Privacy Policy

Last updated: 24 September 2026 (version 2.2)

This Privacy Policy explains how Floats handles personal information across our website at https://floats.ai and the Floats application. It describes what we collect, why, who we share it with, where it is held, how long we keep it, and how you can access it, correct it, or complain.

Who we are

Floats is operated by SOLA SYSTEM PTY LTD (ABN 55 689 449 830), trading as Floats, based in Victoria, Australia.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and this document is our privacy policy for the purposes of APP 1. Where we process personal information about people in the United Kingdom or the European Economic Area on behalf of our customers, we also comply with the UK GDPR and the EU GDPR as a processor under a Data Processing Agreement with those customers.

Our Data Protection Contact is Scott Anderson. For any privacy matter, including access, correction, deletion and complaints, email [email protected].

Two kinds of personal information

Floats is a recruitment platform that turns CVs and job advertisements into candidate presentations (which we call floats) and outreach. That means we handle personal information in two different roles.

• Information about you as a visitor, customer or account user. We decide how this information is handled, and this policy applies to it in full.
• Information about candidates and contacts uploaded by our customers. Recruiters and hiring teams using Floats upload CVs, candidate details and hiring-manager contacts. The customer who uploaded that information decides how it is used and how long it is kept, and we handle it only on their instructions. If you are a candidate or a hiring contact, the recruiter who holds your details is the right first point of contact. If you contact us directly, we will identify the relevant customer and forward your request to them within 5 business days.

Information we collect

Account and website information. When you register for an account we ask for your name, company name, address, email address and telephone number. If you contact us we receive the details you provide, such as your name, email address, phone number, the content of your message and any attachments. When you use the application we record activity such as logins, features used and the content you create, and we collect billing details through our payment provider.

Candidate and contact information uploaded by customers. This may include names, contact details, current and previous employment, education, skills, CV files, photos and portfolio files, and the content of floats and outreach messages. It may incidentally include sensitive information (such as nationality or visa status) where a candidate has included it in their CV. We do not seek this information and do not use it for any purpose beyond presenting the CV as instructed by the customer.

Engagement information. When a float or submission is opened by a recipient, we record open events, viewing duration, clicks and replies, timestamps, the recipient's IP address and the approximate location derived from it. This lets recruiters see whether their presentations have been viewed and lets us filter out automated scanners.

Google user data. If you connect the optional Gmail integration, we receive the limited data described in the Google API Services and Gmail Integration section below. That data is handled only as described in that section.

How we collect it

We collect account and website information directly from you. We collect candidate and contact information from our customers, who upload it or import it from their applicant tracking system, email or CSV files. We collect engagement information automatically when a float or submission is opened. We do not buy personal information from data brokers.

How we use it

We use personal information to:

• Provide, operate, maintain and secure the website and application
• Generate candidate presentations and outreach from CVs and job advertisements, on our customers' instructions
• Improve and expand the service and develop new features
• Communicate with you about your account, support requests and service updates
• Send marketing and promotional material, where you have opted in
• Bill for the service
• Detect and prevent fraud, abuse and security incidents
• Comply with legal obligations

We will not use personal information for other purposes unless we have your consent or are otherwise permitted or required to do so under the Privacy Act, for example for specified law enforcement or public health and safety reasons.

AI processing. To produce candidate presentations, CVs and job advertisements are processed by third-party artificial intelligence services under contracts that prohibit the provider from using the data to train its models. The output is reviewed and edited by the recruiter before it is sent. Floats does not make automated decisions about candidates that have legal or similarly significant effects; all hiring decisions are made by our customers.

These purposes describe how we handle account, website and candidate information generally. Data obtained through the Gmail integration (Google user data) is not used for these general purposes. It is used only as described in the following section.

