Privacy Policy

KOKO Systems ("KOKO", "we", "us") provides an AI hiring and training secretary for small businesses. We handle personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For users outside Australia, we apply the same standards.

There are two kinds of people whose information we handle: account owners (businesses using KOKO) and applicants (people who submit a form through an owner's KOKO link).

From account owners: name, email address, business name and details, billing information (processed by Stripe — we never store card numbers), and your usage of the product.

From applicants: only what the form you submit asks for. This typically includes your name, email address, phone number, preferred language, your written answers, and a resume if you choose to attach one.

We do not collect sensitive information (such as health, religion or biometric data) unless an owner's form explicitly asks for it and you choose to provide it.

We use personal information to:

• deliver applications to the business you applied to;
• send notification and confirmation emails;
• help owners assess applications, including AI-assisted reply drafts and fit signals shown only to the owner;
• operate billing, support and security; and
• detect spam, fraudulent listings and abuse.

We never sell personal information, and we do not use applicant data to train AI models.

Applications are shared with the business that published the link you applied through. Beyond that, we disclose information only to the service providers that run KOKO:

• Supabase — database and authentication
• Amazon Web Services (S3) — resume and image storage
• Vercel — application hosting
• Resend — transactional email
• Stripe — payment processing

Some of these providers store data outside Australia (primarily the United States). Where that happens we rely on providers that maintain recognised security and privacy certifications, consistent with APP 8 (cross-border disclosure).

Application data is kept while the receiving business's account is active so they can manage their hiring. When an account is closed, its data — including applications received — is deleted within 30 days, except where we must retain records for legal or billing reasons.

You may request access to, correction of, or deletion of your personal information at any time. This applies to applicants too: if you applied to a job through KOKO and want your application removed, contact us and we will action it within 30 days.

Email privacy@kokosystems.co with the email address you used, and we will verify the request before exporting or deleting your data.

Data is encrypted in transit (TLS) and at rest. Database access is restricted by row-level security so each business can only see its own data. Internal AI assessments are visible only to the business owner, never to applicants or other parties.

If you believe we have mishandled your information, contact us first at privacy@kokosystems.co and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We will email account owners and update the date at the top of this page whenever this policy changes in a material way.