Privacy Policy and Collection Notice

Effective: 11 October 2026 · Version: 2026-10-11.3

This policy explains how Customer Experience Insight Pty Ltd (ABN 61 634 039 759) trading as WA AI Hub ("we", "us") handles personal information when you use Persona Journey at https://www.cxinsight.com.au (the "Service"). It is written to the standard of Australian Privacy Principle (APP) 1 (privacy policy) and APP 5 (collection notice) of the Privacy Act 1988 (Cth) (the Privacy Act).

Our legal position, plainly. We are a small business with annual turnover under A$3 million, so the Privacy Act's APPs do not currently bind us by law. We have chosen to follow them anyway, including the overseas-disclosure rules in APP 8, the automated-decision transparency rules in APP 1.7 to 1.9, and the data breach notification standard. We treat this as a promise to you, and you can hold us to it. The statutory tort for serious invasions of privacy in the Privacy Act, other Australian laws and the Australian Consumer Law apply to us regardless. If you are in the European Union, United Kingdom or elsewhere, see section 17.

1. Summary

You need an account to use the Service. We collect your name, email and sign-in details for it.
Your prompts, template answers, uploaded files, and the personas and journeys you create or edit (with the instructions you type to change them), are processed by AI and research service providers overseas, in Singapore and the United States, to generate and edit your documents. Build is different: your messages and the repository files it reads are processed by an Australian-hosted AI service, and only go to providers outside Australia if you turn that on for a session. Section 7 lists every type of provider, what it receives, and where it is.
We do not keep your uploaded files or the instructions you type to change a document. They pass through our systems while your request is processed. Finished personas and journeys are saved to your library in our Sydney database, with your edits and the idea description and template answers they were made from, so you can reopen them, until you delete them. Drafts are also kept in your own browser, and in your GitHub repository if you choose to commit them. So you can track them, we also keep a record of each GitHub sync (repository, branch, commit link and the persona's title) and your code-trace reports (file paths, persona and journey headings, and suggested links). If you connect Participo™ (our workshop service), the workshops you send or pull from it are saved to your workshop inbox in our Sydney database: the facilitator's cited synthesis and only the transcript lines it cites, never the full transcript. You choose when a workshop is sent, and you can remove any workshop at any time. When you use one in the Studio it is treated like any other file you upload. Build is different: so you can continue a conversation and review changes before they reach GitHub, we keep your Build messages, the AI's replies and plans, and the code changes it proposes. Proposed code is deleted once you apply or discard it, or after 7 days; we keep only the file names, a summary and links to the commits and pull requests made. To suggest prompts you use often, we keep those prompts with file names, quoted text and other specific details removed; you can clear them at any time.
Teams. If you create or join a team, its other members can see your name, email address and role, and the personas and journeys you add to the team. Team owners and admins can see the team's activity (for example who joined, changed a role or deleted an item), and owners can see how many of the team's shared credits each person uses. Items you add to a team stay with it if you leave.
If you subscribe, card details go directly to our payment processor. We never see or store them.
We do not sell personal information, show advertising, or use tracking or analytics cookies.
Do not upload sensitive information or health information (see section 4), or identifiable information about other people unless you are allowed to share it.

