Privacy Policy

Last updated: 21 August 2026 Effective date: 21 August 2026

1. Introduction

Mibboo is a product of AOGEN PTY LTD (ABN 33 686 852 871, ACN 686 852 871), an Australian private company with its principal place of business at 115 Pitt Street, Sydney NSW 2000, Australia.

In this policy, “Mibboo”, “we”, “us” and “our” refer to AOGEN PTY LTD.

This Privacy Policy explains how we handle personal information when you use the Mibboo platform and websites (the “Service”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”), and — where applicable — other privacy laws relevant to the people whose information we handle.

If you have any questions, contact us at info@mibboo.com.

2. Two different roles — please read this first

Mibboo handles personal information in two distinct roles, and your rights differ depending on which applies.

2.1 Where we are the controller

For information about account holders — the employers, recruiters and team members who sign up for and use Mibboo — we decide how and why that information is used. We are the controller (or, under Australian law, the APP entity responsible for it).

This includes your name, email address, organisation details, login records, usage data and billing information.

2.2 Where we are the processor

For information about candidates who complete an application form published through Mibboo, the employer who published the form decides how and why that information is collected and used. That employer is the controller. We process candidate information on their behalf and on their instructions.

If you are a candidate, this means the employer you applied to is primarily responsible for your information. You should contact them first about access, correction or deletion. We will assist them in responding to you, and section 11 explains how to reach us directly.

2.3 Where we are a separate controller for the optional talent pool

A candidate may separately choose to let Mibboo retain their application in Mibboo’s private talent pool if the employer’s Mibboo workspace closes. For this limited purpose, Mibboo decides why and how the retained information is used and acts as a separate controller (or the APP entity responsible for it).

This choice is optional, off by default and is not required to submit an application. Talent-pool information is not made available as a searchable pool to employers. We may use it only to identify and contact the candidate about a potentially suitable future opportunity. A candidate can withdraw this choice at any time by contacting info@mibboo.com.

3. Information we collect

3.1 Account holders

We do not currently collect payment information. If paid plans are introduced, payment details will be handled by a third-party payment processor and we will not store full card numbers.

3.2 Candidates

The specific information collected from a candidate is determined by the form the employer publishes. It typically includes:

• name, email address and phone number;
• location and time zone;
• answers to role-specific questions;
• a curriculum vitae or other uploaded document;
• salary expectation and currency;
• consent choices;
• technical information such as IP address (stored in hashed form) and submission timestamp.

We do not collect candidate photographs. Our form generation does not produce fields requesting a photo or profile picture.

Some forms may include optional demographic questions where an employer is required to collect them for equal-opportunity or bias-audit purposes. Where present, these questions are always optional and the responses are excluded from all AI evaluation and scoring by design.

3.3 Information we do not seek

We do not intentionally collect sensitive information such as health information, criminal record, religious or philosophical beliefs, political opinions, or trade union membership. Employers are contractually prohibited from using the Service to collect information unlawfully.

4. How we use information

4.1 Account holders

• to create, secure and administer your account and Organisation;
• to provide the features of the Service;
• to meter usage against plan limits;
• to send service, security and transactional communications;
• to provide support;
• to detect, investigate and prevent fraud, abuse and security incidents;
• to analyse and improve the Service;
• to comply with legal obligations.

4.2 Candidates

We process candidate information solely to provide the Service to the employer, which includes:

• receiving, validating and storing the application;
• extracting structured information from a CV (skills, roles, dates, education);
• generating AI-assisted evaluation and ranking to support the employer’s human review;
• sending the candidate an application confirmation and any status updates the employer sends;
• deleting the information at the end of the employer’s configured retention period.

Where a candidate separately opts into Mibboo’s private talent pool and the employer’s workspace closes, we may also retain and review that candidate’s application to identify a potentially suitable future opportunity. We do not use a talent-pool choice to score the application and do not tell the employer whether the candidate selected it.

5. Artificial intelligence and candidate evaluation

We want to be specific about this because it matters.

5.1 What the AI does

The Service uses large language models to (a) generate application forms from a job advertisement, and (b) analyse application answers and CV content to produce attribute scores and a written rationale.

5.2 Identifying details are removed before AI processing

Before any candidate content is sent to an AI model, we apply a redaction step that removes direct identifiers, including name, email address, phone number, physical address, date of birth and nationality. The model receives experience, skills, education and answer content — not the candidate’s identity.

Any optional demographic responses are never included.

5.3 Providers are restricted

AI processing is routed only to a defined allowlist of inference providers that support zero-data-retention operation and that we have instructed not to retain or train on submitted content. Automatic failover outside that allowlist is disabled: if no permitted provider is available, the request fails rather than being sent elsewhere.

Our current AI providers are listed in section 8.

