Privacy Notice

We collect information you provide when you submit a question (which registers you for the AI Advisor pilot in the same step), respond to clarification requests, or provide feedback. This may include your name, work email, organisation, role category, sector, geography, organisation size band, consent status and the content of your submitted question.

We use this information to operate the pilot, manage your weekly entitlement, respond to your submitted question, maintain service records, improve response quality, assess product demand and meet governance, security and audit requirements.

We may collect organisation-level market intelligence such as sector, role category, organisation size band, AI adoption maturity and public trigger event. We do not use this to build unnecessary personal profiles or infer sensitive personal attributes.

Third parties who process your data

Your submitted questions and related content are shared with the following processors to operate the service:

• Anthropic and OpenAI — question classification, research planning, evidence review and draft response generation.
• Zoho Mail — delivery and receipt of service emails (confirmations, responses, notices, and subscriber replies).
• Firecrawl, Tavily and Serper — web search used to locate evidence sources for a response.

These processors may handle data outside Australia, including in the United States. Where this occurs, we rely on each processor's own standard contractual clauses or equivalent safeguards for that transfer. During the pilot, responses are reviewed by a person before being sent.

We store records needed to operate the pilot, including consent records, question records, responses, evidence records, audit logs, email logs and incident records. Access is limited to authorised administrators and reviewers.

How long we keep your data

• Email delivery logs: 365 days.
• Background processing job records: 90 days.
• Audit logs (tamper-evident, kept for accountability and security purposes): approximately 7 years, and not deleted even upon a deletion request — see below.
• Your account, question and response records: kept while your account is active. If you withdraw or your account becomes inactive, your personal data (name, email, question and response text) is automatically anonymized 30 days after withdrawal, unless you request earlier deletion yourself.

Your rights

Subject to applicable law, you have the right to:

• Access a copy of your data — use our data rights page to export it directly.
• Erasure of your data — use the same data rights page to request deletion. This anonymizes your name, email and submitted question/response text and deactivates your account. We retain anonymized records and audit log entries where necessary for accountability, security and legal obligations, consistent with applicable law.
• Rectification, restriction or objection — contact us at the address below.
• Portability — the export available on the data rights page is provided in a structured, machine-readable (JSON) format.

We aim to respond to any such request within 30 days.

You may also request withdrawal from the pilot or unsubscribe from marketing communications using the links included in our emails.

Legal basis for processing

We process your question and response content on the basis of your consent, given when you submit your first question via our question form. We process data for security monitoring and audit logging on the basis of our legitimate interest in operating the service safely and demonstrating accountability. Where we are subject to a legal obligation to retain specific records, we rely on that obligation as the basis for retention.

If something goes wrong

If we become aware of a data security incident affecting your information, we will assess and, where required, notify the relevant supervisory authority within 72 hours and notify affected individuals without undue delay where the incident poses a high risk to your rights.

Contact: [email protected]

Last updated: July 2026 · Version 3