Sift

Legal

Privacy Policy

Effective 9 November 2026

Sift (careerstreamservices.com) is an Australian job search website. This policy explains what personal information we collect, why we collect it, who we share it with, how it is shared, and how we protect it. It applies whenever you use the site, create a profile, apply for a role, open an employer account or subscribe.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). By using Sift you agree to the handling described here.

1. Information we collect

Account information

Your name, email address and login method. If you sign in with Google, Microsoft, Facebook or Apple, we receive your name and email address from that provider. Passwords, where you use one, are stored by our authentication provider in hashed form — we never see them.

Profile information you give us

Your professional headline, summary, skills, years of experience, location, preferred work type and employment type, salary expectation, availability, and the CV file you upload. This is the information we use to score roles against you.

Activity on Sift

Roles you save or shortlist, fit scores and matching notes generated for you, applications you start, employers you follow, and your last matched date.

Employer information

If you open an employer account: company name, company website, contact name and contact email, the job ads you publish, and the status of those ads.

Payment information

Your subscription or advertising purchase — the amount, currency, status, the Stripe checkout reference and your email address. Card numbers, expiry dates and security codes are entered on Stripe's own checkout page and are never received or stored by Sift.

Messages you send us

The name, email address and message you submit through our contact form, so we can reply.

Technical information

Standard server and security logs such as the pages requested, error reports, browser type and approximate region. We also store small amounts of data in your browser (a session token to keep you signed in and your light or dark theme choice).

2. How we use your information

  • Create and secure your account, and keep you signed in.
  • Score open roles against your profile and generate the fit score, reason and skill gap shown to you.
  • Read the CV you upload so your profile can be filled in from it.
  • Save your shortlist and remember which roles you have applied for.
  • Process subscription and advertising payments and confirm what was paid.
  • Publish employer job ads in our public job catalogue.
  • Reply to your contact messages and support requests.
  • Detect abuse, fraud and payment problems, and keep the service reliable.
  • Understand which pages and searches are used, so we can improve them.

We do not sell your personal information, and we do not use your CV or profile to advertise to you.

3. Who we share it with, and how

We disclose personal information only to the service providers and parties below, only for the purposes described, and only as much of it as each one needs.

Stripe

Our payment processor. Stripe receives your email address and payment details to take payment and manage renewals, and returns the payment status to us. Card details go directly to Stripe, never through our servers. Stripe's own privacy policy applies to that processing.

Method of disclosure: Encrypted API calls sent from our servers and from your browser to Stripe.

Our hosting and database provider (Base44)

Sift runs on Base44's application platform, which hosts our website, stores our database records and files, and authenticates sign-ins. Your information is stored in our app's database on that platform, under access rules that restrict each record to you and to our administrators.

Method of disclosure: Stored in our app's database and private file storage on the platform, accessed over encrypted connections.

AI model providers

To score jobs and read a CV, the relevant profile text, job details and your CV document are sent to an AI model provider that returns the result. We send only what is needed for that task. We do not authorise these providers to use it to train their models on your behalf or for their own marketing.

Method of disclosure: Encrypted API requests containing only the text or document needed for the specific task, with short-lived access links to your CV.

Sign-in providers

If you choose Google, Microsoft, Facebook or Apple sign-in, that provider confirms your identity to us and shares your name and email address. They do not receive your Sift profile.

Method of disclosure: Standard OAuth sign-in between your browser and the provider.

Email delivery provider

We use an email service to send account emails such as verification codes, password resets and payment receipts. That provider receives your email address and the contents of that message.

Method of disclosure: Encrypted API calls to the email service when a message is sent.

Employers

Only what you choose to send. When you apply to a role, you decide what to include in the application (such as a cover note and your contact details). We do not sell, rent or hand your profile, CV or contact details to employers or recruiters. Employer job ads are public, but your profile is not.

Method of disclosure: Shared only when you submit an application, or when you contact an employer through a link we provide.

Authorities

We may disclose information where we are legally required to, for example in response to a valid court order or a lawful request from an Australian regulator, or where necessary to investigate fraud or a threat to someone's safety.

Method of disclosure: Disclosed to the requesting body only, limited to what is lawfully required.

Some of these providers store data outside Australia, mainly in the United States. Where that happens we rely on the provider's contractual and security commitments to protect the information, and we disclose only what the service in question requires.

4. How we protect your information

  • All traffic to and from Sift is encrypted in transit with HTTPS/TLS, including sign-in, profile saves and payment requests.
  • Uploaded CVs are stored in private storage, not on the public web. They can only be opened through a short-lived signed link generated for the matching task.
  • Record-level access rules mean your profile, saved roles and applications are readable only by you and by our administrators. Other users cannot see them.
  • Payment card details are never transmitted to or stored on our servers — they go straight to Stripe.
  • Access to administrative functions is limited to our own authorised staff, protected by individual logins and role checks on the server.
  • We keep our platform and dependencies up to date and monitor logs for errors and abuse. No system is perfectly secure, but if a breach affecting your information ever occurs we will notify affected users and the OAIC as required by law.

5. How long we keep it

Your profile and account information are kept while your account is active. If you delete your account, your profile and saved roles are deleted. Limited records such as payment confirmations may be kept longer where tax or accounting law requires it, and contact messages are kept while we deal with your enquiry.

6. Your choices and rights

  • Ask for a copy of the personal information we hold about you.
  • Correct anything that is wrong — most of it you can edit yourself on your profile page.
  • Delete your account, which removes your profile and saved roles. You can do this from your profile page, or ask us to.
  • Withdraw consent to non-essential cookies and analytics in your browser settings.
  • Complain about how we handled your information, to us first and then to the Office of the Australian Information Commissioner.

7. Young people

Sift is intended for people looking for work. If you are under 16, please use it only with the help of a parent or guardian.

8. Changes to this policy

If we change how we handle personal information we will update this page and change the effective date above. Material changes will be flagged on the site.

9. Contact us

For any question about this policy, or to ask for a copy, correction or deletion of your information, use our contact form. We aim to respond within 30 days. If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.