Effective: 30 September 2026 · Version: 2026-09-30
This policy explains how Customer Experience Insight Pty Ltd (ABN 61 634 039 759) ("we", "us") handles personal information when you use Persona Journey at https://www.cxinsight.com.au (the "Service"). It is our privacy policy under Australian Privacy Principle (APP) 1 and our collection notice under APP 5 of the Privacy Act 1988 (Cth) (the Privacy Act).
We handle personal information in line with the APPs, including the overseas-disclosure rules in APP 8 and the Notifiable Data Breaches scheme. We do this even where an exemption, such as the small business exemption, might otherwise apply to us.
1. Summary
- You need an account to use the Service. We collect your name, email and sign-in details for it.
- Your prompts, template answers and uploaded files are sent to AI and research service providers overseas, in Singapore and the United States, to generate your documents. Section 7 lists every type of provider, what it receives, and where it is.
- We do not store your prompts, uploaded files or generated documents on our servers. They pass through our systems while your request is processed. Drafts are kept in your own browser, and in your GitHub repository if you choose to commit them.
- If you subscribe, card details go directly to our payment processor. We never see or store them.
- We do not sell personal information, show advertising, or use tracking or analytics cookies.
- Do not upload sensitive information or health information (see section 4), or identifiable information about other people unless you are allowed to share it.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account information | Name, email address, profile image, sign-in method | You, or the third-party sign-in service you choose to use |
| Content you submit | Product idea description, persona template answers, uploaded files (.txt, .md, .csv, .json), persona content used to generate a journey | You |
| Generated content | Personas, journeys, images, narration, music | Generated by AI service providers for you |
| Billing information | Plan, subscription status, billing period and payment history. Card details are collected directly by our payment processor | You and our payment processor |
| GitHub connection | GitHub username, an encrypted access token, the repositories you select | GitHub, if you connect it |
| Usage and account records | Credit balance, generation counts and timestamps (for rate limiting), consent records (document version and time accepted) | Generated by the Service |
| Technical information | IP address, browser and device information, session cookies, error logs linked to your account ID | Your device and our service providers |
We do not collect government identifiers or precise location.
3. Why we collect it
We collect, hold, use and disclose personal information to:
- create and secure your account and keep you signed in;
- generate personas, journeys, templates and media you ask for, including sending your content to the service providers in section 7;
- save documents to GitHub when you ask us to;
- process subscriptions and payments, and track credits;
- apply fair-use limits, rate limits and abuse protection;
- keep a record of your acceptance of our terms and this policy;
- keep the Service running, diagnose faults and protect it against misuse;
- respond to your requests and complaints, and send service messages about your account and billing; and
- comply with the law, including tax and record-keeping obligations.
We only use personal information for these purposes or a related purpose you would reasonably expect, unless you consent or the law requires or allows it (APP 6).
Without this information we cannot provide the Service. The Service needs an account and needs to send your content to AI service providers. You may use a pseudonym as your display name. Anonymous use is not practicable because credits, billing and security require an account (APP 2).
We do not use your content to train AI models, and we choose AI service terms that do not allow providers to train on it.
4. Sensitive information, health information and other people's information
The Service is designed for fictional, research-based personas. It is not designed to process information about real, identifiable people.
- Do not submit sensitive information as defined in the Privacy Act. This includes health, genetic or biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and trade-union membership. It covers you and anyone else. We do not intend to collect sensitive information. If you submit it anyway, we treat it as provided with your consent solely for generating your document (APP 3.3), and it is not stored on our servers.
- Health information is also regulated by State and Territory laws, such as the Health Records and Information Privacy Act 2002 (NSW) and the Health Records Act 2001 (Vic). Do not upload patient, client or clinical records.
- Interview notes, survey exports and research files must be de-identified before upload. Remove names, contact details and anything else that could reasonably identify a person, unless you have the individual's consent or other lawful authority to share it with us and our service providers for this purpose.
5. How we hold and protect it
- Credit, plan and subscription records are held in a database hosted in Sydney, Australia. Account records are held by our authentication service provider. GitHub access tokens are encrypted before storage.
- Data is encrypted in transit (HTTPS/TLS). Access to production systems is restricted to authorised personnel.
- Drafts you are working on are saved in your browser's local storage on your device. They are removed when you finish, are no longer restored after 7 days, and are deleted when you clear your browser data. We cannot see them.
- Retention:
- Account and credit records are kept while your account is open, then deleted within 30 days of account closure.
- Billing and payment records are kept for as long as tax law requires (generally 5 years).
- Operational logs are kept for a short period.
- Content sent to AI service providers is processed to produce your result and not stored by us. Providers may keep it for limited periods under their terms, for example for abuse monitoring.
- We take reasonable steps to destroy or de-identify personal information we no longer need (APP 11.2).
6. Cookies and similar technologies
We use only strictly necessary cookies and storage:
- session cookies, to keep you signed in securely;
- a short-lived security cookie used when you connect GitHub, to prevent cross-site request forgery;
- cookies set by our payment processor during checkout, for fraud prevention;
- browser local storage, for your drafts.
We do not use advertising, analytics or cross-site tracking cookies. Because of this, we do not show a cookie banner.
