Privacy Policy

1. What we collect and how

Free calculators (no account). The prompt, asset and token calculators run in your browser and send us nothing. The “custom AI action” estimator sends the description you type to our servers and on to AI providers (section 4) to produce an estimate. Please do not include personal information in that description. Your IP address is used briefly for rate limiting (section 3).

Waitlist form. Email address, organisation, tier of interest and role, which you give us directly on the business waitlist. These are processed by Formspree.

Methodology updates. If you subscribe under a calculator result we keep your email address, when you asked and confirmed, the page you subscribed from, and which update we last sent you. We only email you after you click a confirmation link, and every email has an unsubscribe link. We hold this in our database and send via Resend.

Accounts. Email address, name, organisation name, and a salted hash of your password (we never store the password itself). We also store the calculations you choose to save, the reports you generate, session records (which expire after seven days), and an audit log recording who created, changed, deleted, calculated or exported records in your organisation.

Payments and Concierge orders. Card details are collected and held by Stripe, not by us. For subscriptions we keep your Stripe customer and subscription identifiers, plan and billing status. For Concierge orders we keep the email address, name and organisation name given at Stripe checkout, the amount paid and fulfilment status.

Mining suite. Organisation records in the mining register come from public business registers such as the Australian Business Register. They describe companies, not individuals, and a person reviews every match before it is published.

Analytics. Vercel Analytics records aggregate page and event information without cookies or personal identifiers. We do not record the text you type into calculators in analytics.

We use one essential, httpOnly session cookie to keep you signed in. We do not use advertising cookies.

2. Why we collect, use and disclose it

• To create and secure your account and provide the reporting service you request.
• To take payment, manage your subscription and keep tax and accounting records.
• To fulfil Concierge orders and respond to enquiries.
• To email you about the waitlist or product launch, and to send monthly methodology updates you have confirmed (you can opt out at any time).
• To prevent abuse, secure the service and investigate incidents.
• To meet legal obligations and to improve the service using aggregate data.

We do not sell personal information. We do not use it for direct marketing of third parties.

3. Automated processing and AI (APP 1.7 to 1.9)

From 10 December 2026, APP entities must describe computer programs that make, or are substantially and directly related to making, decisions that significantly affect an individual's rights or interests. We do not believe our current processing meets that threshold, but in line with the Office of the Australian Information Commissioner's guidance to take a cautious approach, we describe all of it here.

Decisions made solely by a computer program. We do not make any decision that significantly affects an individual's rights or interests solely by computer program. The automated processing we do is limited to:

• Rate limiting by IP address, which temporarily refuses repeated requests to the public estimators, suggestion forms, sign-in and registration. It does not use your identity or account history, and the limit resets within a minute.
• Session and permission checks, which confirm that you are signed in and belong to the organisation whose data you request.
• Plan entitlements, which unlock features according to the subscription status recorded from Stripe.
• Payment fraud screening performed by Stripe under its own policy (see section 4). We do not operate that program.

Decisions where a computer program assists. None that significantly affect individuals. Emissions figures and report outputs are calculated from the inputs you provide and published factors; they are estimates about AI usage, not assessments of any person. AI models are used only to produce estimates and draft text that you review (for example the custom action estimator and the mining suite's explainers and drafters). A person always decides whether to rely on that output, and nothing is applied to anyone automatically.

Personal information used by these programs. IP address (rate limiting); session identifier and organisation membership (access checks); subscription status (entitlements); text you choose to submit to an estimator.

If this changes, we will update this policy before the change takes effect. You can ask us about any automated processing, or ask for a person to review an outcome you think is wrong, using the contact details in section 8.

4. Service providers and overseas disclosure

We use these providers, each of which may handle personal information on our behalf:

• Vercel (hosting and analytics), United States and global edge network.
• Neon (Postgres database), United States (AWS us-east-1), where we hold account, report, order and subscriber data.
• Upstash (Redis), for rate limiting counters (IP addresses, retained for about a minute).
• Stripe (payments and fraud screening), United States and other countries.
• Formspree (waitlist form submissions), United States.
• Resend (email delivery for methodology updates), United States.
• AI providers (OpenAI, Google, xAI and Groq), United States, which receive only the text you submit to an AI-assisted feature. We use the first provider that responds.

Most of these providers are located in, or store data in, the United States. Where we disclose personal information overseas, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the APPs, including through contractual terms.

5. Security and retention

Passwords are hashed with PBKDF2, sessions use httpOnly cookies, access to each organisation's data is checked on the server, and connections are encrypted in transit. We keep account data while your account is active. When you ask us to close your account we delete your personal information, except records we must keep by law (such as tax and payment records, generally for five years). Rate limiting records expire within a minute. If we suffer an eligible data breach we will notify affected individuals and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

6. Access and correction

You can ask to access or correct the personal information we hold about you, or ask us to delete your account, by contacting us (section 8). We will respond within 30 days and will tell you the reason if we cannot give access. You can unsubscribe from emails at any time.

7. Complaints

If you think we have breached the APPs, contact us first and we will investigate and reply in writing within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (1300 363 992).

8. Contact

Privacy contact, Customer Experience Insight Pty Ltd: hello@aixhuman.co (please put “Privacy” in the subject line) . See also our methodology for the limits of our estimates, which are estimates and not metered actuals.