This Privacy Policy explains how Wavely Pty Ltd (“we”, “us”, “our”, “Jarli”) collects, holds, uses, discloses and protects your personal information when you use the Jarli app and website (together, the “Service”). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we handle your personal information in accordance with them. Please read this policy together with our Terms of Service.
Wavely Pty Ltd is an Australian registered company and the entity responsible for the Service. For any privacy question, request or complaint, contact our Privacy Officer at privacy@jarli.au (or hello@jarli.au). Our contact details are in section 20.
This policy applies to personal information we handle about users of the Service, visitors to our website, and people who contact us. It does not apply to third-party services we link to, which have their own privacy policies.
Under APP 2, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us — except where it is impracticable for us to deal with you that way, or the law requires or authorises us to deal with identified individuals. You can browse our public website and begin an onboarding conversation with Jarli as a guest without creating an account. To save a plan, sync across devices, or manage a subscription, you will need an account, which requires an email address and a sign-in identifier.
The kinds of personal information we collect depend on how you use the Service. They include:
| Category | Examples |
|---|---|
| Account & identity | Your email address and a unique sign-in identifier
(oid) issued by Microsoft Entra External ID, our identity
provider; a display name or greeting name you choose. |
| Career profile | Your work situation, employment history, skills, goals, timeframe, visa/right-to-work context you volunteer, and preferences — whatever you choose to share while building your profile with Jarli. |
| Sensitive information (wellbeing-adjacent) | Because Jarli supports people through career change — including stressful situations such as redundancy — your conversations may reveal information about your emotional state, wellbeing, financial pressure, or health. Under the Privacy Act some of this may be “sensitive information”. We collect it only with your consent (see section 5) and only to respond to you supportively and appropriately. We do not ask for, and ask that you do not share, information such as your racial or ethnic origin, political or religious beliefs, sexual orientation, or criminal record, as Jarli does not need it. |
| Conversation content | The messages you exchange with Jarli, and the profile, plans, milestones and weekly activities generated for and with you. |
| Subscription & billing | If you purchase a paid subscription (on the Jarli web app — the mobile apps do not sell subscriptions in-app), your payment is processed by our payments provider, Paddle, who acts as merchant of record. Paddle collects your payment details and billing information directly; we do not receive or store your full card number. We receive limited billing metadata (for example subscription status, plan, country, and the last four digits or card type) to manage your entitlements. See sections 8 and our Terms. |
| Technical & diagnostic | App and website error diagnostics, device and operating-system type, app version, approximate region, and basic technical logs used to keep the Service reliable and secure. These are configured to avoid capturing message content or directly identifying you. |
| Correspondence | Information you provide when you contact us for support or make a request or complaint. |
We do not use third-party advertising trackers, we do not sell your personal information, and we do not use your conversations to train third-party AI models for their own general-purpose use (see section 8).
We collect personal information (APP 3 and APP 5):
Where it is reasonable and practicable, we collect personal information directly from you. If we receive personal information we did not solicit, we will deal with it as required by the APPs.
We collect and use your personal information to:
Consent for sensitive information. We collect sensitive information only where you consent and it is reasonably necessary for the supportive purpose above. By choosing to share wellbeing-adjacent information with Jarli in the course of your conversations, you consent to us collecting and handling it for these purposes. You can withdraw your consent at any time by deleting your account (section 13) or contacting us; withdrawing consent does not affect handling that has already occurred.
Jarli is an AI-assisted service. To provide it, we use artificial-intelligence models to process your personal information and to make or substantially support decisions, without a human reviewing each one. We believe in being transparent about this, consistent with the automated decision-making transparency requirements being introduced into the Privacy Act.
Your career profile, conversation content, wellbeing-adjacent information you share, your stated goals and constraints, and your responses to and progress through activities.
These decisions are guidance and support only. They are general in nature, are not legal, financial, medical, employment or migration decisions, and do not by themselves determine your legal rights or entitlements. AI output can be inaccurate, incomplete or out of date, so you should use your own judgement (see our Terms). If you would like a person at Wavely to review how Jarli has handled your information or a plan it produced, contact privacy@jarli.au and a member of our team will help.
We may send you service-related messages (for example account, security, billing or important change notices), which are not marketing and which you cannot opt out of while you hold an account. We will only send you marketing or promotional messages where you have consented or where the law otherwise permits, and every such message will include a simple way to opt out (APP 7). You can also opt out at any time by contacting us. We do not disclose your personal information to third parties for their own direct-marketing purposes.
