Privacy notice

Version 2026-10-07.4. Written to meet the New Zealand Privacy Act 2020. Please read it together with the terms of use.

Who runs Reroute

Reroute is a free, independent, not-for-profit project run by a volunteer to help people in New Zealand take the next step in their careers. It isn't affiliated with any employer, recruiter, job site or government agency. You can contact us at reroute.support@gmail.com.

What we collect and why

• Your Google account ID, so you can sign in and other users can't see your information. We don't store passwords. Your name and email are shown only in your own browser, and your sign-in is kept only in that browser tab, for up to an hour.
• Your CV's content, whenever you review your CV or ask for an improved version. The text of your CV is sent to Reroute, which passes it to the AI model to do what you asked. Before it's sent, email addresses and New Zealand phone numbers are taken out, in your browser and again on Reroute's server in case any slip through. Everything else, such as your name, employers, dates and achievements, is sent as you leave it, so remove anything you'd rather not share first.
  What's kept: your latest CV review, and a profile drawn from your CV: a headline, your years of experience, up to 15 skills, up to 8 achievements taken from your CV, and the sectors you've worked in. Reroute uses these for career directions, fit checks, letters and interview preparation. They're kept until a new review replaces them, you delete them, or after 90 days without a visit. The full text of your CV isn't kept once the review or improved version is done. An improved CV is kept only if you save it (see below). CV text is never written to the technical logs.
• What you're looking for: the roles, places and kind of work you'd like, when you could start and your weekly goal, plus the career directions Reroute suggests and the ones you choose to focus on. These shape your plan and suggestions. You can change them at any time.
• CVs you save (up to 5): the name you give each one, the direction it's aimed at, and its full content: headline, profile, skills, each role with its employer, dates and achievements, and education. The contact details you type into the CV builder (name, email, phone and location) are not sent to Reroute: they're kept only in this browser, and your browser adds them when it makes the Word file.
• Jobs you check or add: the job ad's text (with email addresses and New Zealand phone numbers taken out, in your browser and again on the server), plus fit checks, your answers about gaps, cover letters, CV bullet points, scam checks, interview preparation, emails (follow-up, thank-you and offer replies), application statuses, interview dates and notes, so you can track your applications and get reminders.
• Your conversations with the assistant: your messages and its replies, so you can reopen a conversation and the assistant can follow it. To answer, the assistant can look at what's already in your account: your CV review and the profile drawn from your CV, your career directions, what you're looking for and your saved jobs. Messages are sent and kept exactly as you type them (contact details are only taken out of CVs and job ads), so leave out anything you'd rather not share. You can delete any conversation.
• Job-search preferences you tell the assistant, such as the roles, industries, locations, kind of work or pay you're after, so it can give you better suggestions next time. It's set up to remember only these. It's told never to keep health, family, religion, ethnicity, immigration, money or contact details, or anything from your CV or job ads. You can see everything it remembers under "What Reroute remembers" and delete any of it.
• A record that you accepted the terms of use and this privacy notice: your Google account ID, the versions you accepted, the date and time, your IP address and your browser type. We keep it so we can show you agreed. It's stored separately and only ever added to, never changed.
• Your usage today: how many AI requests your account made today and what they cost, so the service stays fair and free for everyone. The count is deleted after 2 days and the cost after 7.
• Service totals: for each day, how many AI requests everyone made together, what they cost, which features were used, how many people used Reroute, how many times each step happened (accepting the terms, a CV review, a job check, a cover letter, applying, an interview, an offer), and how quickly and reliably Reroute answered (worked out from the technical logs, which never contain your content). We keep these to plan and fund Reroute, and only the volunteer who runs it sees them. They're totals only: they don't identify you and can't be linked back to you.
• Visits: once you've accepted this notice, a marker that someone visited Reroute that day, stored under a scrambled code made from your account ID (never the ID itself). It's only ever counted, to work out how many people use Reroute each day, week and month, and it's deleted after 35 days.
• Feedback, if you rate Reroute: your rating (1 to 5), what it's about and your comment, if you write one. It's stored without your account ID, and email addresses and New Zealand phone numbers are taken out of the comment, so it isn't linked to you. Please don't put other personal details in it. So that each person can rate once every 7 days, a marker under a scrambled code (not your account ID) is kept for that long.
• Technical logs (time, page requested, error codes, IP address) to keep the service secure and working. These never contain your CV, job ads or chat messages, and your account ID appears only in scrambled (hashed) form.

