Privacy, cookies & legal policies

Privacy notice

Controller: Nullify Holdings Pty Ltd (ABN 18 664 463 950). Operating entity: Evalify Pty Ltd (ABN 32 664 474 980). References to “Nullify”, “we”, “us”, and “our” cover the Nullify service and website operated by these entities in their stated roles.

Nullify acts as a controller for website visitors, prospects, applicants, and platform-account administration. When we process customer repositories, infrastructure, findings, and related user mappings to provide the contracted security service, we generally act as a processor on the customer’s instructions.

What we process and why

We collect only the personal information reasonably needed for the purposes below. The applicable legal basis depends on the relationship and jurisdiction.

We do not sell personal information. We do not use personal information for solely automated decisions that produce legal or similarly significant effects about an individual.

Cookies and optional website technologies

Essential code runs to serve the website, prevent abuse, and remember your privacy choice. Analytics and marketing technologies are on by default when you visit, and a notice on your first visit tells you so. You can opt out at any time.

For visitors in the European Economic Area, the United Kingdom, and Switzerland, identified from the browser’s time zone setting, analytics and marketing technologies stay off unless you consent.

Browser settings can also restrict storage, but using our Cookie settings control is the clearest way to express a site-specific choice. Opting out or withdrawing consent does not affect processing that occurred lawfully before withdrawal.

Applicant privacy

When you apply for a role, we use your application information only to assess and administer recruitment, communicate with you, prevent fraud, and meet legal obligations. We do not send résumé content, filenames, form values, or interview notes to advertising or visitor-identification tools.

Application information is retained for the hiring process and any legally required period. We retain information for unrelated future roles only when there is a valid basis and appropriate notice or consent. You may request access, correction, or deletion using the contact details below, subject to legal exceptions.

Recipients and international transfers

We may share personal information with personnel and service providers that need it to operate the service, including hosting, identity, communications, customer-support, recruitment, professional-advisory, and website analytics and marketing providers unless you have opted out (in the EEA, UK, and Switzerland, only where you consent). We may also disclose information when required by law, to protect rights and security, or as part of a legitimate corporate transaction.

Nullify is based in Australia and uses providers in Australia, the United States, the European Economic Area, and other locations. Where GDPR-restricted data is transferred outside the EEA, UK, or Switzerland, we use an available lawful mechanism such as an adequacy decision or Standard Contractual Clauses and supplementary technical or organizational safeguards. You may request information about applicable safeguards.

Retention and security

• Identity and contact data: for the account or business relationship and up to two years afterward where needed for reactivation, records, disputes, or legal obligations.
• Technical and usage data: for the period required for security, incident investigation, consent records, and configured measurement—generally no longer than two years unless a shorter vendor or consent period applies.
• Profile data: for the account and ordinarily deleted within 90 days after account closure, subject to legal exceptions.
• Customer source code: accessed for authorized security work and handled according to the customer agreement and data-processing terms; scan results follow the contracted retention schedule.
• Applications: for the recruitment process and any legally necessary period, with longer talent-pool use only under an appropriate basis.

We use administrative, technical, and physical safeguards designed to protect information, including access control, encryption in transit and at rest where applicable, logging, minimization, and deletion or anonymization processes. No internet service can guarantee absolute security.

Your privacy rights

Depending on your location, you may have rights to access, correct, delete, restrict, or port personal information; object to certain processing; withdraw consent; and complain to a supervisory authority. EEA, UK, and Swiss requests are ordinarily free. A reasonable fee or refusal may apply only where permitted for manifestly unfounded or excessive requests.

We acknowledge requests promptly and ordinarily respond within one month under GDPR, subject to permitted extensions and identity verification. California and other US residents may also have rights to know, correct, delete, opt out, and receive equal service. Nullify does not sell personal information. We may share information about your visits to our website with advertising partners such as LinkedIn for cross-context behavioral advertising, which means showing you ads based on your activity across different websites. You can opt out of this sharing, and of analytics and marketing technologies generally, at any time using the opt-out controls on this page or by turning on Global Privacy Control in your browser.

Product agreements and supporting documents

The contract governing a customer’s use of Nullify may include an order form, enterprise agreement, data-processing agreement, and service-specific terms. Contact us for the documents applicable to your organization.

• Download the current published EULA.
• Request a Data Processing Agreement or subprocessors information.

Contact and complaints

Email support@nullify.ai for privacy questions and data-subject requests.

Complaints about how we handle personal information are handled by emailing support@nullify.ai.