Privacy Policy

Platform is run by Ecodia Pty Ltd (ABN 89 693 123 278), in Australia, which is responsible for the personal information described here. Ecodia Labs Pty Ltd owns the software and licenses it to Ecodia Pty Ltd. In this policy “we”, “us” and “Ecodia” mean Ecodia Pty Ltd.

We hold ourselves to the Australian Privacy Principles in the Privacy Act 1988 and wrote this policy to that standard.

• Your account. Your name, email address and user ID, and how you sign in (a password, which is stored only as a secure hash, or Google or Apple). We use them to sign you in and to show your team who you are.
• Your organisation’s work. The tasks, docs, files, decisions and team chats in your organisation, who its members are, their roles and seats, and counts of how much AI each person uses. We keep them so your organisation can do its work and its owners can see what the AI costs.
• You. What your AI remembers about you, the rules you give it, the people and errands you save, and the services you connect for it. We keep them so your AI can work for you.
• Chats with your AI, and the photos, documents and voice you send it. If you connect a mailbox for your AI, the email it reads there.
• Your sites. Their content, images and settings, so we can build, edit and publish them for you.
• Saved keys and passwords you give your AI so it can use your tools, and bank statement files, only if you pair the vault in the phone app and use its bank feed.
• Payments. Your organisation’s plan, seats and payment history. Card details go to Stripe and never reach us.
• Error and performance reports when something in Platform fails: technical details of the device, browser and page. We do not attach your name or email to them.
• Which pages you open in Platform, recorded in our own database, so we can see what is used and fix what is not.

Our databases and every call to an AI model stay in Australia. Your information is kept in our databases with Supabase in Sydney, Platform runs on Vercel in Sydney, the engine that runs your AI runs on Google Cloud in Sydney, and the AI model is Anthropic’s Claude, running on Amazon Web Services in Sydney (AWS Bedrock).

Some information does leave Australia, and this is all of it:

• error and performance reports, which go to Sentry in the United States;
• payments, which go through Stripe (the United States, India and other countries), and, for subscriptions bought in the app, Apple, Google and RevenueCat (the United States);
• email that Platform sends, such as invites and notifications, which goes out through Resend in the United States;
• your sites' code, which is kept on GitHub (the United States and other countries);
• and anything you choose to connect, such as Google, Notion or Slack, which receives only what that connection needs.

Each of these providers handles the information only to provide its service to us or to you. Apple and Google also deliver the app’s notifications and, if you choose them, sign you in.

Inside your organisation, members see its shared work according to their role, and guests see only what is addressed to them. Your chats with your own AI are yours alone: your organisation’s owners and admins see how much AI each person uses, never what was said in a private chat.

At Ecodia, we look at your information only to give you support you asked for, to fix a fault, to keep Platform secure, or when the law requires it.

To do a job, your AI sends the model your request and the context it needs, such as your task, your site’s structure or a document you gave it. It never sends your saved passwords or keys. Platform asks your permission before your information is sent to the AI for the first time.

We do not use your information to train AI models, and Amazon Web Services states that it does not use what is sent to its Bedrock models to train them.

Your AI drafts, sorts, summarises, chases and edits, and it can carry out tasks with the tools and connections you give it. A change it makes to a website must pass an automated safety check before it goes live, and the parts of Platform that handle money are written and checked by people.

Platform does not make decisions that significantly affect a person, such as hiring, pay, money, or who can see what. A person makes those.

Everything it does on its own, what it asks you first, and what always stays with a person is listed on What your AI does, what stays human.

• Your account, You, your chats in our database, and your saved keys and passwords: until you delete them or your account.
• Your organisation's work: for as long as the organisation keeps it.
• Your sites: until you delete the site or your account.
• Copies of recent conversations that the engine running your AI keeps on Google Cloud in Sydney: these are not yet removed automatically when you delete your account, and we remove them when you ask.
• Backups of our database: up to 14 days, then deleted, so deleted information has left our backups within 14 days.
• Error reports: up to 90 days, with Sentry.
• Invoices and payment records: five years, as Australian tax law requires.

You can correct most of your information where you see it in Platform. Export on You downloads a copy of your account’s data, including your sites, your AI’s memory and documents, and your saved people and errands; ask us by email for a copy of your chats. You can delete your whole account from You, and Delete your account explains how, including by email if you cannot sign in and how to delete only some of your data.

For anything else, or to ask what we hold about you, email code@ecodia.au. We answer within 30 days.

Every connection to Platform is encrypted. Our database is protected by rules that let a person reach only their own and their organisation’s information. Keys and passwords you save are encrypted with AES-256-GCM, cannot be read from the app, and are decrypted by our server only at the moment a job you asked for needs one, with every use written to an audit log.

Platform is not for children under 16, and we do not knowingly collect their information.

If you think we have mishandled your information, email code@ecodia.au. We will look into it and reply within 30 days. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

When this policy changes we update this page and the date at the top, and we keep every earlier version.

Write to code@ecodia.au about anything on this page. Every message gets a reply from Ecodia. Our AI writes most replies, and anything it cannot settle goes to a person at Ecodia. For where each kind of data is stored, see Data handling.