2. What we collect

Category	Examples	Source
Account information	Name, email address, profile image, sign-in method	You, or the third-party sign-in service you choose to use
Content you submit	Product idea description, persona template answers, uploaded files and pasted text (text files, PDFs, Word documents and images), personas and journey maps you bring from elsewhere, persona content used to generate a journey, your edits to a persona or journey and the instructions you give to change it, the opening lines of up to 40 repository files when you ask for code-trace suggestions, and, in Build, your messages and the repository files read to make the change you ask for	You
Generated content	Personas, journeys, images, narration, music	Generated by AI service providers for you
Billing information	Plan, subscription status, billing period and payment history. Card details are collected directly by our payment processor	You and our payment processor
GitHub connection	GitHub username, an encrypted access token, the repositories you select, and the branches, commits and pull requests you approve in Build	GitHub, if you connect it
Usage and account records	Credit balance, plan and subscription status, generation counts and timestamps (for rate limiting), consent records (document version and time accepted)	Generated by the Service, and our payment processor
Library	Your idea descriptions, template answers, imported or generated personas and journeys, titles, portraits, and the scene images, music and narration you attach	You, and AI service providers
Products and requirements	Product and service details and attributes you enter, which personas and journeys they link and each persona's priority, relationship and surface in that product, persona attributes, and the requirement documents (PRD, business, functional and non-functional requirements, service blueprints) written from them, with earlier versions	You, and AI service providers
Stakeholder and ecosystem maps	For each product: the people, teams, organisations and systems you or the AI add (names, descriptions, ring, power, interest, attitude and how to involve them), what passes between them and when in the journeys, AI suggestions with the quotes they rest on, open questions, and a record of who accepted or rejected what and when. We ask you to name roles and organisations, not individual people	You, and AI service providers
Workshops (from Participo™)	A workshop's cited synthesis and the transcript lines it cites, with the workshop's title and date, and the connection keys	You, through Participo™ (our workshop service)
Sync and code-trace records	For each GitHub sync: repository, branch, commit or pull-request link, the persona's title and which AI tool files were updated. For each code trace: file paths, persona and journey headings, and the links found, suggested or edited by you. For Build: your messages, the AI's replies, plans and proposed changes, the commits and pull requests made, and prompt suggestions. For each edit you make in the relationship map (a link between code and a persona's needs or journey, a persona's role, or which needs a journey phase addresses): what changed, any note you add to explain it, and when	Generated by the Service, and edits you make
Technical information	IP address, browser and device information, session cookies, error logs linked to your account ID	Your device and our service providers

We do not collect government identifiers or precise location.

3. Why we collect it

We collect, hold, use and disclose personal information to:

create and secure your account and keep you signed in;
generate personas, journeys, templates and media you ask for, including sending your content to the service providers in section 7;
save documents to GitHub when you ask us to;
process subscriptions and payments, and track credits;
apply fair-use limits, rate limits, and sign-up and payment security (some of which are automated decisions: see section 9);
keep a record of your acceptance of our terms and this policy;
keep the Service running, diagnose faults and protect it against misuse;
respond to your requests and complaints, and send service messages about your account and billing; and
comply with the law, including tax and record-keeping obligations.

We only use personal information for these purposes or a related purpose you would reasonably expect, unless you consent or the law requires or allows it (APP 6).

Without this information we cannot provide the Service. The Service needs an account and needs to send your content to AI service providers. You may use a pseudonym as your display name. Anonymous use is not practicable because credits, billing and security require an account (APP 2).

We do not use your content to train AI models. We can't make the same promise for every provider we send it to. Our image and image-reading service's terms don't allow it to train on your content. Our AI text-generation and web-research services either have terms that allow them to keep and use what they receive to train or improve their AI, or haven't confirmed to us in writing that they don't. Assume that what you send may be kept and used that way, and don't include anything you wouldn't want an AI provider to see. The web-research services receive only your idea description, never uploaded files, imported documents or generated personas.

4. Sensitive information, health information and other people's information

The Service is designed for fictional, research-based personas. It is not designed to process information about real, identifiable people.

Do not submit sensitive information as defined in the Privacy Act. This includes health, genetic or biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and trade-union membership. It covers you and anyone else. We do not intend to collect sensitive information. If you submit it anyway, we treat it as provided with your consent solely for generating your document (APP 3.3). It is sent to our AI service providers, and if it ends up in a persona or journey you save, it is kept in your library until you delete it.
Health information is also regulated by State and Territory laws, such as the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic). Do not upload patient, client or clinical records.
Interview notes, survey exports and research files must be de-identified before upload. Remove names, contact details and anything else that could reasonably identify a person, unless you have the individual's consent or other lawful authority to share it with us and our service providers for this purpose.

