encourage you to review.
If you have a concern about how we have handled your personal information, please contact our Privacy Officer at privacy@jarli.au. We will acknowledge your complaint, investigate it, and aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or in writing to GPO Box 5218, Sydney NSW 2001.
We may update this policy from time to time to reflect changes to the Service, our practices, or the law. We will post the updated version here and change the “Last updated” date above, and where the changes are significant we will tell you, by email or in the app, before they take effect. A change will not let us use information we already hold about you for a purpose unrelated to the one we collected it for, unless you agree or the law allows it.
Privacy Officer, Wavely Pty Ltd (ABN 45 626 415 914)
Email: privacy@jarli.au /
hello@jarli.au