Draft — pending legal review. This text has not yet been reviewed by a lawyer.

Privacy policy

Last updated: 3 October 2026. Operator: the owner of 12-20.com ("we"). Contact: privacy@12-20.com.

1. What we collect

• Account: email address, password hash (if you set a password), language, country of residence, whether you are enrolled in an Australian course (self-reported).
• Your materials: profile facts, CV entries, uploaded CV files, email drafts, replies you paste in, notes, dates you enter. Some of this may be sensitive (for example grades).
• Public research records about academics you look up: names, affiliations, publications, funding acknowledgements and formal notices from OpenAlex, Crossref (including Retraction Watch data) and, if enabled, Semantic Scholar.
• Usage records: which records you viewed and when, generation logs (model, token counts, cost), audit logs of sending, generation and authorisation actions.
• Payments: handled by Stripe; we receive the payment status and a customer id, never your full card number.

2. Why (APP 1, 3, 6)

To provide the outreach workspace you asked for: record cards, CV variants, drafts, pre-send checks, reminders and interview preparation; to bill you; to keep the service secure; and to meet legal obligations. We do not sell personal information and do not export academics' contact details.

3. Consents

At signup you give separate consents for (a) collecting your materials including sensitive information, (b) sending your materials to an overseas AI model provider for processing, (c) optional use of your de-identified case, and (d) optional marketing email. Options (c) and (d) are off by default. You can change them in Settings.

4. Overseas disclosure (APP 8)

AI drafting and analysis are processed through OpenRouter, Inc. (United States), which routes requests to model providers that may process data in the United States or other countries. Only the minimum material needed for each step is sent. Application data is hosted in Melbourne, Australia.

5. Automated processing

The pre-send checker, status tracking and eligibility comparison are automated. They produce warnings and blocks on your own drafts; they do not make decisions about you that have legal effect. You can always see why a check failed.

6. Academics' information (APP 5)

Record cards are generated on request from public scholarly databases, show only verifiable public records with source, date and original wording, and are not shared between users. Academics can view, correct or remove records, or ask not to be contacted through this tool, at /record-requests.

7. Retention

• Uploaded original files (CV, transcripts) are deleted within 24 hours after processing.
• Your materials are deleted 90 days after your last package ends.
• Payment records are kept as required by tax law.
• You can export all your data or delete your account at any time in Settings.

8. Security (APP 11)

Encrypted transport, hashed passwords, encrypted backups, least-privilege access, audit logs, secret scanning. Email bodies and CV text are not written to application logs.

9. Access, correction, complaints

Email privacy@12-20.com. If you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).