Distil

Privacy Policy

Last updated: 3 June 2026 · Version 1

This policy explains how Curiosum Limited (NZBN 9429037423292) ("we", "us") handles personal information when you use Distil, in line with the Privacy Act 2020. Our Privacy Officer can be reached at hello@curiosum.ai.

1. What we collect

  • Your account email address.
  • Your name and mobile phone number (for account and service updates; marketing only if you opt in).
  • The content of the master CV you upload.
  • The job descriptions and notes you submit.
  • The CV and cover letter documents we generate for you.
  • Usage and diagnostic data (event timestamps, sizes, error codes, request logs).

We don't collect payment information during beta.

2. Why we use it

We use your information to provide and improve the tailoring service: parsing your CV, generating tailored documents, delivering them, and keeping the Service reliable and secure. We use your mobile number for account and service updates, and — only if you tick the marketing opt-in — occasional product updates; you can opt out anytime in Settings.

3. Who we share it with, and overseas processing

To tailor your documents, we share your CV and job-description content with third-party AI processing services, some of which are located overseas (including outside New Zealand). We also use a cloud hosting provider to store your data and an email provider to send sign-in links and notifications. We share only what's needed to perform these functions and take reasonable steps to ensure your information is protected, consistent with the Privacy Act 2020 (including IPP 12 on overseas disclosure). Before your CV is sent for processing, we remove your name, email address, and phone number so they are not included in the content shared with the AI provider, and restore them into your generated documents on our servers afterward.

4. How long we keep it

  • Generated CV and cover-letter files are deleted around 60 days after they're produced.
  • Application records (job description, generated content) are kept up to about 1 year.
  • If you delete your account, we remove your personal information, though some de-identified diagnostic logs may remain.

5. How we protect it

Access controls, encryption in transit, and private file storage accessed only via short-lived signed links.

6. Your rights

Under the Privacy Act 2020 you can ask to access or correct your personal information, and you can delete your account and its data. Contact our Privacy Officer to make a request.

7. Children

Distil isn't intended for anyone under 16.

8. Cookies and sessions

We use only the cookies needed to keep you signed in. We don't use third-party advertising trackers.

9. Changes

We may update this policy. Material changes will prompt you to agree again before continuing.

10. Complaints

If you have a concern, contact our Privacy Officer first. You also have the right to complain to the Office of the Privacy Commissioner (privacy.org.nz).