Privacy Policy

Navigator Technology (ABN 86 318 423 453), based in Queensland, Australia, provides technology consulting and the self-service AI Trust Pack. Navigator Consulting is a registered business name of the same ABN; you will see it on AI Trust Pack tax invoices and support emails. This policy explains how we collect, use, store and disclose personal information across our website and services.

We are a small business. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth) whether or not the Act currently requires a business of our size to, because our clients and buyers are entitled to know how their information is handled.

For privacy enquiries, contact hello@navigatortech.com.au. For an AI Trust Pack purchase you can also use support@navigatorconsulting.com.au.

Our consulting services include AI readiness and governance, Microsoft 365 and Copilot, ICT strategy and virtual CIO advisory, Power Platform solutions, and cybersecurity governance.

We collect names, contact details, organisational information, business requirements, system information supplied for advisory or implementation work, and engagement communications. We receive this through enquiries, website forms, meetings and client-provided documentation.

We use this information to respond to enquiries, prepare proposals, deliver the agreed work, manage engagements, issue invoices and meet business and legal obligations. Client documents, diagrams, reports and other supplied materials remain the client's property and are used only for the agreed scope. We do not access client systems unless explicitly agreed in writing.

Consulting records are held in business cloud services, including Google Workspace. Some providers may store or process information outside Australia. We may share relevant information with software vendors or specialist contractors where required for the engagement, with appropriate authority, or where disclosure is required by law.

We retain consulting records only as long as needed for the engagement, relevant business records and legal obligations, then securely delete information no longer required.

AI Trust Pack includes a free readiness check and a paid assessment that produces draft governance documents. Depending on the stage you use, we collect:

• Your email address for purchase, the tax invoice, delivery notifications, support and recovery of access; your first and last name at checkout are optional.
• Your organisation's name, size, industry and primary state, governance answers and context flags, including whether the organisation handles personal, sensitive or confidential information.
• Details of AI systems you list: system name, supplier, business purpose, business owner and risk ratings.
• Order and payment references, payment status, the date of the purchase terms you accepted, and any optional follow-up consent, including the wording shown and when consent was recorded.

We use this information to calculate assessment results, generate and provide your pack, manage payment and access, provide support and keep the record of the sale. Without the required information we cannot complete the assessment or deliver your purchase. Where you do not know an answer, choose “Unsure” and the pack will say so.

Please use a role title, such as “Practice Manager”, for an AI system's business owner. Do not enter unnecessary employee names, client or patient records, financial documents, passwords or sensitive examples. Only provide information you are authorised to share. If you do include personal information about another person, you confirm you are permitted to give it to us for this purpose.

The service generates documents using calculated scores and approved templates. It does not send your answers to an AI model, ours or anyone else's. The scoring is automated and describes the organisation; the service makes no automated decision about any individual. The documents are drafts for your review and adoption; they are not an audit, certification or legal advice.

Assessment information and generated documents are stored on our application server hosted by BinaryLane in Sydney. Encrypted backups are held at our premises in Australia. The payment and email services below process limited information overseas.

• Stripe: processes payments and issues your tax invoice. We provide your email address, order reference, product and amount, and Stripe collects the billing address it needs to work out GST. Stripe keeps a customer record for your purchase. Card details are entered directly with Stripe; we never receive or store them. Stripe processes information internationally, including in the United States and India, and uses providers in other countries. See Stripe's privacy policy.
• Resend: sends purchase, pack-ready and recovery emails, receiving your email address and the message content, including access or recovery links. It processes this information in the United States. See Resend's privacy policy.

We do not send assessment answers or generated documents to Stripe or Resend, and we do not attach packs to emails. Packs are available only through authenticated download. Overseas providers handle the information they receive under their own terms and privacy practices, and we cannot guarantee that they are bound by the Australian Privacy Principles.

We do not sell personal information. If you choose the optional follow-up checkbox at AI Trust Pack checkout, we store your email address and any name you provided with Resend Contacts in the United States to send occasional updates. Assessment answers and documents are not added to the mailing list.

The checkbox is unticked by default. Declining does not affect your purchase or pack. You can unsubscribe using the link in a marketing email or contact us. Unsubscribing stops marketing; it does not delete your pack or stop service messages needed for your purchase.

Our retention policy is to keep your assessment and generated pack for 12 months after payment so you can download them again, then delete them. You can request earlier deletion by contacting us. Deletion ends access to the assessment and pack. A refunded or disputed order follows the same 12-month rule unless you ask us to delete it sooner.

We retain a limited sale record for five years for accounting and tax records. This includes the order reference, date, amount and buyer email address, but not assessment answers or generated documents.

Deleted material may remain in encrypted backups for up to three months as backups expire through their rolling retention cycle. These backups remain in Australia and are used only for recovery. If a backup is restored, we re-apply recorded deletions.

If you opted into updates, your mailing-list contact is held separately until you unsubscribe or ask us to remove it. Deleting your assessment does not automatically unsubscribe you; please tell us if you want both.

We use reasonable administrative and technical safeguards, including restricted access, secure connections and protected downloads. For AI Trust Pack, backup exports are encrypted, but the live application server disk is not encrypted at rest. No electronic system or third-party service can be guaranteed absolutely secure.

If personal information we hold is lost, or accessed or disclosed without authorisation, in a way likely to cause serious harm to the people it concerns, we will tell those people and the Office of the Australian Information Commissioner, and say what we recommend they do.

We limit the information collected to what is needed for the service. Information may also be disclosed where required by law.

Our website and assessment do not use advertising pixels, behavioural profiling or analytics that track individual visitors. The AI Trust Pack page on this website reports each time it is opened to the assessment, and the assessment counts those page opens, visits, sample opens, screenings, checkouts and purchases as daily totals per traffic source so we can see whether the service is used. The traffic source is the campaign tag on the link you followed or, without one, the name of the website that referred you. Nothing in those counts identifies you. Standard hosting and security logs may record technical request information, such as your IP address, for a short period.

The main website is hosted by Vercel, enquiry forms are processed by Formspree, and fonts are delivered by Google Fonts. These services may receive information needed to handle your request, such as your IP address and browser details; Formspree also receives the information you submit in an enquiry. Their processing may occur outside Australia.

AI Trust Pack uses session credentials to provide access to your order. Sessions last up to seven days; recovery links are single-use and expire after 15 minutes. Stripe's checkout may use its own cookies or similar technologies under its privacy policy.

External websites and services have their own privacy practices. We will update this policy before we introduce additional analytics or tracking.

Contact hello@navigatortech.com.au (or, for an AI Trust Pack purchase, support@navigatorconsulting.com.au) to request access to, correction of, or deletion of personal information, or to raise a privacy complaint. Tell us which service and information your request concerns. We may need to verify your identity or authority before releasing or changing information. There is no charge for making a request.

We respond to requests within 30 days and explain any information we must retain or any reason we cannot fulfil a request. The retention and backup limits above apply to deletion requests.

If you have a complaint, please contact us first so we can investigate and respond. If it remains unresolved, or you have not received a response within 30 days, you may contact the Office of the Australian Information Commissioner (OAIC). The OAIC can advise whether your complaint falls within its jurisdiction.

We may update this policy as our services or information-handling practices change. The current version will be published on this page with its update date. Where a change requires consent, we will seek it separately.