7. Data residency and overseas disclosure (transparency statement)
Our database is hosted in Australia, but most of the Service runs overseas. When you use the Service, your personal information, including your prompts, template answers and the contents of files you upload, is disclosed to and processed by the service providers below, in the United States and Singapore, and other countries where our providers run servers (our primary AI text-generation service never processes data in mainland China).
| Service provider (by function) | What they receive | Where |
|---|---|---|
| Primary AI text-generation service (writes personas, journeys and templates) | Idea description, template answers, uploaded file contents, and persona content used to write a journey | Singapore (storage). Processing may happen on the provider's servers in other countries, never in mainland China |
| Backup AI text-generation services (used only when the primary service is unavailable) | The same as the primary AI text-generation service | United States and other countries where those providers operate |
| Web-research services (find and cite public sources) | Idea description only (never uploaded files) | United States and other countries where those providers operate |
| AI media-generation service (images, narration and music) | Generated persona and journey content | United States and other countries where the provider operates |
| Authentication and account-management service | Name, email address, sign-in method, profile image, and technical data such as IP address and device information | United States |
| Payment processor (paid plans only) | Name, email address, billing details and card details (card details go straight to the processor and are never seen by us) | United States and other countries where the processor operates |
| Website hosting and request-processing service | All requests to the Service while they are processed, plus short-lived logs containing your account ID and error details | United States (request processing); global content-delivery network |
| Database hosting service (credits, plan and subscription status) | Account ID, credit balance, plan, subscription status and billing-cycle dates | Australia (Sydney) |
| GitHub, the code-hosting platform you choose to connect (only if you connect it) | Your GitHub account identity, an encrypted access token, and the documents you choose to commit | United States |
Where our primary AI text-generation service processes data. The provider stores data in Singapore, and processing may take place on its servers in other countries, but never in mainland China. Under its terms, customer data is not used to train models.
Which provider handles a request. Each request goes to one AI text-generation service at a time. If that service is unavailable, the request automatically moves to a backup service. So any of the AI text-generation services above may process a given request.
Our accountability. Before disclosing personal information overseas, we take reasonable steps to ensure the recipients handle it consistently with the APPs (APP 8.1). We do this by selecting providers whose commercial terms include confidentiality, security and data-use restrictions. The overseas recipients are not themselves bound by the Privacy Act, and foreign laws may allow authorities there to access data. We remain accountable for their handling of your personal information as required by section 16C of the Privacy Act. We do not ask you to waive this protection.
Want more detail? Email privacy@wahub.ai to ask which kinds of provider handle your information. We will answer in line with APP 12, subject to our confidentiality obligations to those providers.
8. Other disclosures
We do not sell or rent personal information. We only disclose it:
- to the service providers in section 7;
- when you direct us to (for example, committing to your GitHub repository, which may be public if your repository is public);
- if required or authorised by law, such as a court order or a request from an enforcement body under APP 6.2; or
- to a successor if our business is sold or restructured, subject to this policy.
We do not engage in direct marketing. If we ever send marketing messages, we will first ask for your consent and include an unsubscribe option in every message, as the Spam Act 2003 (Cth) and APP 7 require. Service messages, such as sign-in codes, receipts and security notices, are not marketing.
9. Automated processing and AI
- Content generation. Documents are generated automatically by AI models. They are about fictional personas and are not decisions about you. See the AI Disclaimer.
- Automated account controls. Credit limits, rate limits and abuse protection run automatically using your account ID, plan and usage counts. They can temporarily stop you generating content (for example, when credits run out or too many requests arrive at once). They do not use your content, and no other decision about you is made solely by automated means. If you think an automated control has affected you unfairly, contact us and a person will review it.
This section is our disclosure of automated decisions under APP 1.7–1.9 of the Privacy Act, which apply from 10 December 2026.
10. Access, correction and deletion
- You can ask to access or correct the personal information we hold about you (APPs 12 and 13). Email privacy@wahub.ai. We will verify your identity, respond within 30 days, and not charge you for making a request. If we refuse a request, we will explain why in writing and tell you how to complain.
- You can update your name, email and profile image, or delete your account, from your profile menu in the Service.
- Disconnecting GitHub deletes the stored access token immediately.
11. Data breaches
If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires (Part IIIC of the Privacy Act).
12. Children
The Service is for people aged 18 or over. We do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
13. Western Australia and public-sector users
The Privacy and Responsible Information Sharing Act 2024 (WA) (PRIS Act) applies to WA public entities, and to contracted service providers only where a WA government contract requires it. It does not otherwise apply to us.
If you are a WA public entity (or a public body in another jurisdiction), do not upload personal information your organisation holds until we have signed an agreement that sets out the privacy obligations (including any Information Privacy Principles) your organisation needs to pass on to us. Contact us to arrange this.
14. Complaints
Contact us first at privacy@wahub.ai or PO Box 8400, South Perth WA 6151. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au, by phone on 1300 363 992, or at GPO Box 5288, Sydney NSW 2001.
15. Changes to this policy
We will publish updates here with a new version and effective date. For significant changes, we will ask you to review and accept the updated policy in the Service before you continue using it.
16. Contact
Customer Experience Insight Pty Ltd · ABN 61 634 039 759 PO Box 8400, South Perth WA 6151 privacy@wahub.ai