5. How we hold and protect it

Credit, plan and subscription records, GitHub sync history, code-trace reports, Build sessions and prompt suggestions, your library (the personas, journeys, portraits, scene images, music and narration the Service saves for you), your workshop inbox (workshops you send or pull from Participo™) and the connection keys for Participo (a digest of the key you create for Participo to send with, and the Participo key you paste in to pull, which is encrypted before storage), your products and services with their requirement documents (with up to 20 earlier versions of each) and stakeholder and ecosystem maps, team records (team names, members and roles, invites, including an email address an invite is addressed to, and the team activity log) and a short-lived cache of web research are held in a database hosted in Sydney, Australia. Account records are held by our authentication service provider. GitHub access tokens are encrypted before storage.
Data is encrypted in transit (HTTPS/TLS). Access to production systems is restricted to authorised personnel.
Sign-in protection. Passwords must be at least 15 characters and are checked against lists of passwords exposed in known breaches. Signing up is protected by an automated bot check. After 10 failed sign-in attempts an account is locked for 60 minutes. Sessions expire after 7 days. You can also sign in with a third-party sign-in service. We do not currently offer a second sign-in step (multi-factor authentication) of our own, so please use a strong, unique password and keep your email account secure.
Drafts you are working on are saved in your browser's local storage on your device. They are removed when you finish, are no longer restored after 7 days, and are deleted when you clear your browser data. We cannot see them. Finished personas and journeys are also saved to your library on our servers so you can reopen them; you can delete any item from the library at any time, which removes it, its portrait and its link to your sync history from our database.
Retention:
- Account, credit, sync-history, code-trace, Build, library and product records are kept while your account is open, then deleted within 30 days of account closure. Code proposed in Build is deleted when you apply or discard it, or after 7 days (1 hour in a workspace set to "Don't save"), whichever is first. Deleting a product deletes its requirement documents and their history, and its stakeholder and ecosystem map; the linked personas stay in your library.
- Personas and journeys you add to a team belong to that team. They are kept until a team admin or owner deletes them or the team is deleted, including after you leave the team or close your account (they are then no longer linked to you). Your team memberships are removed when you leave or close your account, and your name is removed from the team activity log when you close your account. If you were a team's only owner and only viewers are left, we keep the team read-only for 30 days (and email its members) before deleting it and its items.
- Web research gathered for your idea is cached for up to 24 hours, so writing the journey after the persona doesn't search again, then deleted.
- Workshops in your workshop inbox are deleted 90 days after they arrive, when you remove them, and when you close your account. Disconnecting Participo™ deletes your saved Participo key at once, and replacing or revoking the key you made for Participo to send with stops the old one working.
- Billing and payment records are kept for as long as tax law requires (generally 5 years).
- Sovereign add-on: you (or your team's admins and owners) can choose to have saved work deleted automatically once it hasn't been changed for 7, 30, 90 or 365 days (checked daily), switch on a don't-save mode in which new work stays only in your browser, delete everything saved in the workspace at once (you get a receipt listing what was deleted, never the content), and download an export first. Deleted data can remain in our database provider's backups for a short time until they are overwritten.
- Operational logs are kept for a short period.
- Uploaded files and the instructions you type to change a document are processed to produce your result and not kept by us. The personas and journeys you save, with the idea description and template answers they came from, are kept in your library until you delete them. AI and research service providers may keep what they receive under their own terms. Some publish a period (for example 30 or 55 days for abuse monitoring); others don't, so assume it may be kept indefinitely. Our database provider may keep backups that include deleted data for a period under its terms.
We take reasonable steps to destroy or de-identify personal information we no longer need (APP 11.2).

6. Cookies and similar technologies

We use only strictly necessary cookies and storage:

session cookies set by our authentication provider, to keep you signed in securely (they are set only when you sign in or start signing in), or, for a Sovereign account, a session cookie we set ourselves when you sign in with an emailed code;
a bot-check widget at sign-up, which reads signals from your browser to tell people from automated programs;
a short-lived security cookie used when you connect GitHub, to prevent cross-site request forgery;
cookies set by our payment processor during checkout, for fraud prevention;
browser local storage, for your drafts (they expire after 7 days).

We do not use advertising, analytics or cross-site tracking cookies, pixels or fingerprinting. Because everything we store on your device is strictly necessary for a service you asked for, the law does not require your consent, and we do not show a cookie banner. If we ever add anything else, we will ask first.

