Privacy Policy

This Privacy Policy applies to Yarashi, operated by The Agile Foundry (trading as Yarashi) ("we", "us", "our"), accessible at yarashi.com.au. Privacy enquiries: privacy@yarashi.com.au Support: support@yarashi.com.au We are the data controller for personal information collected through Yarashi. This policy explains how we collect, use, store, share and protect your personal information, and your rights in relation to it.

We collect only the information necessary to deliver our service (data minimisation). We collect:

For users in the EEA or UK, we process your personal data under the following lawful bases:

For Australian users, the equivalent basis is our obligations under the Australian Privacy Principles and our contract with you. Where we rely on legitimate interests, we have assessed that our interests do not override your fundamental rights and freedoms.

Yarashi uses Anthropic's Claude AI models to deliver its core features. This is central to the service you have signed up for.

Data sent to Anthropic: When you use an AI feature, relevant portions of your CV and the job description are transmitted to Anthropic's API in the United States. Anthropic acts as a data processor on our behalf. We have assessed Anthropic's data handling practices and they meet the standards required under both Australian Privacy Principles and GDPR Standard Contractual Clauses. Anthropic's Privacy Policy: anthropic.com/privacy From 10 December 2026 (Australian Privacy and Other Legislation Amendment Act 2024 — APPs 1.7–1.9): We will provide enhanced automated decision-making disclosures. We are actively preparing for this now.

We do not sell your personal information. We do not share it with advertisers. We share it only with the following service providers who process it on our behalf:

All providers are bound by data processing agreements requiring them to process your information only for the purposes we specify, in accordance with applicable law. We may also disclose your information where required by law, court order, or to protect the rights, property or safety of Yarashi, our users, or others.

You have the following rights in relation to your personal information. EEA/UK users have these rights under GDPR. Australian users have equivalent rights under the Privacy Act 1988.

We will respond to all rights requests within 30 days. We may need to verify your identity before acting on a request. We will not charge for routine requests.

Security measures we implement: • All data transmitted over HTTPS/TLS encryption • Passwords hashed using bcrypt — never stored in plain text • Row-level security (RLS) in our database — each user accesses only their own data • Session tokens expire automatically • CV text stored in your browser locally unless you explicitly save it to your profile • Regular security reviews Data retention: We retain your personal data for as long as your account is active. Upon account deletion, personal data is deleted within 30 days, except where longer retention is required by law (e.g. financial records for taxation purposes — up to 7 years). Data breaches: We will notify you and the relevant authority (OAIC in Australia, relevant national DPA in the EU/UK) within 72 hours of becoming aware of a breach likely to result in a high risk to your rights and freedoms, as required by the NDB scheme and GDPR Art. 33–34.

Yarashi uses browser localStorage (not tracking cookies) to store your session, CV text and search preferences locally on your device. This data does not leave your device unless you explicitly save it to your account. We do not use: • Advertising or marketing cookies • Cross-site tracking pixels • Third-party behavioural analytics • Google Analytics or similar tracking tools The only cookie we set is a secure, HttpOnly session authentication cookie required for you to stay logged in. This cookie is strictly necessary for the service to function and does not require separate consent under GDPR or the Australian Privacy Act.

Our service providers are primarily located in the United States. By using Yarashi, you acknowledge that your personal data may be transferred to and processed in the United States and other countries outside your country of residence. For EEA/UK users: We ensure such transfers comply with GDPR Chapter V through Standard Contractual Clauses (SCCs) approved by the European Commission, supplementary technical measures, and assessment of the legal frameworks in destination countries. For Australian users: We take reasonable steps under APP 8 to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

Yarashi is not directed to persons under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact privacy@yarashi.com.au and we will delete it promptly.

We may update this Privacy Policy to reflect changes in our practices, technology or applicable law. We will notify you of material changes by email and by displaying a notice on the platform at least 14 days before the change takes effect. Continued use of Yarashi after that date constitutes acceptance of the updated policy. The version history of this policy is available upon request.

Privacy Officer The Agile Foundry (trading as Yarashi) Email: privacy@yarashi.com.au Website: yarashi.com.au If you are not satisfied with our response to a privacy complaint, you may contact: Australia — Office of the Australian Information Commissioner (OAIC) oaic.gov.au · 1300 363 992 · GPO Box 5218, Sydney NSW 2001 European Union — Your national Data Protection Authority edpb.europa.eu/about-edpb/board/members_en United Kingdom — Information Commissioner's Office (ICO) ico.org.uk · 0303 123 1113