Guvn.Ai helps navigate Australia’s complex AI regulations.

About this policy

Guvn.Ai Pty Ltd ("Guvn.Ai", "we", "us") is an Australian Privacy Principle (APP) entity bound by the Privacy Act 1988 (Cth). This policy explains how we manage personal information about visitors to our website, prospective customers, customers, and individuals whose data passes through the Guvn.Ai platform.

Personal information we collect

• Identifying information, name, business email, organisation, role and phone number, where you provide it through demo requests, contact forms or direct correspondence.
• Customer account information, single sign-on (SSO) identifiers, role assignments and audit metadata for users of the Guvn.Ai platform.
• Technical information, IP address, browser type, device identifiers, pages visited and timestamps, collected through standard server logs and cookies.
• Operational telemetry, within customer environments, the platform processes metadata about AI tool usage, identity events and policy attestations. This is governed by the customer's data processing agreement and is not used for our own marketing.

We do not knowingly collect sensitive information unless it is necessary for a specific purpose and we have your consent.

How we use your information

We use personal information to provide and improve the Guvn.Ai platform, respond to enquiries and customer support matters, send service communications, meet our legal and contractual obligations, and conduct internal analytics and product development. You can opt out of marketing communications at any time.

When we disclose information

We disclose personal information only as permitted by the Privacy Act: to service providers under confidentiality obligations, to professional advisers, where required or authorised by Australian law, and in connection with a corporate transaction where the recipient agrees to comply with this policy. We do not sell personal information.

Our infrastructure is hosted in Australia. Where we engage overseas service providers, we take reasonable steps to ensure they handle personal information consistently with the APPs.

Storage and security

We hold personal information in encrypted form and apply safeguards aligned to ISO/IEC 27001 expectations. Access is restricted to staff with a legitimate business need. We retain personal information only for as long as it is needed for the purposes outlined in this policy or as required by law.

Access, correction and complaints

You have a right to request access to the personal information we hold about you and to ask us to correct any information that is inaccurate. We respond to access and correction requests within 30 days.

If you believe we have breached the APPs, you may complain to us at hello@guvn.ai. If you are not satisfied with our response, you may refer the matter to the Office of the Australian Information Commissioner, oaic.gov.au · 1300 363 992.

Acceptance

These terms govern your access to and use of guvn.ai (the "Website"). By accessing the Website you agree to be bound by these terms. The Website is operated by Guvn.Ai Pty Ltd, registered in Australia with its principal place of business in Brisbane, Queensland.

Permitted use

You may access and view the Website for lawful business and personal informational purposes. You must not use the Website in a way that breaches any law, interfere with its operation or security, attempt to gain unauthorised access, scrape or systematically extract content without our prior written consent, or use the Website to transmit malicious code or to harass, defame or impersonate any person.

Intellectual property

All content on the Website, including text, graphics, logos, the Guvn.Ai name and mark, the platform interface and code, is owned by or licensed to Guvn.Ai Pty Ltd and is protected by Australian and international intellectual property laws. You may view and print pages for personal or internal business reference. You may not reproduce, modify, distribute, publish or commercially exploit any content without our prior written permission, except as permitted by the Copyright Act 1968 (Cth).

Information accuracy

The Website is provided for general information only. It does not constitute legal, regulatory, financial or professional advice and should not be relied on as such. Regulatory references on the Website are summary in nature; the underlying instruments prevail.

Liability and Australian Consumer Law

To the maximum extent permitted by law, the Website and its content are provided "as is" and we exclude all warranties, representations and conditions, whether express or implied. Nothing in these terms excludes, restricts or modifies any consumer right, guarantee or remedy that cannot be excluded under the Australian Consumer Law or any other applicable law.

Where our liability for breach of a non-excludable consumer guarantee can be limited, our liability is limited, at our option, to the supply of the services again, or the payment of the cost of having the services supplied again. Subject to the above, we are not liable for any indirect, special, incidental or consequential loss arising out of your use of the Website.

Governing law

These terms are governed by the laws of Queensland, Australia. Any dispute arising out of or in connection with these terms is subject to the exclusive jurisdiction of the courts of Queensland and the federal courts sitting in Queensland.

Our approach

We design the platform around a core principle: process the minimum data necessary, retain it for the shortest period required, and surface it only to authorised parties. The platform observes metadata about AI usage; it does not store the prompts, outputs or document content that flow through customer AI tools.

Frameworks and alignment

• ISO/IEC 27001, information security management system aligned to the 2022 standard. Annex A controls implemented across the organisation.
• APRA CPS 234, designed to support APRA-regulated customers' obligations on third-party information security.
• ACSC Essential Eight, Maturity Level 2 across the eight mitigation strategies, with Maturity Level 3 in progress.
• SOC 2 Type II, Trust Services Criteria implementation in progress. Audit window opens Q3 FY26.

Data residency

All customer production data is hosted in Australia.

Access and infrastructure

• Single sign-on via SAML 2.0 or OpenID Connect, integrated with the customer's identity provider.
• Multi-factor authentication required for all administrative and operational access.
• Role-based access control with least-privilege defaults and quarterly access reviews.
• Audit logging of all access to customer data, retained for seven years and exportable on request.
• Data encrypted in transit (TLS 1.3) and at rest (AES-256), with keys managed in AWS KMS.
• Network segmentation between application tiers and customer-isolated data planes.

Assurance and incident response

We run continuous vulnerability scanning across application code, dependencies and infrastructure. Independent penetration tests are conducted at least annually. Security telemetry is centralised, monitored on a 24/7 basis, and tied to documented response runbooks.

We maintain a documented incident response plan. Customers are notified of any incident affecting their data within timeframes consistent with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 and any specific contractual notification obligations. For APRA-regulated customers, the platform supports notification timeframes contemplated by APRA CPS 234.

Responsible disclosure

If you believe you have identified a vulnerability in the Guvn.Ai platform or website, please contact hello@guvn.ai before any public disclosure. We acknowledge reports within two business days and work with researchers in good faith.