Privacy Policy

Version v2.3. Effective 2026-07-04. Teratek Pty Ltd (ABN 63 637 441 779).

1. Who we are

KET Studio is an AI-assisted document service operated by Teratek Pty Ltd ("Teratek", "we", "us"). Teratek is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our Privacy Officer can be contacted at ket.privacy@teratek.com.au or by post at Level 4 & 5, 15 Moore Street, Canberra ACT 2601, Australia.

2. Personal information we handle

Candidate information. When a recruitment agency or employer using KET Studio (a "tenant") uploads a candidate's documents, we process the personal information contained in those documents on the tenant's behalf: the candidate's name and contact details, work history, education and qualifications, referee details, and any narrative content in the documents. We collect this information from the tenant, not from the candidate directly. Tenants are required to give each candidate notice of this (see section 5).

Sensitive information. Candidate documents sometimes contain sensitive information as defined in section 6 of the Privacy Act, including health information, racial or ethnic origin, political opinions, religious beliefs, membership of a trade union or professional association, sexual orientation, criminal record, genetic information and biometric information. We do not ask for it and do not use it for any purpose other than producing the outputs the tenant requests. Tenants must not upload documents containing sensitive information unless the candidate has consented to that collection and to its handling for the purpose described in this policy.

Tenant user information. For each tenant user we collect their work email (UPN), given name, Microsoft Entra ID identifier, IP address and browser user agent at sign-in, and an audit log of actions taken in the workspace. The given name is taken from your organisation's Microsoft sign-in and is used only to address you by name in service and onboarding messages.

3. Why we collect, hold, use and disclose it

Candidate information is handled solely for the purpose of transforming the uploaded documents into the outputs the tenant requests (extraction, restructuring, formatting and branded document generation), and maintaining the audit records that evidence how each document was handled. Tenant user information is handled to authenticate users, secure the service, maintain audit trails, provide support, administer the subscription, and to send you setup and onboarding messages about the workspace you have been given access to. You can stop the onboarding messages at any time using the unsubscribe link in each message.

We do not use candidate content to train AI models, for marketing, or for any purpose unrelated to the tenant's document request.

4. AI processing within Australia

KET Studio's AI-driven extraction and drafting is performed using Anthropic Claude models operated by Amazon Web Services (Amazon Bedrock), invoked through the Australia geographic inference profile. This means:

• Inference requests are processed entirely within AWS's Australian regions (Sydney and Melbourne). The full request lifecycle, including any limited operational storage by AWS for abuse detection, occurs within Australia.

• Candidate and tenant information handled through the application is not disclosed to any overseas recipient in the course of this AI processing. Anthropic (the model developer) does not receive, access or store the content processed on Amazon Bedrock. (Website-visitor information collected on our public website is handled separately and may be processed overseas, as described in section 9.)

• AWS does not use the content of requests to train models and does not share it with model providers.

• Data in transit between AWS regions remains on the AWS private network, encrypted (TLS 1.3 and AWS network encryption).

This is enforced by technical controls: our AWS environment is restricted by policy to Australian-region inference only, and every inference request is logged with the region in which it was processed. These logs are retained and auditable.

AI-inferred attributes. AI models can infer characteristics from the content of a document. Our system instructions and output schema are configured so that Claude does not attempt to infer sensitive attributes from a candidate's document, and no such inferred attribute is stored or returned to the tenant.

Foreign law transparency note. AWS's Australian subsidiary is the entity that contracts with Teratek and hosts your information within Australia. The ultimate parent company of AWS is headquartered in the United States. In narrow circumstances, foreign laws such as the US CLOUD Act can compel a global provider to produce data. This does not involve any transfer by Teratek and does not alter our obligations under the Privacy Act. AWS publishes periodic transparency reports, which Teratek monitors.

5. What we require of tenants

Each tenant must: (a) give each candidate the KET Studio Candidate Collection Notice (or an approved equivalent), including any materially updated version Teratek publishes, before uploading their documents, so the candidate is aware their information will be provided to Teratek and processed using AI within Australia (APP 5); (b) only upload documents it is lawfully entitled to provide for this purpose; and (c) not upload documents containing sensitive information unless the candidate has consented to its collection and handling for the purpose described in this policy.

6. How we protect information (APP 11)

• All transmission uses TLS 1.3 encryption in transit. Data at rest is encrypted in Azure and AWS.

