Privacy policy.

1. Data we collect

We collect different categories of data depending on how you use Locket.

From candidates

• Account details : name, email address, and the LinkedIn profile data you authorise during sign-in (headline, current role, profile picture).
• Profile content you choose to provide : work history, preferred role types, location, work-authorisation status, resume uploads, and other text you enter into your profile.
• Video recordings you submit as part of your profile or in response to a recruiter brief, along with any audio, captions, or AI-generated transcripts derived from them.
• Search data derived from your content : the text of your profile and video transcripts is indexed (including as numerical embeddings) so that recruiters can find you through Locket’s search.

Your videos may reveal information that privacy law treats as sensitive : for example your racial or ethnic background, apparent age, or a disability. You choose what to record, and by submitting a video you consent to us storing and sharing it as described in this policy. We do not use your videos to infer protected characteristics, and we do not require you to disclose sensitive information to use Locket.

From recruiters

• Account details : name, work email, employer, and the LinkedIn profile data you authorise at sign-in.
• Hiring activity : briefs you create, candidates you shortlist or reject, notes you leave on a candidate, and messages you send through Locket.

From everyone

• Technical data : IP address, browser and device type, pages viewed, and timestamps. We use this to keep the service running, debug issues, and detect abuse.
• Product analytics : anonymised events about which features you use (for example, “profile created”, “video uploaded”) so we can improve the product.

Recruiters also create data about candidates as they use Locket : notes on a candidate, shortlist or reject decisions, and messages. If you are a candidate, this is personal data about you even though someone else created it, and you can ask to access it under section 10.

2. How we use your data

• To create and operate your Locket account.
• To match candidates with recruiter briefs and surface relevant opportunities.
• To transcribe and process video recordings so they are searchable and accessible.
• To send service emails (login links, notifications about your profile, hiring activity).
• To send you occasional product and marketing emails, where you have not opted out. Every marketing email includes an unsubscribe link, and opting out never affects the service emails you need to use Locket.
• To improve the product through aggregated, anonymised analytics.
• To comply with our legal obligations and protect against fraud or abuse.

We do not sell your personal data, and we do not use your videos or profile content to train foundation models : neither our own nor those of any third party.

If you are in the EEA, Switzerland, or the UK, the legal bases we rely on for each of these uses are set out in section 11.

3. Who we share your data with

With recruiters and employers

Locket is a marketplace : its purpose is to put candidates in front of employers. When you create a candidate profile and respond to briefs, your profile, videos, transcripts, and the details you provide are made visible to recruiters and the employers they work for, so they can consider you for a role. Recruiters can reach you both when you respond to a brief and by searching Locket’s candidate pool : our search matches their query against the profiles, videos, and transcripts that candidates have submitted, so submitting a profile may make you discoverable to recruiters you have not directly applied to. Once an employer has accessed your information, they become an independent controller of it and handle it under their own privacy policy. If you do not want your information shared with employers, do not submit a profile or video, or close your account.

With our service providers

We share data with the third-party providers listed in section 7, who process it on our behalf and only on our instructions. They receive the minimum data needed to do their job and are contractually bound to keep it secure and not use it for their own purposes.

For legal and safety reasons

We may disclose your data to courts, regulators, law enforcement, or other authorities where we believe it is required by law, or necessary to enforce our terms, establish or defend legal claims, or protect the rights, safety, or property of Locket, our users, or the public. We may also share data with our professional advisers (such as lawyers, auditors, and insurers) where needed for the services they provide to us.

In a business transfer

If Locket is involved in a merger, acquisition, financing, sale of assets, or insolvency, your data may be transferred to the party involved as part of that transaction. We will require them to honour the commitments in this policy, and we will let you know if your data becomes subject to a materially different policy.

4. AI and automated decisions

Locket uses AI in two narrow, clearly defined ways, and no others:

• Transcription : we convert the audio in your videos to text, so it can be shown as captions and made searchable.
• Search (retrieval-augmented generation) : when a recruiter searches for candidates, we use AI to find and surface the profiles and transcripts most relevant to their query. This is a search-and-retrieval tool, not a scoring or screening engine.

That is the full extent of it. Locket does not use AI to draft candidate summaries, score or rank candidates, infer characteristics about you, or make or recommend hiring decisions. Search results help a recruiter decide whose profile to look at; a person at the employer decides who to shortlist, interview, or hire. We do not use solely automated processing to make decisions that produce legal or similarly significant effects about you.

If you are in the EEA, Switzerland, or the UK, you can ask a human to review any decision you believe was made about you by automated means, by emailing us at the address in section 16. You can also object to your profile being included in AI-powered search, though this will make it much harder for recruiters to find you.

5. Where your data is stored

Locket runs on a small number of trusted infrastructure providers. Your data may be stored in or transit through their systems:

• Supabase : primary database (Postgres) and storage for video files, resumes, and profile media.
• Vercel : hosting for the Locket web application, edge functions, and serverless API.

Production data is hosted in Australia and the United States. Both providers offer encryption at rest and in transit.

6. International data transfers

Because our providers and our team operate in Australia and the United States, your personal data may be transferred to, stored in, and processed in countries other than the one you live in. Those countries may have data protection laws that differ from your own.

