Aisembl Pty Ltd ("Aisembl", "we", "us", "our") is committed to protecting your personal information. This Privacy Policy explains how we collect, use, store, and disclose personal information when you use the Aisembl platform at www.aisembl.com (the "Platform"), and how you can contact us if you have any questions.

This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs"). Capitalised terms that are not defined here have the meaning given in our Terms and Conditions.

1. Scope

This Privacy Policy applies to personal information we collect through:

the Aisembl web application and any associated APIs;
account registration, sign-in, and onboarding flows;
Content you upload, enter, or transmit through the Platform;
product-import flows, including AI-assisted product import; and
support and other communications you have with us.

It does not apply to third-party websites or services that we link to or integrate with — those are governed by their own privacy policies.

2. The personal information we collect

2.1 Information you provide to us

Account information — your email address, password (stored only as a salted hash by our authentication provider), and the role you selected at signup (Builder, Designer, App Developer, or User / Homeowner).
Profile information — including the Company you create or join, your display name where provided, and any branding details a Builder or Designer chooses to add to their Company profile (logo, tagline, ABN, contact details, address).
Project Content — everything you enter into the Platform as part of a Project, Space, Template, or product specification. This includes product names, descriptions, prices, supplier information, images, notes, comments, sign-off status, and any other text or files you upload.
Invitations — when you invite a collaborator (for example, a Homeowner) to a Project, we process the email address you supply for that collaborator.
Communications with us — if you email, chat, or otherwise contact us, we keep a record of that communication and our reply.

2.2 Information we collect automatically

Technical information — IP address, browser type and version, operating system, device type, referring URL, and timestamps. This is recorded in our server and hosting provider logs.
Usage information — pages visited, features used, and approximate session timing. We use this in aggregate to improve the Platform.
Cookies and similar technologies — see our Cookie Policy for the full list. The Platform currently uses only essential cookies and similar local-storage values required for authentication and basic functionality.

2.3 Information we collect from third parties

Authentication provider (Supabase) — when you sign up, our authentication provider records your email, password hash, and session metadata, and shares this with us so we can identify your account.
AI Product Import — when you submit a product URL for AI-assisted import, we fetch the page at that URL and pass selected text from it to our AI provider for normalisation. Information returned from this flow is shown back to you for review before being saved to the Platform.

2.4 Personal information about third parties

The Platform allows you to enter information about other people — for example, the email address of a Homeowner you are inviting as a collaborator, or supplier contact details on a product specification. By submitting that information, you confirm that you have the rights and any necessary consents to do so. We rely on you to comply with the APPs when collecting that information.

3. Sensitive information

We do not knowingly collect "sensitive information" as defined in the Privacy Act (such as information about health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record). Please do not upload sensitive information to the Platform — it is designed for construction specification data, not personal records.

4. How we use your personal information

We use your personal information to:

provide, operate, and maintain the Platform;
create and authenticate your account, and provision the right role-based access;
store, organise, and display the Content you enter;
enable collaboration features (sharing Projects, invitations, suggestions, sign-offs);
provide the AI Product Import feature when you use it;
communicate with you about your account, including service notices, security alerts, and changes to these terms;
respond to support enquiries;
detect, investigate, and prevent fraudulent, unauthorised, or unlawful activity;
improve and develop the Platform in aggregate (we do not use your individual Content to train AI models); and
comply with our legal obligations.

We do not sell your personal information. We do not currently send marketing communications. If we decide to in the future, we will obtain your consent first and provide an unsubscribe mechanism in every message.

5. When and with whom we share your information

5.1 Within the Platform

Your Company — if you belong to a Company (as a Builder, Designer, or App Developer member), authorised members of that Company can see Content within that Company's workspace.
Collaborators — if you invite a collaborator to a Project, they can see the Content within that Project to the extent permitted by their permission level (view, comment, suggest, or edit).
Public Space View — if a Builder or Designer chooses to share a Space publicly (via the QR-coded /s/:spaceId URL), the displayed information is sanitised — it excludes cost, supplier contact, and other internal fields — but the URL itself is shareable by anyone who has it, and we do not require authentication to view it.

5.2 Sub-processors and service providers

We rely on the following third-party service providers to operate the Platform. They each act as our sub-processor and are subject to their own privacy and security commitments.

