Privacy Policy

Mint Nimbus Pty Ltd ATF G&G Anderson Family Trust (ABN 21 527 913 094) trading as TryPenguin

Effective date: 23 March 2026 | Last updated: 27 March 2026

1. Who We Are

TryPenguin provides AI-powered CV and interview coaching for university graduates. Our service reviews your CV and produces personalised coaching documents including a CV Revision Guide, a Career Direction Explorer and an Interview Preparation Guide.

We are an Australian business operated by Mint Nimbus Pty Ltd as trustee for G&G Anderson Family Trust (ABN 21 527 913 094) trading as TryPenguin. We voluntarily comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

Throughout this policy, “we,” “our” and “us” refer to Mint Nimbus Pty Ltd ATF G&G Anderson Family Trust trading as TryPenguin. “You” and “your” refer to you, the person using our service.

2. How the Service Works

Understanding how the service works helps explain what data we collect and why. The process is:

• You message us on WhatsApp and send your CV as a document attachment.
• We send you a payment link (processed by Stripe). You pay in your browser and return to the chat.
• Once payment is confirmed, our system processes your CV using AI models to generate personalised coaching documents.
• We send the completed documents back to you via WhatsApp as file attachments.

The coaching documents are generated by AI and are intended as guidance. They do not constitute professional career advice and should not be relied upon as a substitute for independent professional judgement.

3. What Data We Collect

3.1 Data you provide directly

• Your CV document, including your name, contact details, education history, employment history, skills and any other information you include in your CV.
• Your WhatsApp phone number (used as your account identifier).
• Any messages you send us via WhatsApp in the course of using the service.

3.2 Data generated by the service

• A unique student identifier (UUID) assigned by our system and linked to your phone number.
• Coaching documents generated from your CV (CV Revision Guide, Career Direction Explorer, Interview Preparation Guide).
• Processing metadata: timestamps, processing duration, AI model version used and token consumption. This is used for quality monitoring and cost tracking.
• Reasoning records: structured records of the AI’s decision-making process, used for quality assurance and dispute resolution. These are never shared with you or any third party in their raw form.

3.3 Payment data

Payment is processed entirely by Stripe. We receive confirmation that payment was successful, the amount paid, the Stripe payment identifier and a timestamp. We do not receive or store your credit card number, bank account details or other financial instrument details. Stripe’s own privacy policy governs how Stripe handles your payment information.

3.4 Data we do not collect

We do not collect your date of birth, government identification numbers, health information or any special category data as defined under Australian privacy law, unless you voluntarily include such information in your CV. We strongly recommend you do not include sensitive personal information (such as health conditions, religious affiliation or political opinions) in your CV.

4. Why We Collect Your Data

We collect and use your personal information for the following purposes:

• To provide the service: processing your CV and generating personalised coaching documents.
• To deliver documents to you via WhatsApp.
• To process your payment and maintain a record of transactions.
• To maintain your student record so that you can access follow-up services (such as interview preparation) without re-submitting your CV.
• To monitor and improve the quality of our AI-generated outputs through internal review and telemetry analysis.
• To resolve disputes if you disagree with a coaching recommendation (using our reasoning records to reconstruct how the AI reached its conclusion).
• To comply with applicable laws and respond to lawful requests from regulators or law enforcement.

5. Legal Basis for Processing

We process your personal information on the basis of your express consent. By sending us your CV via WhatsApp and completing the payment process, you give us clear and voluntary consent to collect, use and disclose your personal information for the purposes described in this policy.

Under the Australian Privacy Principles (APPs), we rely on:

• APP 3 (Collection of solicited personal information): we only collect information that is reasonably necessary to provide our career coaching service, and only when you voluntarily provide it to us.
• APP 6 (Use or disclosure of personal information): we use your information only for the purpose for which it was collected (providing your CV review and coaching outputs) or for directly related purposes you would reasonably expect.

