1. Who we are
CareersNote is made by WorkX Limited, 21b Cornwall Road, Lyttelton, Christchurch 8082, New Zealand. We comply with the New Zealand Privacy Act 2020. When an adviser adds student information to CareersNote, we hold it on behalf of their school, which remains responsible for it. When a practice uses CareersNote, we hold its clients' information on the practice's behalf in the same way.
2. What we collect
- Adviser accounts: name, school email, school, role and country, and how you signed up.
- Students or clients (added by the adviser or practitioner, from a spreadsheet, or through the school's KAMAR connection): first, last and preferred name, student ID or NSN (optional), year level, form class and student email; optionally subjects or classes and credits this year.
- Parents and caregivers: up to two per student, with name, email and relationship.
- Staff contacts: names, emails, roles and form classes of the people advisers send summaries to or refer students to.
- Conversations: the transcript (for a short time, see section 9), draft and approved summaries, next steps, and who a summary was sent to and when.
- Billing: the school's billing contact, invoices and payments.
- Usage: recorded minutes and basic activity, to run CareersNote and keep it secure.
3. What we never collect
We never ask for students' dates of birth, addresses, ethnicity, health information or photos. Students, parents and family don't have CareersNote accounts.
4. How we use it
Only to provide CareersNote: to transcribe conversations, write draft summaries, send what advisers choose to send, run your account and billing, support you, keep the service secure, and meet legal obligations. We don't sell or rent personal information, and we don't share it with advertisers.
5. Conversations and AI
Every recording starts only after the adviser confirms the student agreed. The audio is streamed straight to Amazon Transcribe in Sydney, Australia, and isn't stored. If live transcription is interrupted, the recording is uploaded once to secure storage in Sydney, transcribed, and deleted as soon as the transcript is made. Student and parent names are replaced with placeholders before the transcript is sent to the AI model (Anthropic's Claude, through Amazon Bedrock) that writes the draft summary, and this runs only in Australia. The AI never sees the real names, and the transcript is deleted when the adviser approves or discards the summary, and always within 8 days. Conversations are never used to train AI models: Amazon Bedrock doesn't use customer content for training, and our AWS account has opted out of AI service data use. An adviser checks and approves every summary before anything is sent.
6. Where it's stored and who processes it
- Supabase: database, Sydney, Australia
- Vercel: application servers, Sydney, Australia
- Amazon Web Services: transcription, AI summaries and short-term audio storage when needed, Sydney and Melbourne, Australia
- Cloudflare R2: encrypted nightly backups, Oceania, kept for 30 days
- GitHub: runs our nightly backup job before the backup is encrypted (United States)
- Resend: sends the emails advisers choose to send, including summaries (servers in Japan; Resend is a US company)
- Sentry: error monitoring, United States, with personal data collection turned off
- Xero and Stripe: invoices and card payments (billing contact details only, never student information)
- Google: only if you choose to sign in with Google (your sign-in details only)
Where a provider processes information outside New Zealand, we make sure comparable privacy protections are in place, as the Privacy Act requires.
7. KAMAR connection
New Zealand schools can connect KAMAR so student details stay up to date. Only the fields listed on our Getting your students in page are sent. The school is responsible for having the right to share this information, and can disconnect at any time in Settings.
8. Security
Information is encrypted in transit (HTTPS/TLS) and at rest. Passwords are stored as salted hashes, never in plain text. Access is limited to the advisers at each school, and server-side logs support security monitoring. If a data breach affects your information, we'll notify you within 72 hours and act immediately to fix it.
9. How long we keep it
- Audio: not stored when transcribed live. If it has to be uploaded, it's deleted as soon as the transcript is made.
- Transcripts: deleted when the summary is approved or discarded, and always within 8 days.
- Draft summaries: kept until the adviser approves or discards them.
- Approved summaries, next steps and student details: kept while the school uses CareersNote, until an adviser deletes them.
- Schools with no plan and no sign-in or recording for 12 months: deleted, after an email a month before.
- When a school deletes its account: deleted straight away, and removed from encrypted backups within 30 days.
- Invoices: kept as required for financial records.
10. Your rights
Under the Privacy Act 2020 you can ask to see the personal information we hold about you and ask us to correct it. Students, parents and family can ask their careers adviser, or email us. We may need to confirm who you are, and we'll reply within 20 working days. If you're not happy with our response, you can contact the Office of the Privacy Commissioner at privacy.org.nz.
11. Changes to this policy
We may update this policy. We'll email advisers about significant changes, and the current version is always at careersnote.com/privacy-policy.
12. Contact us
Privacy officer: Dan Russell, WorkX Limited, 21b Cornwall Road, Lyttelton, Christchurch 8082, New Zealand · support@careersnote.com