Provider	Purpose	Location of processing
Supabase (Supabase Inc.)	Hosted database, authentication, storage, file uploads.	Region selected for our project (to be confirmed).
OpenAI (OpenAI, L.L.C.)	AI Product Import — normalisation of URL content into product fields. We do not enable model training on the prompts we send.	United States.
Replit (Replit, Inc.)	Hosting for the web app and API server.	United States.
Email delivery (provider for transactional email — to be confirmed)	Sending confirmation, password-reset, and invitation emails.	United States.

We will update this table whenever we change sub-processors. Where any sub-processor processes data outside Australia, we take reasonable steps to ensure that they handle your personal information in a way that is consistent with the APPs.

5.3 Other circumstances

We may also disclose personal information:

in response to a lawful request from a court, regulator, or law-enforcement agency;
to enforce our Terms and Conditions or investigate a suspected breach;
to protect the rights, property, or safety of Aisembl, our users, or others;
in connection with a merger, acquisition, financing, sale, or restructure — in which case we will give you reasonable notice and continue to honour the commitments in this policy; and
with your consent.

6. Where your information is stored

The Platform's primary database and authentication services are hosted by Supabase in the region we have selected for our project (to be confirmed and disclosed here). Backups, hosting infrastructure, and AI processing may take place in other jurisdictions, including the United States — see Section 5.2 for the current list of providers.

By using the Platform, you acknowledge that your personal information may be processed and stored outside Australia by these providers. We take reasonable steps to ensure that any overseas recipient of your personal information protects it in a way consistent with the APPs.

7. How long we keep your information

Account information — for as long as your Account is active, plus a reasonable period thereafter to comply with our legal obligations and resolve disputes.
Project Content — while your Account is active. If your Account is deleted, we will take reasonable steps to delete Content within 90 days, except where retention is required by law or where Content is shared into Projects owned by another Company (in which case it remains available to that Company until they delete it).
Server logs — typically retained for up to 90 days for diagnostic and security purposes, then deleted on a rolling basis.
Backups — the Platform's hosted database is backed up by Supabase. Residual copies of your information may persist in those backups for the duration of the backup retention window, and will be overwritten in the normal course of backup rotation.
Communications — emails and support records are retained for a reasonable period after the matter is resolved.

If you would like us to delete your account or specific Content sooner, please contact us using the details in Section 11.

8. Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Those steps include:

TLS encryption of all traffic between your browser and our servers;
password hashing by our authentication provider;
role- and row-level access controls on the database;
restricted administrative access; and
routine review of dependencies and platform configuration.

The Platform is currently offered as a Minimum Viable Product (MVP) / pilot. While we use industry-standard security practices, we cannot guarantee absolute security of information transmitted over the internet, and we ask that you avoid uploading sensitive information that you would not want exposed in the event of a security incident.

If a notifiable data breach occurs, we will notify affected users and the Office of the Australian Information Commissioner ("OAIC") in accordance with the Privacy Act.

9. Your rights under the Australian Privacy Principles

Under the APPs, you have the right to:

Access — request a copy of the personal information we hold about you.
Correction — ask us to correct personal information that is inaccurate, out of date, incomplete, or misleading.
Anonymity / pseudonymity — where lawful and practicable, deal with us without identifying yourself. Authentication on the Platform requires an email address, but you may use a pseudonymous display name.
Withdraw consent — where our processing is based on consent (for example, optional cookies — see Cookie Policy), you can withdraw that consent at any time.
Make a complaint — see Section 10 below.

To exercise any of these rights, contact us using the details in Section 11. We will respond within a reasonable timeframe — generally within 30 days. We may need to verify your identity before acting on a request.

10. Complaints

If you believe we have breached the APPs or mishandled your personal information, please contact us first at legal@aisembl.com with the details of your complaint. We will investigate and respond within a reasonable timeframe, generally within 30 days.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner:

Website: https://www.oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Mail: GPO Box 5288, Sydney NSW 2001

11. Contact us

For privacy questions, access / correction requests, or complaints, contact:

Aisembl Pty Ltd
Email: legal@aisembl.com
Web: www.aisembl.com

We aim to respond to all privacy enquiries within 5 business days.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" at the top of this page. If the changes are material, we will notify you via the email address associated with your Account or through a notice on the Platform. Your continued use of the Platform after the changes take effect means you accept the revised policy.