Privacy Policy

RetainedCo is a brand operated by NOMARK Pty Ltd (ABN 72 687 436 219), an Australian company. NOMARK is committed to protecting your privacy and personal information. This policy explains how we collect, use, and protect personal information when you use the RetainedCo website and services. In this policy, "we", "us", and "our" mean NOMARK Pty Ltd.

This policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

We collect personal information through direct interactions with you, your use of our website, and third-party sources. This may include your name, contact details, professional background, any CV or similar document you upload, and information you provide when you create an account, build a profile, or request an introduction.

We use personal information for purposes including:

• Providing our services.
• Communicating with you about our services.
• Marketing and business development, with your consent.

We do not sell, rent, or trade your personal information for marketing purposes. We share personal information only with the service providers that help us operate the RetainedCo platform:

• Supabase: database, authentication, and file storage. This holds your account, your profile, any CV or portrait you upload, the briefs and messages you write, and your engagement records. Your data is stored in the Sydney, Australia region. Supabase also sends your account confirmation and password-reset emails.
• Vercel: website hosting and delivery. Serverless functions run in the Sydney, Australia region; the global edge layer stores no personal information.
• Vercel Web Analytics: counting page views so we can understand how the site is used. Each page view records the page visited, the referring site, device type, operating system and browser, and an approximate location. Vercel’s public documentation states that it sets no cookies, does not associate this data with your IP address, and does not track you across other websites.
• Anthropic (Claude): extraction of structured information from uploaded CVs and from the engagement briefs you write. This content is transmitted to Anthropic in the United States.
• Voyage AI: generating the numerical representations used to match briefs to professionals. We send a profile’s headline, summary and capability and industry tags when that profile is published, and a brief’s outcome text when it is submitted.
• Stripe: payment processing, identity and tax verification, and payouts, through Stripe Connect. We send your name and email address. Stripe collects identity, tax, and bank details directly. Card details are handled by Stripe and are not stored on our servers.
• Resend: transactional email delivery. We send the recipient address and the content of the message, including any receipt attached to it.
• Resend also hosts our mailing list. If you opt in at sign-up or in your account settings, your email address and name are added to a mailing list stored in the United States or the European Union. Closing your account removes you from it.
• BusinessAPI: only if you use our business setup tools. We send the details of your sole-trader ABN application: your title and names, date of birth, gender, email address, phone number, business address, the declaration you sign, your answers to the entitlement questions, and your expected annual income. Tax file numbers are never sent: an application containing one is rejected before it leaves our servers. BusinessAPI is operated by Business API Pty Ltd, an Australian company.
• Checkify: checking an ABN you give us, and re-checking it on a schedule afterwards. We send the ABN only. Checkify is operated by Business API Pty Ltd.
• Australian Business Register: the same ABN check, where it is made directly against the register instead. We send the ABN only. The register is an Australian Government service.

Some of these providers process information overseas, including in the United States and the European Union. Where a provider’s location is confirmed, it is stated above. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

We protect your personal information using measures including encryption, secure servers, access controls, and regular security assessments.

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you may:

• Request access to the personal information we hold about you.
• Request correction of inaccurate or out-of-date information.
• Request deletion of your personal information, subject to legal requirements.
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise your rights, contact us at privacy@nomark.au.

We may update this policy from time to time. Changes will be posted on our website with an updated date. Continued use of our services after an update constitutes acceptance of the revised policy.

Questions or complaints about our privacy practices should be directed to NOMARK Pty Ltd at privacy@nomark.au. Website: nomark.au.