Privacy

EvenBetter is operated by EvenBetter Technology Pty Ltd (ABN 69 681 536 149), an Australian company based in Sydney. This Privacy notice explains what personal information we collect when you use the EvenBetter Service, what we do with it, and the controls you have over it.

For matters relating to this notice or your personal information, reach us via our contact page. This notice works alongside our Terms & Conditions and, where we handle personal data on your behalf, our Data Processing Addendum.

Your relationship with us depends on whose personal data is involved:

• For your own account data, we are the controller — we decide how and why it is processed, and this notice governs that use.
• For personal data you submit about other people — for example, employees or candidates named in a job description or offer — we act as a processor on your behalf. You remain the controller of that data, and our Data Processing Addendum governs how we handle it.

We collect the following categories of information:

• Account information — name, work email, organisation, password hash (managed by our auth provider), and authentication timestamps. We never see your password.
• Service inputs — the job descriptions and offer details you paste, the extracted role facts (title, skills, location, experience band, expected pay), and the benchmark reports we generate for you.
• Technical & usage data — IP address, browser/device, pages visited, feature interactions, error logs, and performance traces. Used to keep the Service running and improve the user experience.
• Billing data — handled by our payment processor (Stripe). We see plan tier, credit balance, and invoice metadata; we never see full card numbers.
• Support communications — anything you email us, chat to us, or submit via feedback forms.
• Location history— the places you've picked in the benchmark wizard's location field, kept so we can serve a “recent locations” list without re-querying an external maps provider on every open. You can wipe this list at any time from Profile → Data & privacy.

We use the information we collect to:

• Provide the Service and deliver benchmark reports to you.
• Maintain account security and detect abuse (rate-limiting, anomaly detection, fraud prevention).
• Bill, collect payments, and meet our tax / record-keeping obligations.
• Improve the Service — including the de-identified use described in the Use of de-identified inputs section below.
• Respond to support requests and operational notifications (e.g. credit-balance alerts, scheduled maintenance).
• Send marketing communications where permitted (see the Marketing communications section below).
• Comply with applicable Australian and overseas law, and cooperate with lawful regulator or court requests.

If you are protected by the EU or UK GDPR, we rely on the following legal bases:

• Performance of our contract — to create your account and deliver the Service you have signed up for.
• Legitimate interests — to secure and improve the Service, run product analytics, and send direct marketing to our existing customers, balanced against your rights.
• Consent — for advertising cookies and certain marketing, which you can withdraw at any time.
• Legal obligations — to meet tax, accounting, and other statutory requirements.

We do not sell your personal information, and we do not use your account-linked inputs to train large language models for other parties.

Generating a benchmark involves two distinct AI stages, and we handle your identity differently in each.

Processing your input.The job description text you submit is processed by Anthropic's Claude models: a Haiku model redacts personally identifiable information before anything is persisted, a Sonnet model extracts role facts (such as title, seniority, skills, and location), and an Opus model writes the narrative report.

Benchmark research. Separately, our benchmark research pipeline — run in our self-hosted n8n orchestration — sends role/market context (job title, seniority, location, and extracted requirements) to third-party AI research models, currently including Anthropic (Claude), Google (Gemini), OpenAI (ChatGPT), and xAI (Grok). This research pipeline does not send your identity, your employer's identity, or your specific offer or salary figures.

The AI providers and other sub-processors we use are maintained in the sub-processor section below and updated as providers change.

We use a vetted set of sub-processors to run the Service. Each handles a specific function and accesses only what it needs:

Infrastructure

• Cloudflare Workers/Pages (US/global edge) — compute and hosting.
• AWS RDS PostgreSQL (Sydney, Australia — ap-southeast-2, accessed via Cloudflare Hyperdrive) — primary database (account, reports, transactions).

Platform services

• Clerk (US) — authentication and account management.
• Stripe (US) — payments and invoicing.
• Resend (US) — transactional email.
• HubSpot (US) — CRM and marketing email.
• Mixpanel (US) — product analytics.
• Sentry (US) — error monitoring.
• Langfuse (US) & Arize (US) — AI-call tracing.

AI models

• Anthropic (US) — Claude models for extraction, narrative generation, and PII redaction.
• AI research models — the benchmark research providers described above: Anthropic (Claude), Google (Gemini), OpenAI (ChatGPT), and xAI (Grok), which receive role/market context only.

Server-side ad-conversion measurement. Where enabled, server-side conversion measurement (Conversions API) to Meta, Google, LinkedIn, and OpenAI Ads sends a hashed email, the event, and a value. This measurement is disabled in production by default and may be enabled during marketing-measurement phases.

