Privacy Policy

Last updated: 30 September 2026

In short: Your data belongs to your organisation. STARselect is operated by ConstructEng Australia Pty Ltd. What you enter is stored on servers provided by a third-party host in Australia, on our behalf, and is used only to run STARselect for you. Text you send to STARselect's AI features is processed by Anthropic, and connected LinkedIn and email accounts run through Unipile; both are based overseas. We don't sell your data, and we don't use it for any other purpose, including ConstructEng Australia's own recruitment business.

1. About this policy

STARselect is a recruitment software service operated by ConstructEng Australia Pty Ltd as trustee for ConstructEng Australia (ABN 66 474 096 793), based in New South Wales ("we", "us", "our"). This policy explains how we collect, hold, use and disclose personal information in connection with STARselect, including the STARselect web app and the interview booking pages it creates.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where health information is involved in New South Wales, we also have regard to the Health Privacy Principles in the Health Records and Information Privacy Act 2002 (NSW).

This policy covers STARselect only. The ConstructEng Australia recruitment website and recruitment services have their own privacy policy.

2. Two kinds of personal information

STARselect handles personal information in two different ways, and it helps to keep them apart:

• Our customers' information. When a recruiter or employer ("customer") signs up, we collect information about them and their team members to provide the service. We are responsible for that information.
• Candidates' information. Customers use STARselect to manage recruitment: they upload CVs, add candidates, search LinkedIn, write interview notes and send messages. That information belongs to the customer, who decides what to collect and how to use it. We store and process it on the customer's behalf, to provide STARselect to them. If you are a candidate and want to know how a recruiter or employer uses your information, please contact them first; we will also help where we can (see section 11).

3. What we collect

From customers and their team members

• Name, work email address, organisation name, and your role in the organisation's STARselect account.
• Your password, which we store only in a scrambled, one-way form (a bcrypt hash), so we cannot see it.
• Records of how the service is used, such as sign-ins, AI features used and their size, messages queued and sent, and searches run, so we can operate plan allowances, daily limits and the free trial.
• If you connect your LinkedIn or email account: the identifier of that connection, the email address of a connected mailbox, and the information needed to run the features you use (see section 5).
• Billing details. Payments are made through Stripe's secure checkout, so card numbers go to Stripe and we never see or store them. We keep your plan and billing history, and the billing details you give at checkout, such as a business tax ID.
• Anything you send us when you contact us for help.

Information you give about yourself. If you fill in About you in Settings (for example the name you sign with, your title, experience, specialisms, a short summary, key points, and a CV or LinkedIn profile you use to draft them), we use it only to write and personalise the messages, emails and job adverts you create in STARselect. It's kept with your account in your organisation's workspace and isn't shown to your colleagues, except where it appears in messages you send. When you ask STARselect to draft it for you, the text is sent to our AI provider for that purpose. You can change it, or remove the CV or profile it was drafted from, at any time in Settings.

If your organisation fills in About your agency or About your company, including from its website, those details are shared with everyone in your workspace and used in messages and job adverts they create.

About candidates (entered or imported by customers)

• Names, contact details, location, current and past employers and job titles, and links to LinkedIn profiles.
• CVs, cover letters, role descriptions and LinkedIn profile text uploaded or fetched by the customer.
• Assessments created in STARselect: rankings against a role's criteria, market map grades and notes, interview guides, interview notes and scorecards.
• Messages sent to candidates through STARselect, and the text of their replies (see section 5).
• Interview times offered and chosen on a STARselect booking page.

CVs can contain sensitive information, such as health information or information about a person's background. STARselect's AI features are instructed to ignore information that could indicate age, gender, ethnicity, nationality, religion, disability, family or carer responsibilities and other protected attributes. Customers should avoid collecting sensitive information that is not needed for the role, and must have consent where the law requires it.

From people who use a booking page

When a candidate opens an interview booking link, we record the time they choose. The page does not ask them to sign in, and we do not collect other information from it.

Automatically

• A single sign-in cookie (starselect_session) that keeps you signed in for up to 30 days. It is essential to the service.
• A few preferences stored in your own browser (for example, which notices you have dismissed). These stay on your device.
• Standard server logs, such as IP address, browser type and the time of requests, used for security and fixing faults.

STARselect does not use advertising or analytics cookies.

4. How we use personal information

• To provide STARselect: running your account, storing your records, and carrying out the tasks you ask for, such as ranking CVs, writing interview guides, building market maps, sending messages and invitations, and checking for replies.
• To operate plans, the free trial and fair-use limits.
• To keep the service secure, prevent misuse and fix problems.
• To contact you about your account, the service and changes to it.
• To comply with the law.

We do not sell personal information. We do not use candidates' information for our own purposes, including ConstructEng Australia's own recruitment business, unless the candidate has separately given it to us for that purpose.

