Privacy policy

Candora is operated by Evarin Pty Ltd (ABN 98 697 805 146), trading as Candora. This policy covers the Candora website, account and membership services, employee survey service, and communications with us.

A customer organisation is responsible for its decision to run a survey, the questions it asks, the people it invites, and its own notices and legal obligations. Candora operates the service and protects responses from being exposed to that organisation at an individual level.

Candora responses are completely anonymous to the employer. There is no employer-controlled anonymity setting and no employer reporting view or export that reveals a person's answers or individual written comments.

To send private invitations, prevent duplicate submissions, calculate participation, and place responses into the correct reporting group, Candora must process participant identity and response data within a restricted source layer. Employer-facing reports are generated from a separate privacy-safe results layer. Group results are suppressed unless at least three people have responded, and written responses are converted into themes and findings rather than shown as quotations.

The customer can see its participant roster and operational delivery or completion status. It cannot see which answers a participant gave. Read more in How privacy works.

Depending on how you use Candora, we may collect:

• account information such as a name, business email address, password credentials, organisation, role, and session information;
• participant roster information supplied by a customer, including a name, email address, reporting group or team, optional employee reference, and invitation or delivery status;
• survey responses, including selections, ratings, written responses, reporting-group linkage, and submission timing;
• survey setup material, questions, audience selections, and text supplied for roster import or AI-assisted features;
• billing records such as subscription status, participant quantity, paid period, and Stripe customer or subscription identifiers. We do not receive or store complete payment-card details;
• short campaign tags from links to our public pages, such as source, campaign and ad name, when a tagged link is used;
• support messages and basic technical information needed to operate, secure, and troubleshoot the service.

Survey content may contain sensitive information, including views about health, disability, race, religion, union membership, or other workplace matters. Customers should only request this information where lawful and necessary. Participants should avoid naming other people and may skip questions where the survey allows it.

We collect information directly from account holders and survey participants, from customer-supplied rosters, through payment and email service providers, and automatically when the service is used.

We use it to create and secure accounts, provision memberships, build and deliver surveys, prevent duplicate responses, monitor participation, produce privacy-safe reports, provide support, process billing events, improve reliability, comply with law, and investigate fraud, misuse, or security incidents.

We record public marketing page categories and campaign tags to understand which visits lead to registration, verification, and paid membership. To estimate return visits before registration, we derive a site-specific key from the request IP address and browser User-Agent. We do not store those raw values in marketing analytics, and remove the key from events after 30 days. This does not track survey respondent pages or use survey answers for marketing attribution.

We do not sell personal information or use survey responses for targeted advertising.

Candora uses carefully bounded AI services to help structure pasted roster information, draft or refine survey questions, and turn restricted written responses into privacy-safe themes and findings. Depending on the feature selected, relevant text may be processed by providers such as Anthropic or OpenAI.

AI-generated roster proposals are reviewed before records are saved. Findings pass through additional privacy checks, and the employer receives findings rather than raw employee comments. AI output can be incomplete or inaccurate and should be reviewed before it informs a workplace decision.

We disclose information only as needed to operate Candora, including to cloud hosting and database providers, email delivery providers, Stripe and its related payment services, AI providers for requested features, professional advisers, and authorities where disclosure is required by law.

We require service providers to handle information for the services they provide to us. We may also disclose information in connection with a genuine corporate transaction, subject to appropriate privacy protections.

Candora's application and primary database are hosted in Australia. Some service providers, including payment, email, support, AI, and advertising measurement providers, may process information in the United States and other countries in which they or their subprocessors operate. Privacy laws in those countries may differ from Australian law. We take reasonable steps to select reputable providers and protect information disclosed overseas.

Candora uses cookies and similar browser storage for account authentication, security, preferences, and in-progress survey operation. Candora's first-party marketing analytics does not set a cookie or use browser storage. On public marketing, signup, and account-registration confirmation pages, visitors whose IP address maps to Australia, New Zealand, or the United States may also receive a Google Ads tag. Google may use cookies or similar storage to measure ad visits and account registrations. We do not load this tag for visitors outside those countries or on survey respondent and survey results pages, and we do not send survey answers to Google. We do not use this tag for personalised advertising or remarketing. Your browser can block cookies, but essential account and survey features may then stop working. Country lookup uses GeoLite2 data created by MaxMind, available from https://www.maxmind.com/.

We use reasonable technical and organisational safeguards, including access controls and separation between restricted response data and employer-facing results. No internet service can guarantee absolute security.

We retain information for as long as reasonably necessary to provide the service, maintain security and records, meet contractual and legal obligations, and resolve disputes. When information is no longer required, we delete or de-identify it where reasonably practicable. Customers may contact us about account or organisation deletion.

We assess suspected eligible data breaches and notify affected people and the Office of the Australian Information Commissioner where the law requires it.

You may ask to access or correct personal information we hold about you. We may need to verify your identity and may refuse or limit a request where the law permits, including to protect another person's privacy. An employer cannot use an access request to obtain an employee's restricted survey answers.

To make a request or privacy complaint, email hello@candora.app with enough detail for us to investigate. We aim to acknowledge and respond within 30 days. If you are not satisfied, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

We may update this policy as Candora, its providers, or legal requirements change. We will publish the revised policy here and update the date above. We will give additional notice where a change materially affects how we handle personal information.

Privacy contact: Evarin Pty Ltd trading as Candora, NSW, Australia, hello@candora.app.