Privacy Policy

Interpretation and Definitions

Interpretation

The words of which the initial letter is capitalised have meanings defined under the following conditions. The following definitions shall have the same meaning regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means a unique account created for you to access the Service or parts of the Service.
• Affiliate means an entity that controls, is controlled by or is under common control with a party, where "control" means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.
• AI Features means the features of the Service that use artificial intelligence to generate, refine, simulate or otherwise assist with workflows and related content based on the descriptions and instructions you provide.
• Company (referred to as either "the Company", "We", "Us" or "Our" in this Privacy Policy) refers to Assess.one Technologies Pty Ltd, 715/2B Defries Avenue, Sydney, NSW, Australia.
• Cookies are small files that are placed on your device by a website or application, containing details of your usage or an identifier used to operate the Service.
• Device means any device that can access the Service, such as a computer, a mobile phone or a digital tablet.
• Integration (or Connected Account) means a third-party service or account that you choose to connect to the Service — such as an email, SMS or payment provider — using your own credentials, to extend the functionality of your workflows.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the assess.one application and website, together with all related features, including the AI Features and Integrations.
• Service Provider (or Sub-processor) means any natural or legal person who processes data on behalf of the Company — third-party companies or individuals engaged by the Company to facilitate or provide the Service, to perform services related to the Service, or to assist in analysing how the Service is used.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).
• Workspace refers to the logical environment within the Service where your Content and Data are stored and where you and your authorised users interact with the Service.
• You means the individual accessing or using the Service, or the company or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

The Data We Collect

Personal Data you provide

When you create an Account, use the Service, contact us or respond to a marketing communication, we may collect:

• Email address;
• First name and last name;
• Phone number (for example, to send you multi-factor authentication codes);
• Billing details, such as your name and billing address (payment card details are collected and processed directly by our payment processor, not stored by us); and
• The content of any messages or requests you send to us.

Usage Data

Usage Data is collected automatically when you use the Service. It may include your device’s Internet Protocol (IP) address, browser type and version, the pages of the Service you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Cookies and similar technologies

We use cookies and similar technologies that are necessary to operate the Service — for example, to keep you signed in and to maintain sessions — and, where permitted, to help us understand usage and improve the Service. You can control cookies through your browser settings; disabling necessary cookies may affect how the Service works.

Anonymous use before sign-up

If you use the Service before creating an Account, we create an anonymous session (identified by a cookie or similar identifier) so that we can generate and preserve your draft workflow. If you later create an Account, this activity may be associated with your Account.

Information from authentication providers

You can create an Account and sign in through our authentication provider, including using third-party sign-in options such as Google or Microsoft. If you register through, or otherwise grant us access to, such a service, we may collect Personal Data already associated with that account, such as your name and email address.

Prompts and inputs to the AI Features

When you use the AI Features, we collect the descriptions, instructions and other inputs you provide so that we can generate, refine and simulate workflows and related content for you.

Content and Data in your Workspace

We process the Content and Data you and your authorised users create, upload or submit within your Workspace — including data submitted through external forms you publish. Where that Content includes personal information about other people, please see "Content and Data You Store" below.

How We Use Your Personal Data

The Company may use Personal Data for the following purposes:

• To provide and maintain the Service, including to monitor its usage;
• To manage your Account and your registration as a user of the Service;
• To perform a contract with you, including for the products or services you have purchased;
• To contact you by email, telephone, SMS or other electronic communication regarding updates, security notices or information related to the Service;
• To provide you with news, special offers and general information about goods, services and events we offer, unless you have opted out;
• To manage and respond to your requests;
• To improve your account security, including using your phone number to send multi-factor authentication codes;
• For analytics — to understand usage trends, measure the effectiveness of our communications, and evaluate and improve the Service; and
• For business transfers, such as evaluating or conducting a merger, reorganisation or sale of some or all of our assets.

Legal Bases for Processing

Where data protection laws such as the EU or UK General Data Protection Regulation (GDPR) apply, we rely on the following legal bases to process your Personal Data:

• Performance of a contract — to provide the Service you have requested;
• Legitimate interests — to operate, secure, analyse and improve the Service, and to communicate with existing customers, provided these interests are not overridden by your rights;
• Consent — where required, for example for certain marketing or cookies; you may withdraw your consent at any time; and
• Legal obligation — to comply with applicable laws.

