Privacy Policy

1. Who We Are

Edelvor operates the Edelvor platform at edelvor.com (the “Platform”). Edelvor is an Australian company subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). In this policy, “we”, “us”, and “our” refer to Edelvor. “You” refers to any individual who uses the Platform, whether as a professional, a company administrator, or a visitor.

2. What This Policy Covers

This policy explains what personal information we collect, why we collect it, how we use and share it, and your rights regarding your information. It applies to all interactions with the Platform, including browsing, account registration, profile creation, search, and enquiry submission.

3. Information We Collect

3.1 Information you provide directly

• Account information: name, email address, password (hashed), phone number
• Professional profile information: job title, disciplines, sectors, qualifications, registrations (e.g. RPEQ, CPEng), years of experience, biography, software competencies, and standards worked to
• Project history: project names, descriptions, roles held, client names, involvement levels, and dates
• Company affiliation: the company or companies you claim to be associated with
• Enquiry information: messages, attachments, and contact details submitted through the Platform
• Nominations and awards: fellow nominations submitted by company administrators, including supporting statements
• Feedback: private post-engagement feedback (a Yes/No "would work again" response plus an optional comment), visible only to the fellow, their firm administrators, and platform administrators. Feedback is never publicly displayed.

3.2 Information collected automatically

• Device and browser information: IP address, browser type, operating system, device identifiers
• Usage data: pages visited, search queries, time on site, referral sources
• Cookies and similar technologies: session cookies for authentication. We use cookieless analytics (via Vercel) to measure aggregate usage. It runs only if you accept analytics in the cookie banner.

3.3 Information from third parties

• Company administrators may add your name and basic professional details to the Platform as part of their employee listing
• Authentication providers (e.g. Google, LinkedIn) if you choose to sign in via a third-party service

4. How We Use Your Information

We use your personal information for the following purposes:

• Providing the service: Creating and maintaining your account, displaying your professional profile in search results, facilitating enquiries, and processing nominations and feedback.
• Public professional directory: Your professional profile (name, title, qualifications, project history, company, disciplines, sectors) is displayed publicly to enable clients and other professionals to find experts. This is the core function of the Platform.
• Search and matching: We index your profile data (including through semantic and AI-powered search) so that users searching for specific expertise can find relevant professionals.
• Verification and trust: Verifying company-user affiliations, processing fellow nominations, and displaying verified badges.
• Communication: Sending you notifications about enquiries, profile updates, nomination status, and important platform changes.
• Improvement and analytics: Understanding how the Platform is used, improving search quality, and developing new features using aggregated, de-identified data.
• Legal compliance: Complying with legal obligations, responding to lawful requests from authorities, and protecting our rights and the safety of users.

5. The Public Nature of Professional Profiles

The following information is publicly visible by default when a profile is created:

• Full name and professional title
• Company affiliation and verification status
• Disciplines, sectors, and areas of expertise
• Qualifications and professional registrations
• Project history (project names, roles, and descriptions)
• Fellow status and any awards or nominations received
• Biography and summary of experience

The following information is never publicly displayed:

• Email address (visible only to you and your company administrator)
• Phone number (visible only to you and your company administrator)
• Password
• IP address or device information

You have control over certain visibility settings through your Privacy Settings. However, because the Platform is a professional directory, some core profile information must remain visible for your profile to appear in search results.

6. Company-Added Employee Listings

Company administrators may add employees to the Platform as part of their workforce listing. When a company adds your details:

• The company provides your name, professional title, and basic professional information
• Your listing will appear on the Platform as an unverified profile until you claim it
• You will be notified (where an email address is provided) that a profile has been created on your behalf
• You have the right to claim the profile, request corrections, or request removal

7. How We Share Your Information

We do not sell your personal information to third parties. We share information only in the following circumstances:

• Public display: Your professional profile is displayed publicly as described in Section 5.
• Company administrators: Your company administrator can view your full profile, contact details, and manage your fellow status and project history.
• Enquiry recipients: When a user submits an enquiry about you or your company, the enquiry details are shared with the relevant company administrator and, where applicable, with you.
• Service providers: We use trusted third-party services for hosting (Supabase/AWS), analytics, and email delivery. These providers process data on our behalf under strict contractual obligations.
• Legal requirements: We may disclose information if required by law, regulation, legal process, or enforceable government request.
• Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred. We will notify you before your information becomes subject to a different privacy policy.

8. Data Storage and Security

Your data is stored on servers provided by Supabase (which uses AWS infrastructure). Data may be stored in Australia and other jurisdictions where our service providers operate. Where data is transferred overseas, we take reasonable steps to ensure it is protected in accordance with the APPs.

We implement technical and organisational security measures including:

• Encryption of data in transit (TLS/HTTPS) and at rest
• Hashed password storage (passwords are never stored in plain text)
• Role-based access controls for company administrators
• Regular security reviews and monitoring
• Row-level security policies on our database

No system is 100% secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

9. Your Rights

Under the Australian Privacy Principles, you have the following rights:

• Access: You can request access to the personal information we hold about you. Your profile information is visible to you at all times through your dashboard.
• Correction: You can update or correct your profile information at any time through your dashboard.
• Deletion: You can request deletion of your account and associated personal information. See Section 10 for details.
• Complaint: If you believe we have breached the APPs, you can lodge a complaint with us at admin@edelvor.com. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
• Opt-out of marketing: You can opt out of marketing communications at any time through your notification settings.

10. Account Deletion and Data Retention

When you request deletion of your account:

• Your profile is immediately removed from public search results
• Your personal information is deleted or de-identified within 30 days
• Project history records may be retained in de-identified form to maintain the integrity of project records
• Feedback you have submitted about others may be retained but the reviewer attribution is removed
• Company administrators will be notified that your profile has been removed
• Data required for legal compliance or dispute resolution may be retained for up to 7 years as required by law

11. Privacy Settings and Controls

You can manage your privacy through the Privacy Settings page in your dashboard. Key settings include:

• Controlling which profile fields are visible to the public vs. restricted to logged-in users
• Opting out of AI-powered search indexing
• Managing notification preferences and email communications
• Controlling whether your profile appears in downloadable search results or reports
• Setting contact preferences for enquiries

12. Cookies and Tracking

We use the following types of cookies:

• Essential cookies: Required for the Platform to function (authentication, session management). These cannot be disabled.
• Analytics cookies: Help us understand how the Platform is used. These are only placed with your consent.

We do not use advertising or tracking cookies. We do not share cookie data with advertisers. You can manage your cookie preferences at any time through the cookie banner or your browser settings.

13. Children's Privacy

The Platform is designed for professional use and is not intended for individuals under 18 years of age. We do not knowingly collect information from children. If we become aware that we have collected information from a child, we will take steps to delete it promptly.

14. Automated Decision-Making

We use automated processes for the following purposes:

• Search ranking and matching: your profile is ranked in search results using algorithms that consider relevance, completeness, verification status, and other factors
• Semantic search: AI-powered search processes your profile text to match natural-language queries

These automated processes affect the visibility of your profile in search results but do not make decisions that significantly affect your rights or interests. You can opt out of AI-powered search indexing through your Privacy Settings.

15. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes by email and/or a prominent notice on the Platform. The “last updated” date at the top of this policy indicates when it was last revised. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

16. Contact Us

If you have questions or concerns about this policy or our handling of your personal information:

• Email: admin@edelvor.com
• OAIC: If you are unsatisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or by phone on 1300 363 992.