• Multi-factor authentication is mandatory for all tenant administrator accounts.

• Teratek maintains an information security programme aligned to ISO/IEC 27001 principles and reviews controls annually.

• We hold a Data Processing Addendum with AWS (with Australian addendum) governing the Bedrock processing.

• Application logs record only minimum metadata (token counts, success or failure indicator, internal candidate reference). Candidate narrative content is not written to application logs.

• Tenant data is isolated by partition key at the database layer. A tenant's administrators can access only that tenant's data.

• Teratek staff access data only for operational support under documented procedures, with access logged.

7. Data location and retention

All KET Studio operational data (brand packages, audit logs, tenant mappings and generated documents) is stored in Microsoft Azure (Cosmos DB and Blob Storage) in the Australia East region. AI inference occurs in AWS Australian regions as described in section 4. No candidate or tenant personal information handled through the KET Studio application is stored or processed outside Australia. Website-visitor information collected on our public website is a separate category handled as described in section 9.

When personal information is no longer needed for a permitted purpose, we destroy or de-identify it in accordance with APP 11.2.

8. Overseas disclosure statement (APP 1.4(f))

Teratek is not likely to disclose candidate or tenant personal information handled through the KET Studio application to overseas recipients. All such processing and storage occurs in Australia as described above. As set out in section 4, our AWS contracting entity is the Australian subsidiary of AWS. Any theoretical foreign-law risk sits with AWS as a global provider and does not involve any transfer by Teratek. If our application processing arrangements change, we will update this policy and re-notify tenants before any overseas disclosure occurs (see section 12). Separately, website-visitor information collected on our public website is processed by analytics, advertising and form providers that may operate overseas, as described in section 9; that overseas processing does not involve candidate or tenant application data.

9. Website analytics, cookies and online forms

This section applies to visitors to Teratek's public website (including pages built and hosted on Framer). It concerns website-visitor information only, and does not apply to candidate or tenant Personal Information handled through the KET Studio application, which is covered by sections 2 to 8.

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

We also use Google Analytics to understand website traffic and usage. Google Analytics sets first and third-party cookies and processes website-usage data, including a truncated version of your IP address and details of your interaction with the site. Google's handling of that data is described in the Google Privacy Policy.

When you submit an enquiry or sign-up form on our website, the form is collected through Framer Forms. The details you choose to provide (such as your name, email address and message) are processed so that we can respond to you and administer your request, and are held in accordance with this policy.

Overseas processing of website data. Microsoft and Google are global providers and may process website-analytics and advertising data on infrastructure located outside Australia, including in the United States. This overseas processing applies only to the website-visitor information described in this section. It does not apply to candidate or tenant Personal Information handled through the KET Studio application, which is processed and stored in Australia as described in sections 4 and 7.

Your choices. You can control or refuse cookies through your browser settings, and where required we present a cookie notice on the website. Refusing analytics cookies does not affect your access to, or use of, the KET Studio application.

10. Data breaches

Teratek complies with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we become aware of a suspected eligible data breach we will assess it promptly and within 30 days. Where we conclude that a data breach is an "eligible data breach" under Part IIIC (a breach likely to result in serious harm and not remediated in time to avoid that harm), we will notify the Office of the Australian Information Commissioner and the affected individuals as soon as practicable, in the form required by the Act. In addition, as a contractual commitment, we notify affected tenants within 72 hours of confirming a breach reasonably likely to affect their candidate data.

11. Access, correction and complaints

Candidates and tenant users may request access to, or correction of, personal information Teratek holds about them, or make a privacy complaint, by contacting our Privacy Officer at ket.privacy@teratek.com.au. We respond within 30 days. Because candidate documents are held only briefly, Teratek may hold limited information about a candidate at the time of a request. Where the tenant holds the relevant records we will coordinate with the tenant, and we verify the identity of the requester before disclosing anything. If you are dissatisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

12. Changes to this policy

This policy is versioned. The current version and effective date appear at the top. Material changes, in particular any change to where data is processed or stored, are published as a new version, and tenant administrators must review and acknowledge the new version before further candidate documents are processed.

13. Contact

Teratek Pty Ltd
Privacy Officer: ket.privacy@teratek.com.au
General enquiries: ket.studio@teratek.com.au
Postal address: Level 4 & 5, 15 Moore Street, Canberra ACT 2601, Australia