How We Share Your Personal Data

We may share your Personal Data in the following situations:

• With Service Providers (sub-processors): we use trusted third parties to help us operate the Service, including providers of authentication and identity management, cloud hosting and storage, artificial intelligence and model inference, payment processing, email and SMS delivery, and product analytics and error monitoring. A current list of our sub-processors is available on request from support@assess.one .
• For business transfers: in connection with any merger, sale of Company assets, financing or acquisition of all or part of our business.
• With Affiliates: in which case we will require them to honour this Privacy Policy.
• With other users: when you share information or interact in shared areas of a Workspace, other authorised users of that Workspace may see it.
• For legal reasons: as described in "Disclosure of Your Personal Data" below.
• With your consent: for any other purpose you agree to.

We do not sell your Personal Data.

AI Features and Your Data

The prompts and inputs you submit to the AI Features are processed by our AI service providers solely to generate the output you request and to operate, secure and improve the Service. We do not use the content of your workflows or your AI prompts to train third-party foundation models. AI-generated output may be inaccurate, and you are responsible for reviewing it before relying on it.

Integrations and Connected Accounts

When you connect a third-party account to the Service — such as an email, SMS or payment provider — you provide credentials that allow the Service to act on your behalf. These credentials are stored encrypted and are used only to operate the Integrations you configure. Data you send through a Connected Account is handled by that third-party provider in accordance with its own privacy policy and terms, over which we have no control.

Content and Data You Store

The Service enables you to collect, store and process data — including personal information — for example through the workflows and external forms you create.

Where you use the Service to process personal information about your own users, customers or other individuals, you act as the controller (or equivalent) of that information and we process it on your behalf as your processor / service provider, in accordance with your instructions and our agreement with you.

You are responsible for obtaining any necessary permissions and providing any required notices for the collection, storage and use of that information, and for ensuring your use of the Service complies with the laws that apply to you.

Retention of Your Personal Data

The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our legal agreements and policies.

Usage Data is generally retained for a shorter period, except where it is used to strengthen security or improve the functionality of the Service, or where we are legally obligated to retain it for longer.

International Data Transfers

Your Personal Data may be transferred to, stored in, or processed in countries other than the one in which you reside — including the Asia Pacific (Sydney) region, where our infrastructure is primarily hosted, and other locations where our service providers operate. These countries may have data protection laws that differ from those in your jurisdiction.

Where we transfer Personal Data internationally, we take steps reasonably necessary to ensure it is treated securely and in accordance with this Privacy Policy, including putting in place appropriate safeguards (such as standard contractual clauses or equivalent mechanisms) where required by applicable law. Your submission of information represents your agreement to that transfer.

Your Privacy Rights

Depending on where you live and subject to applicable law, you may have the right to:

• access the Personal Data we hold about you;
• correct inaccurate or incomplete data;
• delete your data;
• receive a copy of your data in a portable format;
• restrict or object to certain processing;
• withdraw consent where processing is based on consent; and
• lodge a complaint with a supervisory or data protection authority.

To exercise any of these rights, contact us at support@assess.one . We will respond within the timeframes required by applicable law. If you are in the EEA or the UK, you may also contact your local supervisory authority. If you are a California resident, you have rights under the CCPA/CPRA, including the right to know, delete and opt out of the sale or sharing of personal information; as noted above, we do not sell your Personal Data.

Deleting Your Personal Data

You have the right to delete, or request that we help delete, the Personal Data we have collected about you. The Service may allow you to delete certain information from within the Service, and you can update, amend or delete information by signing in to your Account and visiting your account settings.

You may also contact us to request access to, correction of, or deletion of any Personal Data you have provided to us. Please note that we may need to retain certain information where we have a legal obligation or lawful basis to do so.

Disclosure of Your Personal Data

Business transactions

If the Company is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law enforcement

Under certain circumstances, the Company may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (for example, a court or a government agency).

Other legal requirements

The Company may disclose your Personal Data in the good-faith belief that such action is necessary to:

• comply with a legal obligation;
• protect and defend the rights or property of the Company;
• prevent or investigate possible wrongdoing in connection with the Service;
• protect the personal safety of users of the Service or the public; and
• protect against legal liability.

Security of Your Personal Data

The security of your Personal Data is important to us. We use commercially acceptable means to protect your Personal Data — including encryption of Integration credentials and data in transit — but no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee its absolute security.

Children’s Privacy

The Service does not address anyone under the age of 16. We do not knowingly collect personally identifiable information from anyone under the age of 16. If you are a parent or guardian and you are aware that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 16 without verification of parental consent, we take steps to remove that information from our servers.

Links to Other Websites

The Service may contain links to other websites that are not operated by us. If you click a third-party link, you will be directed to that third party’s site. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services. We strongly advise you to review the privacy policy of every site you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date above. Where the change is material, we will let you know by email and/or a prominent notice on the Service before the change takes effect.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If you have any questions about this Privacy Policy or wish to exercise your privacy rights, you can contact us:

• By email: support@assess.one