5.4 Human decision-making

AI output is decision-support information. Employers using the Service are contractually required to apply human review and are prohibited from making an adverse hiring decision solely on the basis of automated processing.

Each score is stored together with the model used, the prompt version and a written rationale, so that an employer can review how a result was produced.

6. Disclosure of information

We disclose personal information to:

• service providers (sub-processors) who help us operate the Service — see section 8;
• the employer whose form a candidate completed, in the case of candidate information;
• professional advisers such as lawyers and accountants, where necessary;
• law enforcement or regulators, where required or authorised by law;
• an acquirer, in connection with a merger, acquisition or sale of assets, subject to equivalent privacy protections.

We do not sell personal information. We do not disclose personal information to advertisers or data brokers.

7. Where your information is stored

Application data, including candidate information and uploaded documents, is stored in Sydney, Australia (ap-southeast-2).

Some of our service providers process limited data outside Australia. Where this occurs it is a cross-border disclosure under APP 8, and we take reasonable steps to ensure recipients handle the information consistently with the APPs — including contractual commitments, restricting what data leaves Australia, and applying the redaction described in section 5.2 before any AI processing.

Section 8 identifies which providers process data outside Australia.

8. Sub-processors

We use the following providers. This list is current as at the date of this policy and may change; we will update this page and, where required, notify affected customers.

If you would like to be notified of changes to this list, contact info@mibboo.com.

9. How long we keep information

9.1 Candidate information

Retention is configured by the employer who published the form. The platform default is 12 months from the date of application.

When the retention period expires, an automated process deletes the application, the associated documents from storage, the extracted data and the evaluation results.

If the employer’s workspace closes, the employer-configured deletion date continues to apply unless the candidate separately opted into Mibboo’s private talent pool. An opted-in application may then be retained until no later than 24 months from the date of that choice. Withdrawing the choice ends future talent-pool use and the information will be deleted unless another legal retention requirement applies.

9.2 Account information

We retain account and Organisation information for as long as the account is active. Following termination, you may export your data for 30 days, after which we delete it.

9.3 Backups and deletion

Deleted data may persist in encrypted backups for a limited period before those backups age out on our normal cycle. Candidate contact details are encrypted with per-record keys; when a deletion request is fulfilled, the relevant key is destroyed, which renders that data unreadable including in backups.

9.4 Legal retention

We may retain limited information where required by law, or where necessary to establish, exercise or defend a legal claim.

10. Security

We apply the following measures:

• Encryption in transit (TLS) and encryption at rest for all stored data.
• Application-layer encryption of candidate contact details using per-record keys under envelope encryption. Access to the raw database alone does not reveal this information.
• Redaction before AI processing, as described in section 5.2.
• Role-based access control, with separate permissions for viewing applications and viewing candidate contact details.
• Private file storage with short-lived, signed access links for uploaded documents.
• Audit logging of access to and export of application data.
• Multi-factor authentication on our administrative accounts.
• Restricted internal access on a need-to-know basis. Our staff cannot access candidate contact details or export application data through administrative tools.

No system is completely secure. If we become aware of a data breach likely to result in serious harm, we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as required under the Notifiable Data Breaches scheme, and we will notify affected customers without undue delay.

11. Your rights

11.1 Account holders

You may:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• delete your account and associated data, subject to legal retention requirements;
• export your data;
• opt out of non-essential communications;
• complain about how we have handled your information.

Contact info@mibboo.com. We will respond within a reasonable period, generally within 30 days.

11.2 Candidates

The employer you applied to is the controller of your application. Contact them first — they can access, correct or delete your application directly.

If you cannot reach them, or you want to contact us directly, email info@mibboo.com with the email address you used to apply and, if you know it, the employer or role. We will verify your identity by email before acting, and will either action your request or refer it to the employer as controller.

You may also use that address to withdraw a Mibboo talent-pool choice. Withdrawing does not affect the lawfulness of handling that occurred before withdrawal and does not affect the original application process.

11.3 Complaints

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992

If you are located outside Australia, you may also have the right to complain to your local data protection authority.

12. Children

The Service is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided information to us, contact info@mibboo.com and we will delete it.

13. Cookies

We use cookies and similar technologies. See our Cookie Policy for details.

14. Changes to this policy

We may update this Privacy Policy. If we make a material change, we will update the “Last updated” date and, where the change is significant, notify account holders by email or through the Service.

For candidates, the version of this policy in effect at the time of your application is recorded with your submission.

15. Contact

AOGEN PTY LTD (trading as Mibboo) ABN 33 686 852 871 · ACN 686 852 871 115 Pitt Street, Sydney NSW 2000, Australia

Email: info@mibboo.com Corporate and legal notices: info@aogen.com.au