Who we share it with

We do not sell personal information. We share it only with:

• Recipients you choose. When a recruiter sends a float or submission, the candidate's presentation goes to the hiring contact they selected.
• Service providers that help us run Floats. These are listed, with their locations and roles, on our sub-processor page at https://floats.ai/sub-processors. Each is bound by contract to handle personal information only for the purpose of providing its service to us.
• Integrations you connect. If you connect Gmail, Microsoft 365 or an applicant tracking system, data flows to and from that service under its own privacy policy and on your instruction.
• Authorities and advisers where required. We may disclose personal information where the law requires it or to establish, exercise or defend legal claims.

Overseas disclosure

Our primary infrastructure, including the application database, file storage and backups, is hosted in Australia (AWS, Sydney). Some of the service providers listed on our sub-processor page are located outside Australia, and we are likely to disclose personal information to recipients in the following countries:

• United States: AI processing of CVs and job advertisements, transactional email delivery, error monitoring and web hosting
• Israel, with servers in the United States: image storage for candidate photos and company logos
• European Economic Area: monitoring of AI processing quality
• United Kingdom: real-time notifications within the application
• Canada, with servers in the United States: applicant tracking system integrations, where a customer has connected one

Before disclosing personal information overseas we take steps to ensure the recipient handles it in line with the APPs, including contractual data protection terms, certification under the EU-US Data Privacy Framework and its UK Extension where available, and the standard contractual clauses used for UK and European data. Details for each provider are in our Data Processing Agreement, which is available to customers on request.

Data security

We apply a range of measures designed to protect personal information and other data in our care, including the Google user data described above, against unauthorised access, disclosure, alteration or destruction.

• Encryption in transit. All data exchanged between you, the Floats application and the third-party services we integrate with (including Google) is encrypted in transit using industry-standard TLS/HTTPS.
• Encryption at rest. Our application database, file storage and backups are encrypted at rest, as are the OAuth tokens issued for the Gmail integration.
• Access controls. Access to personal information is restricted to authorised Floats personnel who require it to operate, support or troubleshoot the service, following the principle of least privilege. Each customer's account data is isolated to that account and is not shared with any other account or user. Floats staff access account data only to provide support or troubleshoot issues.

While no method of transmission or storage is completely secure, we continually review our safeguards and work to protect your data using commercially reasonable measures. If you have questions about our security practices, contact [email protected].

Data breaches

Floats is subject to the Notifiable Data Breaches scheme under the Privacy Act. If a data breach is likely to result in serious harm to individuals, we will notify the Office of the Australian Information Commissioner and the affected individuals as the scheme requires. We also notify affected customers within 48 hours of becoming aware of a breach involving their data, under our Data Processing Agreement, so that they can meet their own obligations.

Retention and deletion

Candidate and contact information is kept for as long as the customer's account is active, or until the customer deletes it. We do not apply an automatic expiry: the customer, as the party responsible for that information, sets the retention period. Customers can delete records at any time in the application or through our API, and deletion takes effect immediately and permanently.

Account information is kept while your account is active. When a subscription ends, data remains available for export for 30 days and is then deleted from our live systems within a further 30 days. Billing records we are legally required to keep are retained for the period required by law.

Backups are held for disaster recovery only, are never used to restore individual records, and are erased on a rolling schedule. No copy of deleted data remains in our backups after 12 months.

Requesting deletion. You can ask us to delete your personal information at any time by emailing [email protected]. This includes any OAuth tokens or other data associated with the Gmail integration. We acknowledge requests within 2 business days and complete them within one month, and in practice within 10 business days. If your information was uploaded by one of our customers, we will forward your request to that customer within 5 business days, since they are responsible for deciding it. Our full process is set out in our Data Deletion Policy, available to customers on request.

Log files and engagement tracking

Like most websites, Floats records standard server logs, which include IP address, browser type, date and time, and pages visited. We use these to secure and administer the site and to understand how it is used.