Read-only data sources. We also query external data sources to build benchmarks and send no user data to them: LinkedIn, Indeed, SEEK, ABS, Adzuna, SerpApi, and AU salary-guide publishers.

We disclose your personal information only to (a) these sub-processors to run the Service, (b) where you instruct us to, or (c) where required by law. We do not sell your personal information.

Strictly necessary first-party cookies managed by Clerk are used for authentication and session management on our sign-in flows, and a single evenbetter.terms.accepted localStorage entry stores that you accepted our Terms during sign-up. These are always active because the Service cannot function without them.

Advertising and third-party analytics tags loaded through our tag manager — Google Analytics, Meta, LinkedIn, and Google Ads — are gated by Google Consent Mode v2 and do not load until you opt in via our consent banner. When enabled, advertising cookies (e.g. Meta _fbp, Google Ads _gcl*, LinkedIn li_sugr) let us measure the performance of our campaigns on Meta, LinkedIn, and Google and show relevant ads, and analytics cookies (e.g. Google Analytics _ga) help us understand site usage. We also share limited, privacy-safe conversion data with these platforms to measure ad effectiveness.

When you consent to advertising cookies, we and our advertising partners (Meta, Google, LinkedIn and OpenAI) process hashed identifiers and conversion events to measure and target advertising. Under laws such as the California CCPA/CPRA this may be treated as “sharing” of personal information for cross-context behavioural advertising. We do not “sell” your personal information for money.

Separately, first-party product analytics (Mixpanel) and first-touch attribution operate on a strictly-necessary / legitimate-interest basis to run and improve the Service; these are first-party and are listed in the table below. Cloudflare Web Analytics remains cookieless.

You can review or change your cookie choices at any time: Manage cookie preferences

Separately, server-side conversion measurement (see the sub-processors section) sends only hashed identifiers to advertising platforms and is disabled in production by default.

Service messages — relating to your account, security, billing, or reports — are sent to all users because they are necessary to run the Service.

Marketing messages — such as tips, re-engagement, and offers — rely on your consent or on our existing-customer relationship (the Spam Act 2003 (Cth); consent under the GDPR). You can opt out at any time using the unsubscribe or one-click option in any marketing email. Opting out of marketing does not stop service messages. We never sell your data.

We retain account-linked data for as long as your account is active. After you delete your account or request erasure (see the Your rights section below), we delete account records within 30 days, subject to:

• Backups, which expire on a 30-day rolling schedule — deleted records vanish from backups within that window.
• Billing records, which we retain for 7 years to meet Australian tax-recordkeeping requirements.
• De-identified inputs in the improvement pipeline, which are not tied to your account and remain in the aggregated dataset (see the Use of de-identified inputs section above). Excluding your account from the pipeline going forward is separate from removing past inputs that have already been de-identified and merged.

The rights available to you depend on where you are and the laws that protect you.

Australia — Australian Privacy Principles

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to fix inaccurate or out-of-date information.
• Complaint — raise a concern about how we handle your information (see the Complaints section below).

EU / UK — GDPR

• Access, rectification, and erasure of your personal data.
• Restriction of, and objection to, processing.
• Data portability.
• Withdrawal of consent at any time.
• Lodging a complaint with a supervisory authority.

California — CCPA/CPRA

• The right to know / access the personal information we hold about you.
• The right to delete and the right to correct.
• The right to opt out of the “sale” or “sharing” of personal information. We do notsell your personal information for money. California residents can opt out of the “sharing” described in the Cookies and tracking section at any time by declining or withdrawing consent in our cookie banner (see the Manage cookie preferences control) — and because our advertising tags are opt-in (Google Consent Mode v2) and our server-side conversion measurement is disabled in production by default, no such sharing occurs unless you opt in. To exercise the California “Do Not Sell or Share My Personal Information” right, use the same Manage consent control.
• The right to non-discrimination for exercising these rights.

In addition, all users may opt out of the improvement pipeline — excluding future inputs from the de-identified improvement use described above.

To exercise any of these rights, reach out via our contact page. We may need to verify your identity before acting on a request, and we will respond within 30 days or the period required by law. Where we process personal data on a customer's behalf (as a processor), we route requests from that customer's employees or candidates to the customer as controller.

We use industry-standard technical and organisational measures to protect personal information: encryption in transit (TLS 1.3) and at rest, scoped access controls for staff, audit logs on database reads/writes, and regular dependency-vulnerability scanning. No method of transmission or storage is 100% secure.

If we become aware of an eligible data breach, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme, and the relevant EU or UK supervisory authority without undue delay — within 72 hours where required.