7. Data residency and overseas disclosure (transparency statement)

Our database is hosted in Australia, but most of the Service runs overseas. When you use the Service, your personal information, including your prompts, template answers and the contents of files you upload, is disclosed to and processed by the service providers below, in the United States and Singapore, and other countries where our providers run servers, which may include mainland China (not every provider has told us which countries, so we cannot rule any out).

Service provider (by function)	What they receive	Where
Primary AI text-generation service (writes and edits personas, journeys, templates and requirement documents)	Idea description, template answers, uploaded file contents, the personas and journeys you create, import or edit, the instructions you type to change them, the product and service details you enter and the requirement documents written from them, and, only when you ask for code-trace suggestions, the opening lines of up to 40 files from the repository you choose	Singapore (storage). Processing may happen on the provider's servers in other countries, which may include mainland China
Backup AI text-generation services (used when the primary service is unavailable or its result can't be used)	The same as the primary AI text-generation service	United States and other countries where those providers operate
Web-research services (find and cite public sources)	Idea description only (never uploaded files). These services may keep this text and use it to train or improve their AI models	United States and other countries where those providers operate
AI image-reading service (reads the text in images and scanned documents you upload, such as photos of journey maps or whiteboards)	Images you upload, and scanned PDFs you choose to have read (up to 10 pages each)	United States and other countries where the provider operates
AI media-generation service (images, narration and music)	Generated persona and journey content	United States and other countries where the provider operates
Authentication and account-management service	Name, email address, sign-in method, profile image, and technical data such as IP address and device information	United States
Payment processor (paid plans only)	Name, email address, billing details and card details (card details go straight to the processor and are never seen by us)	United States and other countries where the processor operates
Website hosting and request-processing service	All requests to the Service while they are processed, plus short-lived logs containing your account ID and error details	Australia (our application runs in the Sydney region). The provider is based in the United States, and its logs and support systems may be held there
Database hosting service (credits, plan, subscription status, sync history, code-trace reports, Build sessions, library, products and teams, and workshops you send or pull from Participo™)	Account ID, credit balance, plan, subscription status and billing-cycle dates; for each GitHub sync, the repository, branch, commit links and the persona's title; for each code trace, file paths, persona and journey headings, suggested links, and the relationship edits you make (links, persona roles and phase mappings) and any notes you add to them, with when each was made; for Build, your messages, the AI's replies and plans, proposed code changes (kept until you apply or discard them, for up to 7 days), links to the commits and pull requests made, and the prompts you use often (with file names and quoted text removed) for prompt suggestions; your library (personas, journeys, portraits, scene images, music, narration, and the idea descriptions and template answers they came from); your products and services, the attributes you give them and your personas, which personas they link, and their requirement documents with up to 20 earlier versions each; team names, members and roles, invites (including an email address an invite is addressed to) and the team activity log; if you connect Participo™, the workshops you send or pull (the facilitator's cited synthesis and only the transcript lines it cites, with the workshop's title and date, deleted 90 days after they arrive), a digest of the connection key you create for Participo to send with, and the Participo key you paste in to pull (encrypted before storage); web research cached for up to 24 hours	Australia (Sydney)
Australian-hosted AI coding service (Build: the Fast, Balanced, Frontier and Open model choices)	When you use Build: your messages, the list of files in the repository you choose and the contents of up to 15 of its files per request (likely passwords and keys are removed first), and your persona and journey	Australia (Sydney and Melbourne). The provider is based in the United States. Under its published terms it does not keep your prompts or results and does not use them to train models
Premium AI coding models outside Australia (Build only, and only when you turn them on for a session)	The same as the Australian-hosted AI coding service: your messages, the repository's file list, up to 15 files per request (likely secrets removed first), and your persona and journey	United States and other countries where those providers operate. The providers may keep what they receive for a period under their own terms
Australian-hosted AI text and image-reading service (Sovereign add-on only: replaces the AI text-generation and image-reading services above for Sovereign workspaces)	The same as the primary AI text-generation and image-reading services, for work in a Sovereign workspace	Australia (Sydney only). The provider is based in the United States. Under its published terms it does not keep your prompts or results and does not use them to train models
Account sign-in for Sovereign accounts (Sovereign add-on only: replaces the authentication service above once you move your account)	Email address, name, sign-in sessions and one-time sign-in codes; your consent record and encrypted GitHub token	Australia (Sydney), in our own database
SocialCraft, our social campaign app (another WA AI Hub app, run by us), only if you connect it to Persona Journey	For the one workspace you choose when you connect: your personas and journeys, your products and services (their details and the list of their requirement documents), and the context files in GitHub repositories you pick. SocialCraft processes this content with an AI service provider in the United States to plan and write social posts. It sends back campaign results with commenter names and handles removed	Australia (SocialCraft's hosting, Sydney region), with AI processing in the United States
Participo™, our workshop service (only if you connect it to pull workshops)	Your Participo key, sent with each request as a credential, and the id of the workshop you ask for. We receive the workshop from Participo; we do not send it your personas, journeys or documents	Australia (Sydney). Participo's own AI and speech-to-text services process workshop audio and text outside Australia, as its privacy policy explains. Sovereign accounts cannot use it yet
GitHub, the code-hosting platform you choose to connect (only if you connect it)	Your GitHub account identity, an encrypted access token, the documents you choose to commit, read access to the repositories you ask us to scan for the code trace or work on in Build, and the branches, commits and pull requests you approve in Build	United States

