Privacy Policy

Last updated: 24 July 2026

1. Who we are

Fern ("Fern", "we", "us") operates fernrecruitment.co.nz, a recruitment platform that helps New Zealand small businesses in high-turnover sectors receive AI-screened, ranked shortlists of job applicants.

For any privacy question or request, contact: fernrecruitmentsupport@gmail.com

2. Information we collect

From businesses using Fern:

• Account details (name, email, business name) via our sign-in provider
• Business details entered on the account/settings page
• Job role information posted to the platform
• Payment details when unlocking a role (once payment processing is live)

From job applicants:

• Information submitted through our application form, including name, contact details, CV/qualifications, and answers to role-specific questions

We only collect information that is necessary to provide the shortlisting service, in line with the Privacy Act 2020.

3. How we collect it

• Business account information is collected directly when a business signs up
• Applicant information is collected directly from applicants when they submit our application form
• We do not buy, scrape, or source applicant information from any other channel

4. How we use it

• To screen and rank applicants against a role's stated requirements
• To generate a shortlist for the hiring business
• To allow a business to review ranked candidates and, on unlocking a role, make direct contact
• To operate and improve the Fern platform

5. Automated screening and human review

Fern uses an AI-assisted process — provided by OpenAI, acting as our processor — to screen and rank applicants against the criteria a business specifies for a role. The screening reads the applicant's CV and application answers and produces a score and reasoning against the role's stated requirements. This is a tool to support the business's hiring decision — the business, not the AI, makes the final decision about who to contact and hire. Ranking and reasoning are provided to help a human reviewer make an informed choice, not to make the choice automatically. Applicant data sent for screening is not used to train third-party AI models.

We review our screening criteria to ensure they relate to genuine job requirements and do not rely on protected characteristics under the Human Rights Act 1993 (such as age, sex, disability, ethnicity, religious belief, or family status).

6. Who we share information with

We use the following service providers to operate Fern, each of which processes data on our behalf:

• Tally — collects application form submissions
• Clerk — manages account authentication
• Supabase — stores business, job, and applicant records (Postgres database) and applicant CV files (encrypted file storage)
• OpenAI — performs the automated screening of applications
• Vercel — hosts the Fern website and application
• Stripe — processes payments when a business unlocks a role

Some of these providers store or process data outside New Zealand. Where personal information is disclosed overseas, we take reasonable steps to ensure it receives comparable levels of protection, consistent with our obligations under the Privacy Act 2020.

We do not sell applicant or business data to third parties, and we do not share applicant information with any business other than the one the applicant applied to. Access to each applicant's data is restricted, at the database level, to the single business the applicant applied to.

Where an application reaches Fern through a job board (for example, SEEK), it is delivered only to the business that posted that role and that owns the hiring relationship. It is never pooled with other businesses' data, repurposed, or used for marketing.

7. How long we keep information

• Applicant information — including CV files — is automatically deleted 3 months after the role it was submitted to is closed. If a business reopens the role within that window, the applications are retained and the 3-month period restarts when the role is closed again.
• Business account information is retained for the life of the account plus 6 months after closure, unless otherwise requested, for legitimate business and legal purposes

You can also ask us to delete applicant information sooner — see "Your rights" below.

8. Your rights

Under the Privacy Act 2020, you have the right to:

• Ask what personal information we hold about you
• Ask us to correct that information if it's wrong
• Make a complaint about how we've handled your information

In addition, applicants can ask us to delete the personal information they submitted, and we will do so unless we are required to retain it (for example, where the business that received the application has a legal basis to keep it).

To exercise any of these rights, contact fernrecruitmentsupport@gmail.com. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

9. Security

We protect personal information with a layered set of controls:

• Encryption in transit: all traffic to and from Fern uses HTTPS/TLS.
• Encryption at rest: databases and CV files are encrypted at rest by our managed infrastructure providers.
• Per-business isolation: the database enforces, at the row level, that each business can only access its own roles and applicants.
• Private CV storage: CV files are held in a private store and are never publicly accessible; they are opened only through short-lived, single-use links generated for an authorised business.
• Access logging: access to applicant information — including viewing an applicant list or opening a CV — is recorded in an audit log.
• Authentication: every request for applicant data is verified against a signed-in session, and staff accounts on the services we rely on require multi-factor authentication.

10. Changes to this policy

We may update this policy from time to time. Material changes will be noted with an updated "Last updated" date above.

11. Contact

Questions about this policy: fernrecruitmentsupport@gmail.com