If you are in Australia, sending your data to our US-based providers is a cross-border disclosure under Australian Privacy Principle 8. We take reasonable steps to ensure those providers handle your data consistently with the Australian Privacy Principles, through the contractual and technical safeguards described in section 7 and below.

Where we transfer personal data out of the EEA, Switzerland, or the UK to a country that has not been recognised as providing an adequate level of protection, we put an appropriate safeguard in place : usually the European Commission’s Standard Contractual Clauses (and the UK Addendum or Swiss equivalent where relevant), together with additional technical measures such as encryption. You can ask us for a copy of the safeguard we rely on by emailing the address in section 16.

7. Third-party services we use

We rely on a small set of third parties to deliver core features. They only receive the minimum data needed to do their job, and they are contractually bound to handle it securely:

• Groq (Whisper) : transcribes the audio in your videos so the resulting text can be displayed as captions and used for search.
• Anthropic : powers our AI search, which matches a recruiter’s query against candidate profiles and transcripts. We do not share your videos directly with Anthropic; we send the derived text only.
• Better Auth + LinkedIn : handles authentication. LinkedIn returns the basic profile fields you authorise when you sign in.
• PostHog : product analytics for anonymised usage events.
• Resend : sends transactional and service emails on our behalf.

8. Cookies

We use cookies for three purposes:

• Essential : to keep you logged in, remember your waitlist progress, and protect against CSRF. The service will not work without these.
• Preferences : to remember settings such as your theme.
• Analytics : to record anonymised product usage events.

We do not use third-party advertising or cross-site tracking cookies. Where the law requires consent for non-essential cookies (for example, for visitors in the EEA and the UK), we ask for it before those cookies are set, and you can change your choice at any time.

9. How long we keep your data

• Account data : kept for as long as your account is active. If you delete your account, we remove your profile, videos, and resume within 30 days.
• Waitlist signups : kept until the early access cohort closes, after which inactive entries are deleted within 12 months.
• Hiring activity : shortlists, notes, and messages are retained for the life of the recruiter’s account, then deleted on account closure.
• Logs and analytics : kept in identifiable form for up to 90 days, then anonymised or deleted.
• Legal records : billing and compliance records may be retained longer where law requires it.
• Aggregated or anonymised data : once data has been aggregated or anonymised so it can no longer identify you, it falls outside these timelines and we may keep it indefinitely to understand and improve the product.

Note that once an employer has accessed your profile or videos, any copy they hold is governed by their own retention practices, not ours.

10. Your rights

Under Australian privacy law and the GDPR, you can ask us to:

• Access the personal data we hold about you.
• Correct data that is wrong or out of date.
• Delete your account and the data attached to it.
• Export a copy of your profile and videos in a portable format.
• Object to specific uses (for example, analytics or inclusion in AI search), restrict processing, or withdraw consent where we relied on it. Withdrawing consent does not affect processing we carried out beforehand.

Most of these you can do directly from your profile settings. If you joined the waitlist and want off, open your confirmation page at /waitlist/thanks and use the “Remove me from the waitlist” link — that deletes your signup row immediately. For anything else you can’t self-serve, email us at the address in section 16 and we will respond within 30 days. You may exercise these rights yourself or through an authorised agent acting on your behalf, provided they can prove their authority.

11. Legal bases (EEA, Swiss & UK users)

If you are in the EEA, Switzerland, or the UK, data protection law requires us to have a legal basis for using your personal data. We rely on the following:

• Performance of a contract : to create and run your account, match candidates with briefs, and make profiles and videos available to recruiters : the core of the service you ask us for.
• Consent : for submitting videos and any sensitive information they contain, for non-essential cookies, and for marketing emails. You can withdraw consent at any time.
• Legitimate interests : to keep the service secure, prevent fraud and abuse, and improve the product through anonymised analytics : balanced against your rights and freedoms.
• Legal obligation : to keep records the law requires us to keep and to respond to lawful requests.

12. How to make a complaint

If you are unhappy with how we have handled your personal data, please contact us first at the address in section 16 so we can try to put it right. We will acknowledge your complaint and respond within a reasonable time, usually 30 days.

You also have the right to complain to a data protection regulator. In Australia that is the Office of the Australian Information Commissioner (OAIC). If you are in the EEA, Switzerland, or the UK, you may complain to your local supervisory authority.

13. Security

We encrypt data in transit (TLS) and at rest, restrict production access to a small set of engineers, and use audited infrastructure providers. No system is perfectly secure : if we ever detect a breach that affects your data, we will notify you and the relevant authorities as required by law.

14. Children

Locket is not for children. We do not knowingly collect data from anyone under 18. If you believe a minor has signed up, email us and we will remove the account.

15. Changes to this policy

We will update this policy as Locket evolves. Material changes will be announced in the product or by email before they take effect. The “last updated” date at the top reflects the most recent revision.

16. Contact us

Questions about this policy, or want to exercise one of your rights? Email us at privacy@locketjobs.com, or write to us at:

Locket Pty Ltd
Attn: Privacy
Victoria, Australia