5. Connected LinkedIn and email accounts

STARselect can connect to a customer's own LinkedIn (including LinkedIn Recruiter) and email accounts through a third-party service, Unipile. When you connect an account, you authorise STARselect to act on it for the features you use:

• LinkedIn: running the people searches you start, reading the profile details those searches return, fetching profiles you ask for, sending the messages, InMails and connection requests you queue, and checking those conversations for replies. A CV attached to a reply is saved to that person's candidate record.
• Email: sending the emails and interview invitations you queue from your own address, and checking your inbox for replies to them. To find replies, STARselect looks at the sender of emails that arrive in your inbox after a message was sent: their address, and for a reply to a LinkedIn message sent from STARselect, their name. It keeps only the text of replies from people STARselect messaged for you, and a CV attached to one of those replies, which is saved to that person's candidate record. A reply matched only by name is shown to you to confirm, and is removed if you say it's from someone else. If you turn on Watch my inbox (in Settings, for your own mailbox only), STARselect also looks at the sender address of new emails in your inbox, and keeps the text of emails from people whose address is on a candidate or client contact record in your workspace, including replies to emails you sent from another email app. A CV a candidate attaches is saved to their candidate record, and a document a client contact attaches is kept so you can view it or create a vacancy from it. Emails from anyone else are not stored. You can turn this off at any time.

You can disconnect either account at any time. On the free trial, STARselect disconnects a connected LinkedIn account when the trial ends, unless a paid plan has been chosen.

So that each LinkedIn account is used for one free trial, when a LinkedIn account is used on a free trial we keep a one-way fingerprint of it (a code worked out from LinkedIn's identifier for the account, from which the identifier can't be recovered) with the trial organisation it was used in. We keep it after the trial ends, and use it only to check whether that LinkedIn account has already had a free trial.

6. AI processing

STARselect's AI features send the relevant text (for example a CV, a role description, LinkedIn search results, or a message template) to Anthropic, the provider of the Claude AI models, to produce the result you ask for. Anthropic's commercial terms don't allow it to train its models on this content, and it deletes the content from its systems within 30 days, unless the content is flagged for breaching Anthropic's usage policy or the law requires Anthropic to keep it longer.

AI results can be wrong. They are suggestions for a person to review, and customers make their own hiring decisions.

Voice commands and dictation: when you use a microphone button in STARselect, on a reference form or on a pre-screen page, what you say is recorded in your browser a phrase at a time and sent to OpenAI's speech-to-text service to be written down. STARselect doesn't keep the recording, only the text. OpenAI processes the audio in the United States. Under OpenAI's published data controls, audio sent for transcription isn't used to train its models and isn't retained. For a voice command, the text is then sent to Anthropic, as above, to work out what you asked for.

If that service isn't available, and in STARselect's browser extension, your browser's own speech service turns what you say into text instead. That service is provided by the company that makes your browser (for example Google in Chrome, Apple in Safari or Microsoft in Edge), under its own privacy terms, and may process your voice outside Australia. STARselect receives only the text.

7. Who we disclose information to

We share personal information only with service providers that help us run STARselect, and only as needed for that purpose:

Messages you send through STARselect go to their recipients through LinkedIn or your own email provider. We may also disclose information where the law requires or allows it, for example to a court or regulator, or to protect people's safety.

8. Overseas disclosure

Some of our service providers are overseas, as listed above, so personal information may be disclosed to recipients in the United States, France, India and the other countries listed above. We take reasonable steps to ensure these providers handle personal information in a way consistent with the Australian Privacy Principles, including through our agreements with them.

9. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include storing passwords only as one-way hashes, encrypting connections to the service, and limiting each organisation's records to its own members. No system is completely secure, so please use a strong password and keep it to yourself.

If a data breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will tell affected customers promptly so they can meet their own obligations.

10. How long we keep information

We keep customer and candidate information for as long as the customer's account is open, so the customer can use it. Customers can delete candidates, roles and other records from STARselect at any time. If an account is closed, or a free trial ends without moving to a paid plan, we keep the records for 90 days so they can be restored or exported. After that we may delete them. We delete or de-identify personal information once we no longer need it, unless the law requires us to keep it longer.

Deleting your account

You can delete your STARselect account at any time in the app: go to Settings and choose Delete my account. This deletes your account straight away. A workspace that only you belong to is deleted with it, including its vacancies, candidates, interview guides and files. In a shared workspace you leave it, and your colleagues keep its records. If you can't sign in, email simon@constructeng.com.au from the address on your account and we will delete it for you.

11. Access, correction and complaints

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us (section 13). We will respond within a reasonable time, usually within 30 days. If we refuse a request, we will tell you why.

If you are a candidate, your information in STARselect is controlled by the recruiter or employer who added it. We will pass your request to them and help them respond, or respond ourselves where appropriate.

If you have a complaint about how we have handled personal information, please contact us first and we will try to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. For health information held in NSW, you may also be able to contact the NSW Information and Privacy Commission at ipc.nsw.gov.au.

12. Changes to this policy

We may update this policy as STARselect changes or the law changes. We will post the new version here with a new "last updated" date, and tell customers about significant changes by email or in the app.

13. Contact us