Privacy Management Policy

Obsidia is an AI-powered knowledge and workflow platform operated by Client Plus Solutions Pty Ltd (ABN to be confirmed), a company incorporated in Australia. We are an APP entity and are bound by the Australian Privacy Principles under the Privacy Act 1988 (Cth).

In this policy, "we", "our", and "us" refers to Client Plus Solutions Pty Ltd. "Platform" refers to the Obsidia application and associated services. "Customer" refers to the organisation contracted with us. "User" refers to individuals who access the Platform through a Customer's account.

Obsidia has designated a Privacy Officer who is the first point of contact for all privacy-related matters, including access and correction requests, complaints, and NDB assessments.

• Role: Privacy Officer
• Contact: privacy@obsidia.com.au
• Location: Sydney, Australia

The Privacy Officer is responsible for maintaining this policy, overseeing APP compliance, managing the annual review cycle, and acting as Incident Commander for NDB assessments.

Account and authentication information

When a Customer invites a User, we collect their email address, first name, and last name. This is used to verify identity and control access to the Platform.

Workspace content

Users create content on the Platform — AI conversations, uploaded documents, workflow run inputs and outputs, and prompt library entries. This content may contain personal information depending on what Users choose to include. Customers determine what content enters the Platform.

Usage and audit data

We collect metadata about Platform usage including timestamps, token counts, and abbreviated query and response previews. This is used for compliance, troubleshooting, and service improvement. We do not use workspace content to train AI models.

Connector-sourced content

Where Customers configure integrations (SharePoint, Confluence), the Platform retrieves and indexes documents. This content is held for the duration of the integration.

Engagement portal

Where Customers enable the public portal, external users provide their email to access portal conversations. This is collected on behalf of the Customer under that Customer's portal privacy notice.

We collect and use personal information only for the following purposes:

• Providing, operating, and improving the Platform
• Authenticating Users and enforcing access controls
• Processing AI queries on behalf of Users
• Maintaining security and compliance audit trails
• Troubleshooting errors and supporting Customers
• Meeting our legal obligations under Australian law

We do not sell personal information. We do not use workspace content to train, fine-tune, or improve AI models. We do not use personal information for direct marketing without explicit consent.

Disclosure to third parties occurs only where necessary to deliver the Platform (see our sub-processor register) or where required by law.

Under APPs 12 and 13, individuals have the right to access personal information we hold about them and to request correction of inaccurate or out-of-date information.

For Users of the Platform

Users should first contact their organisation's Platform administrator, who can export or correct information through the Admin panel. The administrator can also raise a deletion request on the User's behalf.

Direct requests to Obsidia

Direct access or correction requests can be made by emailing privacy@obsidia.com.au. We will acknowledge the request within 5 business days and respond within 30 days. If we cannot provide access (for example, because doing so would reveal another person's personal information), we will explain why in writing.

Correction requests

If we agree information is inaccurate or out of date, we will correct it within 30 days. If we disagree, we will record your correction request alongside the information and explain our decision in writing.

If you believe Obsidia has mishandled your personal information, you can make a complaint. See our full privacy complaints procedure for the complete process, SLAs, and escalation path.

In summary: send your complaint to privacy@obsidia.com.au. We will acknowledge within 5 business days and resolve within 30 days. If you are not satisfied, you may escalate to the Office of the Australian Information Commissioner (OAIC).

Some personal information processed through the Platform is disclosed to overseas recipients as part of service delivery. This occurs for AI inference (Anthropic — USA), embeddings (Voyage AI — USA), error monitoring (Sentry — USA), and application hosting (Netlify — global CDN). Full details, including region, purpose, and reasonable-steps assessment for each recipient, are published in our Overseas Disclosure Register.

Before disclosing information to an overseas recipient, we take reasonable steps (contractual protections, DPA review, or opt-out of model training) to ensure the recipient does not breach the APPs in relation to that information, as required by APP 8.1.

For Customers with strict data residency requirements, the Compliance tier uses Australian-hosted infrastructure (AWS Bedrock, ap-southeast-2) for all AI inference and storage, with no overseas disclosure of Customer Data.

APP 5 requires us to notify individuals at or near the time of collection. The table below lists each collection point and the notice provided.

We implement technical and organisational measures to protect personal information, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Row-level security enforced at the database layer
• JWT-based authentication with short-lived session tokens
• Step-up authentication required for sensitive administrative actions
• All Standard-tier infrastructure hosted in Australia (Sydney region)
• Comprehensive security audit logging for all administrative actions
• Mandatory privacy and security awareness training for all staff

For a full description of our security posture, see our Incident Response Plan and contact security@obsidia.com.au.

• Privacy Policy — detailed data handling practices and retention schedules
• Overseas Disclosure Register — every overseas recipient with reasonable-steps assessment
• Sub-Processor Register — full technical details on all sub-processors
• Privacy Complaints Procedure — how to make a complaint, SLAs, and OAIC escalation
• Data Processing Addendum (DPA) — contractual obligations for Customer data