You may withdraw your consent at any time by contacting us at privacy@trypenguin.ai or by sending “delete my data” via WhatsApp. If you withdraw consent, we will delete your records in accordance with Section 9 of this policy.

6. How Your Data Is Processed — Third-Party Services

Your data is processed by the following third-party services in the course of delivering the TryPenguin service. Each plays a specific role:

6.1 WhatsApp Business API (Meta Platforms, Inc.)

We use the WhatsApp Business API to receive your messages and CV and to deliver coaching documents back to you. Messages sent through the WhatsApp Business API are encrypted in transit between your device and Meta’s servers and between Meta’s servers and our system. However, unlike personal WhatsApp messaging, messages processed through the Business API are decrypted at the business endpoint (our system). This means the conversation is not end-to-end encrypted in the way personal WhatsApp chats are.

Meta’s data handling is governed by Meta’s privacy policy and WhatsApp Business terms. We download and process your CV attachment immediately upon receipt and do not rely on Meta’s infrastructure for long-term storage of your documents.

6.2 Twilio (WhatsApp Business Solution Provider)

We use Twilio as our Business Solution Provider (BSP) for the WhatsApp Business API. Twilio receives and routes WhatsApp messages between Meta’s infrastructure and our system. This means your messages and CV attachment transit through Twilio’s infrastructure in addition to Meta’s.

Twilio is a United States company. Twilio’s data handling is governed by their own privacy policy and data processing terms.

6.3 Anthropic (Claude API)

Your CV content is sent to Anthropic’s Claude API for AI processing. Anthropic processes this data to generate your coaching documents. We do not send your name, phone number, email address or payment details to Anthropic — only the text content extracted from your CV document.

Under Anthropic’s commercial API terms:

• Your data is not used to train AI models. Anthropic does not use API inputs or outputs for model training purposes.
• API data is retained by Anthropic for up to 7 days for safety and abuse monitoring purposes, after which it is automatically deleted.
• Anthropic acts as a data processor on our behalf. Their processing is limited to generating the coaching analysis requested by our system.

Anthropic is a United States company. Anthropic’s privacy practices are governed by their own privacy policy and API terms of service.

6.4 Stripe

Stripe processes your payment. We do not handle your credit card or bank details directly. Stripe is PCI DSS compliant and handles all payment data in accordance with its own privacy policy and terms.

6.5 Where Your Data Is Stored

Your data is not retained solely within WhatsApp. When you use our service, your information is processed and stored across the following locations:

• Our server (primary storage): Your student record, CV text, coaching output documents and usage telemetry are stored on our server hosted by DigitalOcean in their Sydney, Australia data centre (SYD1 region). This infrastructure uses encrypted storage volumes (AES-256 encryption at rest).
• WhatsApp / Meta: Your WhatsApp messages transit through Meta’s infrastructure. We download and process your CV attachment immediately upon receipt and do not rely on Meta’s infrastructure for long-term storage of your documents.
• Twilio: Messages are routed through Twilio’s US-based infrastructure in transit. Twilio does not store your CV or coaching documents.
• Anthropic: Your CV text is transmitted to Anthropic’s US-based API for processing and is retained for up to 7 days (see Section 6.3).
• Stripe: Payment information is processed and stored by Stripe. We do not store your credit card details.

7. Cross-Border Data Transfers

Your data may be transferred to and processed in countries outside Australia as a consequence of using the third-party services described above:

• WhatsApp Business API: Meta’s infrastructure is primarily based in the United States.
• Twilio: Twilio is a United States company. Message routing and webhook delivery are processed on US-based infrastructure.
• Anthropic (Claude API): Anthropic is a United States company. API requests are processed on US-based infrastructure.
• Stripe: Stripe is a United States company with global infrastructure.

We take reasonable steps to ensure that overseas recipients of your data handle it in accordance with the Australian Privacy Principles.