Where our primary AI text-generation service processes data. The provider stores data in Singapore, and processing may take place on its servers in other countries, which may include mainland China. We cannot rule that out, and those countries may not give your information the protection Australian law does. We still require the provider's data-processing terms to apply. It hasn't confirmed to us in writing how long it keeps the data or that it never uses it to train models, so assume it may do both.

Which provider handles a request. Each request goes to one AI text-generation service at a time. If that service is unavailable, or its result can't be used (for example, an edit that changes nothing), we automatically try once more on the same or a backup service. So more than one of the AI text-generation services above may process the content you submit in a single action, and any of them may process a given request.

Our accountability. Before disclosing personal information overseas, we take reasonable steps to ensure the recipients handle it consistently with the APPs (APP 8.1). We do this by selecting providers whose commercial terms include confidentiality, security and data-use restrictions. The overseas recipients are not themselves bound by the Privacy Act, and foreign laws may allow authorities there to access data. We remain accountable for their handling of your personal information as required by section 16C of the Privacy Act. We do not ask you to waive this protection.

Sovereign add-on. In a workspace with the Sovereign add-on (on your own Pro plan or your team's Team plan), the writing, editing, template, image-reading and code-trace-suggestion work above is done only by our Australian-hosted AI service instead of the overseas ones. If that service is unavailable, the request fails and you are not charged: we never fall back to an overseas service. If you move your account (Privacy settings), your sign-in, consent record and GitHub connection are held in our own database in Sydney instead of by our overseas authentication provider, which then deletes its copy. These still leave Australia even with Sovereign: web research for your idea, portraits, scene images, music and narration, payments, and our hosting provider's logs and support systems (the Service marks these "Leaves Australia"). The Australian AI provider is a United States company, so foreign laws may still allow authorities there to seek access to data it processes.

Linked WA AI Hub apps. You can connect Persona Journey to SocialCraft, our social campaign app (also run by us, as WA AI Hub). Nothing is shared until you connect the two and approve it on a consent screen that lists exactly what SocialCraft may do. When you connect, you choose one workspace (your own, or a team you belong to), and SocialCraft can then read only that workspace's personas and journeys, products and services (their details and the list of their requirement documents, not the documents themselves), and the context files in GitHub repositories you pick. Depending on what you approve, it may also add campaign results to your personas and spend credits from that workspace's balance. SocialCraft processes this content with an AI service provider in the United States. Campaign results it sends back are anonymised: commenter names, handles, email addresses, phone numbers and links are removed, and we remove them again when they arrive. Your sign-in details, other workspaces and other people's personal items are never shared. Sovereign accounts and workspaces can't be connected, because their content must stay in Australia. To disconnect, go to Privacy settings, Connected apps, and choose Disconnect (or disconnect from SocialCraft's settings): access stops at once. Campaign results already added stay on your personas until you delete them or the persona.