We disclose personal information only to service providers that help us run Jarli, under contractual obligations to protect it and use it only for the purposes we specify. Our key providers (sub-processors) are:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic (Claude) | Our primary AI provider. The models that power Jarli’s conversations, plans and activities. Your conversation content is processed to generate responses. Under our terms with Anthropic, your content is not used to train their models for general use. | Overseas (United States) |
| OpenAI | Our fallback AI provider. If our primary provider is temporarily unavailable, we automatically route your request to OpenAI so you still get a reply. The same conversation content is processed to generate the response. Under our terms with OpenAI, your content is not used to train their models. | Overseas (United States) |
| Microsoft Azure | Cloud hosting, database and sign-in (Microsoft Entra External ID). | Australia (Australia East) |
| Paddle | Payments and subscription management as merchant of record. Paddle collects and processes your payment and billing information directly. | Overseas (United Kingdom / European Union / United States) |
| Sentry | Error diagnostics (configured to avoid message content or directly identifying information). | Overseas (European Union) |
We may also disclose personal information: where you have consented; where required or authorised by law, a court/tribunal, or a regulator; to protect the safety of you or others; or in connection with a sale, merger or restructure of our business, in which case the recipient will be bound to handle it consistently with this policy. We keep the list of providers in this policy current and, where appropriate, will take reasonable steps to notify you of a material change to the providers who handle your personal information. This list may change as our Service evolves.
Some of our providers process personal information outside Australia — our AI providers (Anthropic and, as a fallback, OpenAI) in the United States, our payments provider (Paddle) in the United Kingdom, European Union and United States, and our diagnostics provider (Sentry) in the European Union. By using Jarli you acknowledge that your information — including conversation content and, where relevant, sensitive information — may be disclosed to and processed by these providers overseas. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, including through contractual data-protection commitments. Where we rely on your consent for an overseas disclosure, APP 8.1 accountability may not apply to that disclosure.
We do not use government-related identifiers (such as a tax file number, Medicare number, or driver-licence number) as our own identifier of you, and we do not ask you to provide them. Any such number you happen to mention in conversation is treated as ordinary content and is not used to identify you.
We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date, complete and relevant (APP 10). Much of your profile is information you provide and can update yourself in the app. If you believe information we hold is inaccurate, please tell us (see section 14).
We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure (APP 11), including: encryption in transit (HTTPS); secure credential storage on your device; verified authentication; access controls and least-privilege on our systems; and hosting with a reputable cloud provider in Australia. No method of transmission or storage is completely secure, but we work to protect your information and to review our safeguards.
Notifiable Data Breaches. We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we experience a data breach that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable after we become aware of it, as required by law, and take steps to contain and remediate the breach.
We keep your personal information only for as long as we need it for the purposes described in this policy, or as required by law, after which we destroy or de-identify it. In general, we retain your account and profile information while your account is active, and for a limited period afterwards to handle any wind-down, dispute or legal-hold requirements; we retain billing records for as long as tax and accounting law requires; and diagnostic logs for a short period only.
You can delete your account at any time in the app (Profile → Delete account), by emailing hello@jarli.au, or — without installing the app — via our account-deletion page. When you delete your account we remove your account identifiers, your email address, and the link between you and your conversation history. We action deletion requests promptly and within 30 days.
For safety, quality, security and integrity reasons, some conversation records are retained in de-identified (pseudonymised) form — they are no longer linked to you and cannot reasonably be used to identify you. These de-identified records may be retained indefinitely and used to maintain and improve the Service. If you cancel a paid subscription but keep your account, we retain limited billing records for as long as required for tax, accounting and legal purposes.
You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 12 and APP 13). Much of your information is available to you directly in the app. To make a request, contact privacy@jarli.au. We will respond within a reasonable time (generally within 30 days). We may need to verify your identity first. Access is usually free; if a request is complex we may charge a reasonable cost-based fee and will tell you before proceeding. If we refuse access or correction, we will explain why and how you can complain.
Our website and app use a small number of cookies and similar technologies that are necessary to keep you signed in, remember your preferences, and keep the Service secure and working. We may use privacy-respecting, aggregated analytics to understand how the Service is used and to improve it; where we do, it is configured to avoid identifying you individually. We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, though some features may not work without the necessary ones. Because we do not track you across other websites, our website does not currently respond to browser “Do Not Track” or Global Privacy Control signals.
Jarli is intended for adults. It is not directed at, and is not intended for, people under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us and we will take reasonable steps to delete it.
Jarli may point you to third-party websites, resources and learning materials that we do not control. This policy does not cover those third parties; their handling of your information is governed by their own privacy policies, which we encourage you to review.
If you have a concern about how we have handled your personal information, please contact our Privacy Officer at privacy@jarli.au. We will acknowledge your complaint, investigate it, and aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, by phone on 1300 363 992, or in writing to GPO Box 5218, Sydney NSW 2001.
We may update this policy from time to time to reflect changes to the Service, our practices, or the law. We will post the updated version here and change the “Last updated” date above, and where the changes are significant we will take reasonable steps to bring them to your attention. Your continued use of the Service after an update means you accept the updated policy.
Privacy Officer, Wavely Pty Ltd (ABN 45 626 415 914)
Email: privacy@jarli.au /
hello@jarli.au