Floats and submissions sent by recruiters contain a tracking element. When a recipient opens one, we record the open, viewing duration, clicks and replies, and the recipient's IP address and approximate location, and show this to the recruiter who sent it. We process this information on the recruiter's behalf, as their processor. Open, click and duration events are kept with the float or submission until the recruiter deletes it; the request logs containing the IP address and location are deleted after 90 days.

Cookies and similar technologies

Cookies are small files stored on your device. We use two kinds.

Strictly necessary cookies make the website and application work: for example, keeping you signed in to the application and remembering your cookie choices on our website. These do not need your consent and cannot be turned off.

Optional cookies help us understand how our website is used and measure our marketing. On our website we set these only if you agree to them, and you can accept or reject each category when you first visit. Until you choose, we ask Google's tools to run without analytics or advertising cookies.

We use advertising cookies only to measure the results of our own advertising. We do not allow third parties to serve advertising on our website, and we do not sell personal information.

Changing your choices. You can change or withdraw your consent at any time through the Cookie settings link in our website footer. When you withdraw consent, we delete the optional cookies we can reach. You can also block or delete cookies through your browser settings, although parts of the application will not work without strictly necessary cookies.

Access and correction

You may ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Email [email protected]. We will respond within 30 days. There is no charge for making a request or for correction; if compiling access to a large volume of information involves significant cost, we may charge a reasonable fee that is not excessive, and we will tell you before proceeding. If we refuse a request we will tell you why and how you can complain.

If your information was uploaded by one of our customers, they are responsible for responding to access and correction requests about it. Contact the recruiter directly, or contact us and we will forward your request to them within 5 business days. Account users can view and update their own details in the application at any time.

Your rights under UK and EU law

If you are in the United Kingdom or the European Economic Area, you have the following rights under the UK GDPR and the EU GDPR:

• The right to access the personal data we hold about you
• The right to rectification of inaccurate or incomplete data
• The right to erasure, under certain conditions
• The right to restrict processing, under certain conditions
• The right to object to processing, under certain conditions
• The right to data portability, to receive your data or have it sent to another organisation
• The right to withdraw consent where processing is based on consent
• The right to complain to the Information Commissioner's Office (UK) or your local supervisory authority

Where Floats is the controller of your data (as a website visitor, customer or account user), contact us at [email protected] and we will respond within one month. Where your data was uploaded by one of our customers, that customer is the controller and we act as their processor; we will forward your request to them within 5 business days and assist them in responding. Transfers of UK and EU personal data to Floats in Australia are made under the EU standard contractual clauses and the UK International Data Transfer Addendum, and a transfer risk assessment is available to customers on request.

Other jurisdictions

If you are in a jurisdiction that grants privacy rights not described above, contact us at [email protected] and we will respond in line with the law that applies to you.

Marketing communications

We send marketing and promotional email only where you have opted in. Every marketing email includes an unsubscribe link, and you can opt out at any time by using it or by emailing [email protected]. Opting out of marketing does not affect service and account emails, such as billing notices and security alerts. We do not use candidate or contact information uploaded by customers for our own marketing.

Complaints

If you believe we have handled your personal information in a way that breaches the Australian Privacy Principles, the UK GDPR or the EU GDPR, or that is otherwise inconsistent with this policy, please email [email protected] with a description of your concern. We will acknowledge your complaint within 2 business days, investigate it, and respond with our findings and any action we propose within 30 days. If the matter is complex we will tell you and keep you informed of progress.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992. If you are in the United Kingdom, you can also complain to the Information Commissioner's Office at ico.org.uk. If you are in the European Economic Area, you can complain to the supervisory authority in your country.

Children's information

Floats does not knowingly collect personal information from people under the age of 18. If you believe a child has provided personal information to us through our website or application, contact us at [email protected] and we will remove it promptly.

Changes to this policy

We review this policy at least annually and whenever our services, service providers or the law change materially. We will post the updated policy on this page with a new date and version number, and notify account holders by email of significant changes.