Privacy policy
Who we are
Sitebook operates this service. We help a tradesperson assemble an evidence portfolio for Recognition of Prior Learning (RPL). We are not a Registered Training Organisation and we do not assess anybody.
This policy explains what personal information we collect, why, who else sees it, and what you can do about it. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
- Intake: what you type about your work, and an email address at checkout.
- Portfolio: your name, contact details, employment history, licences, the referees you name and whether you said they consented to contact.
- Evidence: files you upload — photos of work, job records, licences, identity documents — plus a photo's embedded capture date and camera metadata where present.
- Payment: handled by Stripe. Card details are never sent to or stored by this system; we record only that a payment succeeded and its reference.
- Activity log: an append-only record of everything that happens to a portfolio — every read and write, including our own staff's access, and what each change meant. It keeps the content of each request you make, so that a date-stamped, attributed trail exists for the assessor. Access credentials are stripped before anything is written, and uploaded images are referenced by fingerprint rather than copied into the log a second time.
We collect this from you directly, and from your referee when they complete the confirmation you asked them for. We do not buy personal information from anyone.
What we deliberately do not collect
- The guide is instructed never to ask for tax file numbers, Medicare numbers, bank details, or third parties' licence numbers.
- Referee contact details are recorded only when you state that the referee consented.
- We do not use tracking or advertising cookies, and we do not run third-party analytics that profile you across other websites.
Why we collect it
To build your evidence portfolio and to give it to the RTO you nominate. Evidence is analysed to suggest which unit requirements it might relate to; those suggestions are never applied until you confirm them. We also use the activity log to answer questions about who did what to your portfolio, and aggregate, de-identified counts to see which parts of the product people get stuck on.
Automated processing and AI
Parts of this product are built on AI language models. Where one is in use, the text you write and — for photo analysis — the images you upload may be sent to that model provider to be processed, and come back as suggestions for you to accept or reject. No decision that affects your qualification is made by a model: the RTO's human assessor decides whether you are competent, and you decide what goes in your portfolio.
Who we disclose it to
- The RTO you nominate, when you choose to send them your portfolio. That is the point of the product, and it happens when you decide it does — not before.
- Your employer, only if you turn that on yourself (see below).
- Your referee, who is shown the specific work you asked them to confirm.
- Service providers who run the infrastructure: Vercel (hosting), Neon (database), Stripe (payments), and our AI model provider.
- Where the law requires it.
We do not sell personal information, and we do not disclose it for anyone else's marketing.
Overseas storage and processing
Our hosting, database, payment and AI providers are United States companies, and your information is stored and processed on their infrastructure, which may be located outside Australia, including in the United States. By using the service you consent to that disclosure. We take reasonable steps to work only with providers offering protections comparable to the Australian Privacy Principles, but we cannot guarantee that an overseas recipient will handle your information in a way that complies with the APPs, and Australian Privacy Principle 8.2 may therefore limit the remedies available to you.
Your employer
If you work for a company that uses this system, that company can be given access to your portfolio — only if you turn it on yourself. Being linked to a company does not give it access; neither does naming your employer in the interview. Consent is a decision you make from your own account, and:
- When it is on, your employer sees your portfolio in full — your evidence, your photos and their descriptions, your progress, and your activity log.
- You can withdraw it at any time, without asking anyone. It takes effect immediately, though it cannot undo what has already been looked at.
- Our support staff cannot turn it on for you, and cannot turn it on on your employer's behalf.
- Every time your employer looks at your portfolio, that is recorded in your activity log, which you can read.
Security
Your portfolio is reachable only with a credential issued to you, and another candidate's credential is rejected by the server rather than merely hidden by the interface. Traffic is encrypted in transit. Uploaded files are stored in the same database as the rest of your portfolio, so there is one place to secure, one thing to back up and one thing to delete. Candidate pages are excluded from search engine crawling. No system is perfectly secure, and we do not claim otherwise.
How long we keep it
We keep your portfolio for as long as your account exists, because an RPL portfolio is often built over months and an assessor may come back with questions after submission. We do not delete it automatically on a timer. You can ask us to erase it at any time, and we will, as described next.
Access, correction and erasure
You can read and correct almost everything we hold from inside the product itself: your portfolio, your evidence, your diary and your activity log are all visible to you, and you can export the portfolio as a file to keep.
If you ask us to erase your data, we delete your portfolio, your uploaded files, your access token, your activity log, your referee invitations and your employer links. What remains is a record that an erasure happened, with your identifier kept only as a one-way hash, so we can show the deletion took place without keeping the thing we deleted. Some information may survive in backups for a period before those age out, and anything you have already sent to an RTO is theirs to manage under their own policy.
Use the contact form. It reaches us directly and does not need an email address at your end. We aim to reply within five business days.
Complaints
If you think we have mishandled your personal information, tell us first — use the contact route above and we will investigate and write back. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy
If we change this policy we will change the date at the top. If a change materially affects what we do with information we already hold, we will tell you directly rather than relying on you to re-read the page.