Privacy Policy
Last Updated: January 22, 2026
Distill ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and share information about you when you use our website, distill.cv, and our resume cleaning platform (collectively, the "Service").
By using the Service, you consent to the collection and use of information in accordance with this policy.
1. The Distinction: You vs. Candidate Data
To ensure clarity under privacy laws (including the CCPA and NZ Privacy Act), we distinguish between two types of data:
Account Data
Information about you (the subscriber/agency) necessary to create accounts and bill for services. You are the "Data Controller" of this data.
Service Data (Candidate CVs)
The resumes and documents you upload for processing. For this data, you are the Business/Controller and Distill is the Service Provider/Processor. We process this data solely on your behalf.
2. Information We Collect
A. Information You Provide
- Registration Info: Name, email address, agency name, and password.
- Billing Info: We use a third-party payment processor (e.g., Stripe) to handle payments. We do not store your full credit card details.
- User Content: The raw CVs, resumes, and job descriptions you upload for anonymization.
B. Information Collected Automatically
- Log Data: IP address, browser type, operating system, and timestamp of your visit.
- Cookies: We use cookies to maintain your session and save your preferences.
3. How We Use Information
We use your information for the following purposes:
- To Provide the Service: To parse, clean, format, and anonymize the documents you upload.
- To Communicate: To send transactional emails (invoices, password resets) or crucial service updates.
- To Improve Distill: To analyze usage patterns and improve our parsing algorithms (e.g., training our parser to better recognize contact details for redaction).
4. How We Share Information
We do not sell your personal data. We only share data in the following circumstances:
- Service Providers: We share data with trusted third-party vendors who help us operate the Service (e.g., cloud hosting providers, payment processors, email delivery services). These vendors are contractually obligated to protect your data.
- Legal Requirements: We may disclose information if required to do so by law or in the good-faith belief that such action is necessary to comply with legal processes or protect the safety of others.
- Business Transfers: If Distill is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
5. International Data Transfers
Distill is headquartered in New Zealand.
For US Users: Information we collect may be transferred to, stored, and processed in New Zealand or the United States (depending on our cloud server locations).
By using the Service, you acknowledge that your information may be transferred to facilities that may not have data protection laws as comprehensive as those in your jurisdiction. However, New Zealand holds "Adequacy Status" with the EU and maintains strict privacy standards (Privacy Act 2020) that align closely with global best practices.
6. Data Retention
Account Data
We retain your account information as long as your account is active.
Service Data (CVs)
We practice Data Minimization. Once a document is processed and returned to you, we generally retain the raw and processed files for a limited period (e.g., 30 days) to allow you to download them or handle support queries, after which they are permanently deleted from our active servers.
7. Your Rights (CCPA & NZ Privacy Act)
Depending on your location, you may have the right to:
- Access: Request a copy of the personal information we hold about you.
- Correction: Update or correct inaccuracies in your data.
- Deletion: Request deletion of your account and associated data.
- Non-Discrimination (CCPA): We will not discriminate against you for exercising your privacy rights.
Notice to California Residents: Distill acts as a "Service Provider" under the CCPA regarding Candidate Data. We do not "sell" or "share" personal information for cross-context behavioral advertising.
8. Security
We implement industry-standard security measures (encryption in transit and at rest) to protect your data. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
9. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the email address associated with your account or by posting a notice on our website.
10. Contact Us
If you have questions about this Privacy Policy or our data practices, please contact us: