Privacy Policy

Last updated: 18 October 2026

1. About this Policy

This Privacy Policy describes how Aicura Pty Ltd. ABN 85 696 789 876 ("Aicura", "we", "us", "our") collects, uses, holds and discloses personal information.

It covers the hosted Aicura service (the platform at aicura.app, which we run for our customers) and this marketing website. It applies to everyone whose personal information we handle, wherever they are. Sections 13 to 16 set out the rights that apply to you, including under the Australian Privacy Act, the EU and UK General Data Protection Regulation and US state privacy laws.

We're an APP entity under the Privacy Act 1988 (Cth) and we comply with the Australian Privacy Principles (APPs). This Policy is intended to meet our APP 1 transparency obligations. Where the EU General Data Protection Regulation (GDPR) or the UK GDPR applies to our handling of your personal information, this Policy also gives you the information those laws require.

2. Who we are

Aicura is an Australian company providing a software platform that helps organisations with their AI governance. We're based in Melbourne, Victoria, and we serve customers worldwide from Australia.

The hosted service runs in AWS data centres in Australia (Sydney, ap-southeast-2, with backups in Melbourne, ap-southeast-4). Customers in every country are served from there.

For the personal information described in this Policy that we decide how to use, Aicura Pty Ltd. is the controller (the organisation responsible for it). Our contact details are in section 21.

3. Our role for your organisation's data

Aicura plays two different roles, and this Policy treats them differently.

Where we are the controller. We decide how to use the information we need to run our business, such as account and sign-in details, billing records, support correspondence, website enquiries and briefing subscriptions. This Policy governs that information.
Where we act for your organisation. The content your organisation puts into the service, including its AI register, uploaded documents, assessments, discovery signals and the details of the users it adds, is processed on your organisation's instructions. For that content your organisation is the controller and Aicura is its processor, under our Data Processing Agreement. If you are an individual whose details appear in that content, your organisation is the right first contact for a request about it, and we will help them respond.

4. What personal information we collect

We collect a limited set of personal information directly from the people who sign up for, use or contact us about the Aicura service.

4.1 When you sign up

your full name
your work email address
your organisation's name, type, industry and jurisdiction (and APRA classification, where relevant)

Sign-in to the hosted service is handled by Auth0 (Okta), which holds your sign-in credentials. Your password is set and stored by Auth0 and never reaches Aicura's servers.

4.2 When you use the Aicura platform

email addresses, names and roles of additional users you add to your account
the AI register entries you create (these may include free-text descriptions identifying who is responsible for an AI system inside your organisation)
the documents you upload (privacy policies, governance policies and similar), which may incidentally contain personal information about other people, particularly your customers, employees or contractors
risk assessment, policy and support ticket content you create or submit
log data about your use of the platform, including page accesses, requests made and timestamps
where you enable discovery, the signals reported by the source systems you choose to connect (such as your identity provider, device management, cloud inventories, IT service management, code hosting, finance systems and workspace tools). These signals can include personal information about your own staff, for example the user associated with a sign-on to an AI service, or the person a managed device is assigned to. Signals from a connected code hosting source are limited to repository details and the AI SDKs and services identified in dependency and configuration files, and do not include file contents or commit or contributor information
where you run Aicura's enforcement or monitoring components in your own environment, the results those components report back, such as which rule fired and when. The AI prompts and responses themselves remain in your environment and are not sent to Aicura

4.3 When you contact us through our website

your name, email address, organisation, enquiry type and message via our website contact form
your email address, and the country of the briefing you chose, if you subscribe to our briefings
whatever else you choose to include in correspondence

4.4 What we don't collect

We don't ask for and don't collect any of the following.

payment card details (these are collected directly by Stripe, see section 7)
phone numbers
physical or postal addresses
date of birth
government-issued identifiers
sensitive information as defined in the Privacy Act, or special category data under the GDPR (health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, biometric data and similar)

If you happen to include any of these in a document you upload or in correspondence with us, we will hold them as part of that document or that correspondence, but we don't ask for them and don't have a specific use for them.

5. How we collect information

We collect most information directly from you, through the signup form, the platform interface, support tickets, the website contact form and email correspondence.

Where your organisation enables discovery, we also collect information from the source systems your organisation connects to Aicura for that purpose. Your organisation chooses which sources to connect and can disconnect them at any time. Information collected this way is collected on your organisation's instruction and held for your organisation's own governance record. If you are an employee whose details appear in those signals, your organisation is the entity that decided to connect the source, so a request about that information is best directed to them in the first instance, though you can also contact us using the details below.

We do not buy personal information from third parties or use enrichment services.

6. Why we use it, and our legal bases

We use personal information for the purposes below. The GDPR and UK GDPR require a legal basis for each purpose, so we name it alongside each one. Where we act for your organisation (section 3), your organisation decides the purposes and is responsible for the legal basis.

Creating and managing your account and your organisation's tenant, and providing the service. Performance of our contract with you or your organisation. Where your organisation adds you as a user, our legitimate interest, shared with your organisation, in providing the service it has subscribed to.
Billing and processing payments. Performance of our contract, and compliance with our legal obligations (for example tax record keeping).
Responding to support requests. Performance of our contract, or our legitimate interest in helping the people who use the service.
Sending transactional emails (welcome emails after signup, sign-in emails such as password set, password reset and verification, and billing emails such as receipts, invoices and payment notifications). Performance of our contract.
Sending our briefings, if you've subscribed. Your consent, which you give by confirming your subscription and can withdraw at any time through the unsubscribe link in every briefing.
Responding to enquiries through our website contact form or by email. Our legitimate interest in answering the people who contact us, or taking steps at your request before entering into a contract.
Keeping the service secure, investigating and resolving issues, and understanding which features are used. Our legitimate interest in running a secure and reliable service.
Complying with our own legal obligations, including keeping records and responding to lawful requests. Compliance with a legal obligation.
Establishing, exercising or defending legal claims, and in a sale or restructure of our business. Our legitimate interest in protecting and running our business.

Where we rely on legitimate interests, we have weighed them against your rights and expectations, and we use only the information we need. You can object to this processing as set out in section 13.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you. The AI features of the service analyse documents and draft content for your organisation to review, and do not make decisions about individuals.

7. How we share your information

7.1 Inside Aicura

Authorised Aicura personnel may access your data to provide support, investigate issues, curate regulatory content and operate the service. Operator access is restricted, brokered through controlled and audited mechanisms (federated single sign-on with multi-factor authentication), and there is no standing administrative access and no direct interactive path to the production database. Changes operators make to your data are recorded in our audit log alongside changes you make yourself.

7.2 With service providers (sub-processors)

We use a small number of third-party service providers to deliver the platform. We don't sell your information to any of them, and we don't allow them to use your information for their own purposes.

Amazon Web Services. Cloud infrastructure (compute, storage, databases). Australia (Sydney and Melbourne).
Amazon Web Services (Amazon Bedrock). AI model inference. Australia (Sydney or Melbourne through Bedrock's Australian cross-region inference, with embeddings in Sydney).
Auth0 (Okta). Sign-in to the hosted service, user identity and password management. Australia.
Stripe. Subscription billing and payment processing. United States.
Resend. Transactional email delivery (all outbound email from Aicura, including welcome emails, briefings, sign-in emails and billing emails). AWS Tokyo (ap-northeast-1), Japan.
Cloudflare. DNS, content delivery, web application firewall and request proxy. Global edge network.
Cloudflare R2. Storage of the Trust Centre pages a customer publishes. Asia-Pacific, served from the global edge network.
Cloudflare D1. Storage of website contact form submissions and briefing subscriptions. Global edge network.
Grafana Cloud. Application logging and observability. Australia.

We may update this list, and material changes will be reflected here. Our sub-processors page is the authoritative, current list, with what each provider sees and where it is hosted.

7.3 When the law requires it

We may disclose your information when we're required to by law, in response to a valid legal process, or to protect our rights or the safety of others.

7.4 In a business sale

If Aicura is sold or restructured, your information may be transferred to the new owner. We'll let you know if that happens.

8. AI processing

The Aicura platform uses large language models from Anthropic, accessed through Amazon Bedrock in Australia, to perform document analysis and content generation.

When you upload a document or run a workflow that generates AI output, your content is sent to Amazon Bedrock for processing. Under our agreement with AWS, the following applies.

your inputs and outputs are not used to train or improve the foundation models
the model providers (including Anthropic) cannot access your prompts or completions
your content is processed in Australia, in Sydney or Melbourne through Bedrock's Australian cross-region inference, with embeddings generated in Sydney, and stored at rest in Sydney

We log AI calls (prompt content and model output) for up to 90 days for operational debugging and quality assurance. After 90 days, those logs are automatically deleted.

9. International transfers

Aicura is based in Australia and the hosted service runs in Australia, so if you are outside Australia, your personal information is handled in Australia. The bulk of it never leaves Australia, including the documents you upload, the AI register, risk assessments, generated policies, support tickets, audit logs and AI processing.

Australia does not have an adequacy decision from the European Commission or the UK government. We handle transfers from the EU, EEA and UK in two ways, depending on our role.

Your organisation's data. Where your organisation in the EU, EEA or UK puts personal information into the service, the transfer to Aicura in Australia is covered by the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum, which are incorporated in our Data Processing Agreement.
Information we collect directly as controller. When you sign up, contact us or subscribe to our briefings, you give your information directly to Aicura, an Australian company, which holds it in Australia. That is a collection by us rather than a transfer from an organisation in Europe, but we apply the same protections to it that the GDPR and UK GDPR require, including the rights in section 13, the security measures in section 10 and the retention limits in section 11.

A few service providers handle limited information outside Australia (Stripe in the United States, Resend in Japan, and Cloudflare across its global network, with published Trust Centre pages stored in its Asia-Pacific region). Japan has an adequacy decision from both the European Commission and the UK. For the others, we rely on their data processing terms, which include the Standard Contractual Clauses or another transfer mechanism recognised under the GDPR and UK GDPR.

For Australian privacy law purposes (APP 8), we choose service providers that meet recognised security and data protection standards and take reasonable steps to ensure they handle your information consistently with the APPs.

10. Storage and security

We host the Aicura platform in AWS, with all primary infrastructure in the Sydney region (ap-southeast-2) and backups in the Melbourne region (ap-southeast-4), inside a separate AWS account used only for backups. Our security controls include the following.

encryption in transit (TLS 1.2 minimum, TLS 1.3 preferred) on all connections over public networks and to the database and AWS services
encryption at rest using customer-managed AWS KMS keys, scoped per environment and per data class, with a dedicated key for the immutable evidence store
multi-tenant data isolation enforced in two independent layers, at the database (PostgreSQL row-level security, which the tenant-facing role cannot bypass) and at the storage layer (per-request scoped credentials pinned to a single tenant's storage area)
an immutable evidence store and immutable authentication-audit storage, using AWS Object Lock so that, once written, those snapshots and logs cannot be altered or deleted for their retention period by anyone, including Aicura
private network architecture, with no public database endpoints and no direct or "break-glass" interactive access to the production database
restricted operator access via AWS Identity Center and federated single sign-on with multi-factor authentication, and no standing administrative access
AWS-managed threat detection (GuardDuty), vulnerability scanning (Inspector), security configuration monitoring (Security Hub, Config), and centralised, validated activity logging (CloudTrail) written to a dedicated audit account the application accounts cannot modify
point-in-time recovery and daily snapshots for the database, replicated cross-region to Melbourne and held in a backup vault locked to a minimum retention period, and object storage with versioning, Object Lock and cross-region replication to Melbourne

No system is 100% secure, and we don't promise that your information will never be subject to unauthorised access.

11. Retention

Your account and tenant data (register, documents, assessments, generated policies). For the duration of your subscription.
AI processing logs (prompts and model output). Up to 90 days.
Audit logs (records of changes to your data). 7 years from the date of the change.
Billing records (Stripe IDs, contracts, invoices). 7 years from the end of our relationship.
Authentication logs (login events, password resets, identity-provider activity). 7 years, held in dedicated AWS S3 audit storage with Object Lock.
Website contact form submissions. 2 years.
Briefings subscription data. Until you unsubscribe, plus 30 days.
Support correspondence. For the duration of your subscription, plus 12 months.

After your subscription ends, we keep your tenant data for 60 days to allow for export or reactivation, then delete it (other than the categories above that we retain for our own legal, tax or audit purposes).

You can ask us to delete your tenant data sooner, as set out in section 13.

12. Cookies, local storage and tracking

12.1 This website

This marketing website uses no tracking. It runs no analytics, tracking pixels or behavioural advertising tools, and it sets no cookies of its own. Cloudflare, which serves the site, may set a strictly necessary security cookie to protect it from automated abuse. There are no non-essential cookies.

The site keeps two preferences in your browser's local storage, your light or dark theme and the country you chose, so the site shows the right prices and links on your next visit. Where you haven't chosen a country, the site asks Cloudflare for the country of your connection, which Cloudflare works out as part of serving the page, and keeps that answer in your browser's session storage for the current visit. These values stay in your browser. They are not sent to us or to anyone else, with one exception. When you follow a sign-up link, the country code is added to the link so the sign-up page can show your currency. You can clear them at any time through your browser settings.

12.2 The Aicura platform

The Aicura platform does not set tracking or analytics cookies. The web app uses browser local storage to hold authentication tokens and your interface preferences (light or dark theme, tour completion), but does not write its own cookies. Fonts and other static assets are served from Aicura's own domain, and no third-party font services or asset CDNs are loaded.

The platform is served behind Cloudflare. Cloudflare may set technical cookies for bot protection, security challenges and Cloudflare Access authentication. These cookies are necessary for the security and operation of the platform.

Auth0 sets cookies on its own domain when you sign in. These are necessary for authentication and are governed by Auth0's own privacy policy.

13. Your rights

You have the rights below over the personal information we hold about you as controller. Some depend on the law that applies to you, but we honour each of them for everyone wherever we reasonably can. To use any of them, email [email protected]. We may ask you to confirm your identity before we act on a request. We aim to respond within 30 days, and always within the time the law that applies to you allows. There is no charge.

Access. Ask for a copy of the personal information we hold about you. For tenant administrators, this includes the ability to request an export of your organisation's data on the platform.
Correction (rectification). Ask us to correct information that is wrong, incomplete or out of date. You can edit most information about yourself directly inside the platform.
Erasure. Ask us to delete your personal information. We aim to action deletion requests within 30 days. We may retain limited information where the law requires us to (for example, billing records for tax purposes, as set out in section 11).
Restriction. Ask us to limit how we use your information, for example while we check a correction you've asked for.
Portability. Ask for the information you gave us in a structured, commonly used, machine-readable format, or for us to send it to another organisation where that is technically feasible.
Objection. Object to our use of your information where we rely on legitimate interests. We will stop unless we have compelling grounds that override your interests, or need the information for legal claims.
Withdrawing consent. Where we rely on your consent, such as for our briefings, withdraw it at any time through the unsubscribe link in every briefing or by emailing us. Withdrawing consent doesn't affect anything we did before you withdrew it.

Where your request is about content your organisation put into the service (section 3), we will pass it to your organisation and help them respond, as the Data Processing Agreement requires.

14. Complaints

If you think we've mishandled your personal information, contact us first at [email protected]. We'll investigate and respond within 30 days. You can also complain to a privacy regulator at any time, including the following.

In Australia, the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, phone 1300 363 992, or GPO Box 5288, Sydney NSW 2001.
In the EU or EEA, the data protection authority in the country where you live, work or where you think the problem happened. The European Data Protection Board lists them at edpb.europa.eu.
In the United Kingdom, the Information Commissioner's Office (ICO) at ico.org.uk.

15. US residents

If you live in the United States, some state privacy laws give you rights over your personal information, such as rights to know what we collect, to access it, to correct it and to delete it. You can use those rights as described in section 13, and you can ask someone you have authorised to make a request for you. We won't treat you differently for using them.

We don't sell your personal information, share it for cross-context behavioural advertising or use it for targeted advertising or profiling, and we haven't done so in the past 12 months. Because of that, there is nothing to opt out of, and our sites need no opt-out link. We don't use sensitive personal information to infer characteristics about you. The categories of personal information we collect, where they come from, why we use them and who we disclose them to are set out in sections 4 to 7.

16. Data breaches

If a data breach occurs that meets the threshold for notification under the Privacy Act, we'll notify affected individuals and the OAIC in line with the Notifiable Data Breaches scheme. Where another law that applies to us requires notice to a regulator or to affected individuals, we will give it within the time that law requires. Where the breach affects content we process for your organisation, we'll tell your organisation as the Data Processing Agreement requires.

17. Children

The Aicura platform is intended for use by organisations through their authorised employees and contractors. It is not intended for individuals under 18. We don't knowingly collect personal information from children under 18. If you believe we've collected information from a child, contact us and we'll delete it.

18. Links to other sites

Our website and the platform link to sites we don't run, such as regulators' and standards bodies' pages. Their own privacy policies apply when you visit them.

19. Changes to this Policy

We may update this Policy. The "Last updated" date at the top reflects the most recent change. If we make a change that materially affects how we handle personal information, we'll let existing customers know by email or through the platform.

20. Related documents

Our Terms of Service govern use of the service, and our Data Processing Agreement covers the personal information we process for customers. The data handling and sub-processors pages give more detail on where data is held and who processes it.

21. Contact

Privacy contact: [email protected]

Aicura Pty Ltd.
ABN: 85 696 789 876
Melbourne, Victoria, Australia