Want more detail? Email privacy@wahub.ai to ask which kinds of provider handle your information. We will answer in line with APP 12, subject to our confidentiality obligations to those providers.

8. Other disclosures

We do not sell or rent personal information. We only disclose it:

to the service providers in section 7;
when you direct us to (for example, committing to your GitHub repository or opening a pull request there from Build, which may be public if your repository is public);
to a linked WA AI Hub app, such as SocialCraft, only after you connect it and only as described in section 7 ("Linked WA AI Hub apps");
to the other members of a team you create or join, as described in section 1 (your name, email address and role, the items you add to the team, and, for owners and admins, the team's activity and credit use);
if required or authorised by law, such as a court order or a request from an enforcement body under APP 6.2; or
to a successor if our business is sold or restructured, subject to this policy.

We do not engage in direct marketing. If we ever send marketing messages, we will first ask for your consent and include an unsubscribe option in every message, as the Spam Act 2003 (Cth) and APP 7 require. Service messages, such as sign-in codes, receipts and security notices, are not marketing.

9. Decisions made by computer programs (automated decisions and AI)

This section is our disclosure under APP 1.7–1.9 of the Privacy Act, which apply from 10 December 2026. We have taken a cautious approach: it covers automated decisions that may affect your access to the Service or your money, even where the effect may be modest.

Content generation is not a decision about you. AI models generate personas, journeys, images, narration and music. They are about fictional people. We do not use AI to assess, score, rank or profile you. See the AI Disclaimer.

Kinds of personal information used. The programs that make the decisions below use:

your account identifier and sign-in status;
your plan, subscription status and payment status (reported to us by our payment processor), and your billing-cycle dates;
your credit balance, and counts and times of your requests;
your consent record (the document version you accepted and when);
whether your GitHub connection is valid;
the size, type, length and page count of what you submit, such as an uploaded file, pasted text or a repository you ask us to scan. This is checked for those properties only, not to assess you; and
your IP address and device information, which our authentication and payment service providers use for sign-up, sign-in and payment security checks; and
the number of failed sign-in attempts on your account.

We do not use health information, sensitive information, biometric information or your personas' content to make decisions about you.

Kinds of decisions made solely by a computer program.

Allow, refuse or delay a request because you have too few credits, or because you have made too many requests too quickly. Limits are the same for every user and every plan.
Charge credits for an action, and refund them when an action fails or our automatic quality checks reject the result.
Refuse a submission that is too large, too long, in an unsupported file type, or over the page or item limits, or shorten extracted text that is over the limit.
Block content features until you have accepted the current Terms, Privacy Policy, Refund Policy and AI Disclaimer.
Lock an account for 60 minutes after 10 failed sign-in attempts, and end a session after 7 days.
Set your plan, credit allowance and access to export from your subscription status. If a subscription is cancelled, ends, or is unpaid after our payment processor's retries, your account returns to the Free plan automatically. Your credit balance is then capped at the Free allowance. Unused credits are also forfeited at the end of each 30-day cycle.
Decide whether an AI rewrite or tidy-up of your own text is returned to you, based on automatic checks (for example, that it finished and kept your structure).
Disconnect GitHub, by deleting the stored token, when GitHub rejects it.

Kinds of decisions where a computer program does something substantially and directly related to the decision.

Sign-up and payment security. Our authentication and payment service providers run automated bot and fraud checks. These can refuse a sign-up, sign-in or payment. We choose to use these providers, but we do not control their detailed checks.

We do not use a computer program to decide to suspend or close an account, or to refuse a refund or a request under this policy. A person makes those decisions.

If you think a decision was wrong. Email privacy@wahub.ai and tell us what happened. A person will review it, usually within 5 business days. Where it was a mistake, we will correct it, for example by restoring credits or your plan. You can also complain under section 14.

