Privacy Policy

1. About This Policy

This Privacy Policy explains how Arvoe Pty Ltd (ABN pending) ("Arvoe", "we", "us", "our") collects, uses, discloses, and protects personal information in connection with our website at www.arvoe.ai (the "Website"), our AI governance platform (the "Platform"), and related services.

We are committed to complying with the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and applicable state and territory privacy legislation. As a company that provides AI governance tools to educational institutions, we hold ourselves to the highest standards of data protection — particularly when it comes to information relating to children.

2. Information We Collect

2.1 Information you provide directly

• Contact information: name, email address, phone number, school name, and role when you request a demo, complete our self-assessment, subscribe to our newsletter, or contact us.
• Account information: name, email, role, and school affiliation when you create a Platform account.
• Assessment data: responses to our AI Governance Self-Assessment, including maturity scores and governance posture information.
• Communications: content of emails, support requests, and other correspondence with us.

2.2 Information collected automatically

• Usage data: pages visited, time spent, referring URLs, and interaction patterns on our Website.
• Device information: browser type, operating system, device type, screen resolution, and IP address.
• Cookies and similar technologies: we use essential cookies for Website functionality and optional analytics cookies to understand usage patterns. See Section 8 for details.

2.3 Information from third parties

We may receive information from schools that use our Platform in connection with their AI governance programs. This may include aggregated or de-identified data about AI tool usage patterns, governance maturity assessments, and risk posture information. We do not receive identifiable student data through the Platform.

3. How We Use Your Information

We collect and use personal information for the following purposes:

• To provide, maintain, and improve our Website and Platform
• To process and respond to your enquiries, demo requests, and support requests
• To deliver self-assessment results and governance maturity scorecards
• To send you information about our products, services, and AI governance insights (with your consent, where required)
• To generate anonymised, aggregated benchmarking data to help schools understand their governance posture relative to peers
• To comply with legal obligations, including the Privacy Act 1988 and applicable education sector regulations
• To protect the security and integrity of our services

We will not use your personal information for purposes materially different from those described here without notifying you and, where required, obtaining your consent.

4. Children's Privacy

Arvoe does not knowingly collect personal information from children under 18.

Our Website and self-assessment tools are designed for use by school leaders, administrators, and educators — not students. The Platform is used by authorised school staff to manage institutional AI governance.

Where a school uses the Arvoe Platform as part of its AI governance program, any data relating to students is managed under the school's own privacy policies and obligations. Arvoe acts as a service provider to the school and processes data only as directed by the school under a data processing agreement.

We are committed to compliance with the Children's Online Privacy Code when it takes effect in December 2026, and we will update this policy to reflect any additional obligations that arise.

5. Disclosure of Information

We do not sell, rent, or trade your personal information. We may disclose personal information in the following circumstances:

• Service providers: to trusted third-party providers who assist us in operating our Website and Platform (e.g., hosting, analytics, email delivery). These providers are contractually required to protect your information and use it only for the services they provide to us.
• Aggregated data: we may share anonymised, aggregated benchmarking data that cannot identify any individual or school. This data helps the education sector understand AI governance maturity patterns.
• Legal requirements: where required by law, regulation, legal process, or enforceable government request.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to confidentiality obligations.
• With your consent: where you have given us explicit consent to share your information for a specific purpose.

6. Data Storage and Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures, including:

• Encryption of data in transit (TLS) and at rest
• Access controls limiting who can view personal information to authorised personnel only
• Regular security reviews of our infrastructure and third-party providers
• Incident response procedures for data breaches, in compliance with the Notifiable Data Breaches scheme under the Privacy Act

Our Website is hosted on Vercel (global CDN with Australian edge nodes). Our Platform infrastructure is hosted on Supabase with data residency in Australia. We take reasonable steps to ensure that where data is processed outside Australia, it is subject to equivalent privacy protections.

7. Automated Decision-Making

Our Platform uses AI to assist school staff with governance tasks such as risk identification, policy drafting, and compliance monitoring. These AI features:

• Are designed to assist and inform human decision-making, not replace it
• Do not make automated decisions that produce legal effects or significantly affect individuals without human oversight
• Display transparency indicators (tool badges) showing what data sources are being consulted

We are committed to compliance with the automated decision-making transparency obligations taking effect in December 2026 and will update our practices and disclosures accordingly.

8. Cookies and Analytics

We use the following types of cookies:

• Essential cookies: required for basic Website functionality (e.g., session management, security). These cannot be disabled.
• Analytics cookies: used to understand how visitors interact with our Website. We use privacy-respecting analytics tools and do not use analytics data for advertising or profiling.

We do not use advertising cookies, tracking pixels from ad networks, or any form of cross-site tracking. We do not sell data to advertisers or data brokers.

9. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or out-of-date information
• Request deletion of your personal information (subject to legal obligations requiring retention)
• Withdraw consent for marketing communications at any time
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

To exercise any of these rights, contact us at privacy@arvoe.ai. We will respond within 30 days.

10. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes described in this policy, or as required by law. Specifically:

• Website enquiries and self-assessment data: retained for 2 years from the date of collection, unless you become a Platform customer (in which case it becomes part of your account data).
• Platform account data: retained for the duration of the customer relationship plus 12 months, unless a longer retention period is required by law.
• Marketing preferences: retained until you unsubscribe or request deletion.
• Aggregated benchmarking data: retained indefinitely as it is anonymised and cannot identify individuals or schools.

11. Third-Party Links

Our Website may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing any personal information.

12. International Data Transfers

Some of our service providers may process data outside Australia. Where this occurs, we take reasonable steps to ensure the overseas recipient handles your information in accordance with the Australian Privacy Principles, including through contractual obligations and security assessments.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal obligations. We will post the updated policy on this page with a revised "last updated" date. For material changes, we will provide additional notice (such as an email to Platform customers).

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us:

If you are not satisfied with our response to a privacy concern, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.