8. Data Retention

We retain your personal information for the following periods:

• Student record (including your UUID, phone number mapping and processing history): 12 months from your last interaction with the service.
• Coaching documents (CV Revision Guide, Career Direction Explorer, Interview Preparation Guide): 12 months from generation.
• Your original CV: 12 months from submission. We retain a copy to support follow-up services and dispute resolution.
• Telemetry and reasoning records: 12 months from generation. Used for quality assurance.
• Payment records: retained for 5 years as required by Australian tax law.

After the applicable retention period, data is permanently deleted from our systems. We do not archive data beyond the stated periods.

9. Your Rights

9.1 Access (APP 12)

You can request a copy of the personal information we hold about you. We will respond within 30 days. To make a request, email us at privacy@trypenguin.ai.

9.2 Correction (APP 13)

If you believe the personal information we hold about you is inaccurate, incomplete or out of date, you can ask us to correct it. The simplest way to update your information is to submit an updated CV through the service.

9.3 Deletion

You can request that we delete all personal information we hold about you. To do so, send us a WhatsApp message saying “delete my data” or email us at privacy@trypenguin.ai. We will delete your student record, coaching documents, original CV, telemetry and reasoning records within 14 days of your request. We will confirm deletion via WhatsApp.

Please note: deletion is permanent. If you use the service again after deletion, you will need to submit your CV and pay again as a new user. Payment records may be retained beyond deletion where required by tax law.

10. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss and unauthorised access, modification or disclosure (APP 11.1). Our security measures include:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher. This applies to WhatsApp messages, payment transactions via Stripe and all communications between our server and third-party services (Anthropic, Twilio, Stripe).
• Encryption at rest: Student records and coaching documents stored on our server are protected by AES-256 volume encryption on encrypted storage infrastructure.
• Access controls: Access to our backend system is restricted to authorised personnel via SSH key-based authentication only. Password authentication is disabled.
• Automatic security updates: Our server infrastructure receives automatic security patches.
• Network firewall: Inbound connections are restricted to HTTPS (port 443), HTTP (port 80, redirects to HTTPS) and SSH (port 22) only.
• PII handling: Personally identifiable information in CVs is sanitised before being sent to AI models for processing and restored only in the final output documents.
• Payment isolation: Payment data is handled entirely by Stripe and never touches our systems.
• Immediate CV processing: CV attachments are downloaded from WhatsApp and processed immediately. We do not rely on Meta’s infrastructure for document storage.

No system is completely secure. If you become aware of any security incident involving your data, please contact us immediately.

11. Children

TryPenguin is designed for university graduates and is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

12. Cookies and Tracking

The TryPenguin landing page (trypenguin.ai) does not use cookies or tracking technologies.

The WhatsApp chat interface is operated by Meta and is subject to Meta’s own cookie and tracking policies. The Stripe payment page is operated by Stripe and is subject to Stripe’s cookie policy. We do not control the tracking technologies used by these third-party platforms.

13. What We Do Not Do

For clarity, we confirm that we:

• Do not sell your personal information to any third party.
• Do not use your data for advertising, profiling or targeted marketing.
• Do not share your CV or coaching documents with employers, recruiters, universities or any other third party unless you explicitly ask us to.
• Do not use your data to train AI models. Your CV content is sent to Anthropic’s API for processing only. Anthropic’s API terms prohibit the use of API-submitted data for model training.
• Do not make automated decisions about you that have legal or similarly significant effects. The coaching documents are guidance only and do not determine any outcome.

14. Changes to This Policy

We may update this privacy policy from time to time. If we make material changes, we will notify you via WhatsApp before the changes take effect. The “Last updated” date at the top of this policy indicates when it was most recently revised.

15. Complaints

If you believe we have breached the Australian Privacy Principles or handled your data inappropriately, you can:

• Contact us first by emailing privacy@trypenguin.ai. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.
• If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

16. Contact Us

If you have any questions about this privacy policy or how we handle your personal information, please email us at privacy@trypenguin.ai.