Where it's stored and who processes it

Everything we store about you is held on Amazon Web Services (AWS) in Australia (Sydney): your reviews, saved jobs, conversations, remembered preferences, acceptance record and the service's technical logs. Web traffic passes through Amazon CloudFront and the AWS web application firewall, which protect the service from attacks. If the firewall blocks a request, it keeps that request's technical details (time, page, IP address), not your CV, job text, messages or sign-in token, in the AWS US East region for 90 days.

Your CV text, job ads and messages are processed by Anthropic's Claude AI model through Amazon Bedrock in Australia, which may handle a request in Sydney or Melbourne, and checked by an AWS safety filter. AWS does not use your content to train AI models, and model prompt logging is turned off.

Only the volunteer who runs Reroute can access the AWS account where your information is stored. They use that access only to keep the service running, fix problems and keep it secure, and never to read or use your content for anything else. The admin dashboard they use shows only service totals and anonymous feedback, never anyone's CV, jobs or messages.

Reroute never visits job sites or other websites for you: to check a job, you paste or upload the ad. Sign-in uses Google.

How long we keep it

• Everything in your account (your review, what you're looking for, career directions, saved CVs, saved jobs, letters, emails, notes, conversations and remembered preferences) is deleted automatically after 90 days without a visit. Each visit starts the count again. You can also delete it straight away with "Delete all my data".
• Assistant messages are deleted 90 days after they were sent, even if you keep using Reroute, or earlier if you delete the conversation.
• Each chat request (your message, its progress and the reply) is deleted after 24 hours; the conversation itself is kept as described above.
• Technical logs: deleted after 90 days.
• Service totals and anonymous feedback: kept indefinitely, with backups. Neither is linked to your account.
• Visit markers: deleted after 35 days. Feedback markers: deleted after 7 days.
• Your acceptance record: kept for 365 days from when you accepted, then deleted automatically. It's kept even if you use "Delete all my data", because we need to be able to show that you agreed to the terms.

Automatic deletion can take up to a couple of days after these times (that's how the database's expiry works), but expired information is never shown or used in the meantime. Only the service totals and anonymous feedback are backed up; nothing linked to your account is.

What we never do

• Sell your information, or share or give it to anyone else, such as recruiters, employers or advertisers. (AWS and Google only process it to run the service, as described above.)
• Use it for advertising or marketing, or to train AI models.
• Show your information to other users. Each account can only ever see its own information, and the assistant only ever works with yours.
• Apply for jobs, send emails or contact anyone on your behalf.

Your rights: see, correct and delete your information

Under the Privacy Act you can ask to see the personal information we hold about you, and ask us to correct it. You can do most of this yourself, at any time, from the account menu (your name, at the top right of the app):

• See it: "Download my data" saves everything stored in your account to a file, including your conversations, what the assistant remembers and your acceptance records. (Technical logs, today's usage counts and visit markers aren't included, and anonymous feedback can't be found by account to include.)
• Correct it: run a new CV review, change what you're looking for, edit or delete a saved CV or a job, or delete anything the assistant remembers.
• Delete it: "Delete all my data" deletes everything in your account straight away, including what the assistant remembers. A few things stay for a set time: your acceptance record (see above), today's usage counts (so the daily limit can't be reset; gone within 7 days), visit and feedback markers under scrambled codes (gone within 35 and 7 days) and technical logs (gone within 90 days; they never contain your content). Ratings you've sent stay, because they aren't linked to you.

You can also email us at reroute.support@gmail.com. If you're unhappy with how we've handled your information, you can complain to the Office of the Privacy Commissioner.

AI limitations

AI suggestions can be wrong or incomplete, and the assistant can misunderstand you. Always check reviews, letters and emails before using them. Fit scores and scam checks are a guide, not a guarantee.

Changes to this notice

If we change what we collect, why, where or for how long, we'll update the version above and ask you to accept the new notice before you carry on.

Contact

Questions about your privacy: reroute.support@gmail.com