10. Access, correction and deletion

You can ask to access or correct the personal information we hold about you (APPs 12 and 13). Email privacy@wahub.ai. We will verify your identity, respond within 30 days, and not charge you for making a request. If we refuse a request, we will explain why in writing and tell you how to complain.
You can update your name, email and profile image, or delete your account, from your profile menu in the Service. You can delete any library item at any time. Paid plans can download their documents.
Erasure and other choices. You can ask us to delete your personal information, restrict how we use it, or stop using it for a purpose, and we will do so unless the law requires us to keep it (for example, tax records). We do not use automated profiling or direct marketing, so there is nothing to opt out of.
Disconnecting GitHub deletes the stored access token immediately.

11. Data breaches

If we suffer a data breach that is likely to result in serious harm to you, we will tell you promptly and, where appropriate, the Office of the Australian Information Commissioner (OAIC). We follow the Notifiable Data Breaches standard in Part IIIC of the Privacy Act even though it does not strictly bind us. We aim to assess a suspected breach within 72 hours of becoming aware of it, to notify within 30 days at the latest, and sooner where there is a high risk to you. We will also notify the data protection authority and affected people in the EU or UK where their law requires it.

12. Children

The Service is for people aged 18 or over. We do not knowingly collect personal information from children, we do not market to them, and we do not ask for dates of birth. If you believe a child has created an account, or that information about a child has been uploaded, contact privacy@wahub.ai and we will close the account and delete the information within 30 days. Our Children's Policy explains how we keep children out, what we do if we find one, and how to report a safety concern.

13. Western Australia and public-sector users

The Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act) applies to WA public entities, and to contracted service providers only where a WA government contract requires it. It does not otherwise apply to us.

If you are a WA public entity (or a public body in another jurisdiction), do not upload personal information your organisation holds until we have signed an agreement that sets out the privacy obligations (including any Information Privacy Principles) your organisation needs to pass on to us. Contact us to arrange this.

14. Complaints

Contact us first at privacy@wahub.ai or PO Box 8400, South Perth WA 6151. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au, by phone on 1300 363 992, or at GPO Box 5288, Sydney NSW 2001.

15. Changes to this policy

We will publish updates here with a new version and effective date. For significant changes, we will ask you to review and accept the updated policy in the Service before you continue using it.

16. Contact

Customer Experience Insight Pty Ltd · ABN 61 634 039 759 PO Box 8400, South Perth WA 6151 privacy@wahub.ai

17. If you are in the European Union, European Economic Area or United Kingdom

The Service is offered to customers in Australia, in Australian dollars. We do not market it in the EU or UK and we have not appointed a representative there. We still give people there the protections and rights described in this policy, and where the GDPR or UK GDPR applies to us despite this, the following also applies.

Who is responsible. Customer Experience Insight Pty Ltd, PO Box 8400, South Perth WA 6151, privacy@wahub.ai. We do not have a data protection officer, because we do not carry out the large-scale monitoring or sensitive processing that requires one.
Why we process your information, and our legal basis.

Purpose	Information	Legal basis
Account, sign-in, providing the Service, library	Account, content, usage records	Performance of our contract with you (Art 6(1)(b))
Payments, tax invoices, record keeping	Billing information	Contract, and our legal obligations (Art 6(1)(b) and (c))
Security, rate limits, fraud and bot protection, fixing faults	Technical, usage and account records	Our legitimate interest in keeping the Service secure and fair (Art 6(1)(f)). You can object
Records of your acceptance of our terms	Consent record	Legal obligation and legitimate interest (Art 6(1)(c) and (f))

We do not rely on your consent to provide the Service, and we ask you not to submit special-category information (section 4).
Your rights. You can ask for access, correction, erasure, restriction and a portable copy of your information, and you can object to processing based on legitimate interests. Email privacy@wahub.ai. We respond within one month. You can also withdraw any consent you have given, and you can complain to your local data protection authority as well as the OAIC.
Automated decisions. We make no decision with legal or similarly significant effect on you solely by automated means, other than the account controls in section 9, which you can ask a person to review.
International transfers. Your information goes to Australia (our database), the United States and Singapore (section 7). We rely on the EU-US Data Privacy Framework where a US recipient is certified under it, and otherwise on standard contractual clauses in our providers' data processing terms, together with the other safeguards in section 7. You can ask us for a copy of them.
How long we keep it. As set out in section 5.