ReportReady Privacy Policy
ReportReady handles sensitive institutional information, so we keep our approach simple. We collect only what we need, keep customer data in Australia, and never sell it, benchmark it or use it to train AI. This policy explains how.
Last updated
Who We Are and What This Policy Covers
1.1 The short version. We collect what we need to run ReportReady, we keep customer data in Australia, we do not sell it, we do not benchmark it, and we do not use it to train AI models. The rest of this Policy is the detail behind those commitments.
1.2 Who we are. ReportReady is operated by CampusQ Pty Ltd (ABN 76 606 776 863) of Level 5, 61 York Street, Sydney NSW 2000 (CampusQ, we, us, our). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1.3 What this Policy covers. This Policy explains how we handle Personal Information in connection with: (a) the ReportReady platform and its modules, AI Features and Integrations (the Service); (b) our websites, including reportready.com.au and related pages (the Sites); and (c) our sales, marketing, events, support and supplier relationships.
1.4 Our two roles. We handle Personal Information in two distinct capacities, and the distinction matters.
| Capacity | Whose information | Decided by | What governs it |
|---|---|---|---|
| Service provider to our customers | Personal Information contained in documents, records and evidence our customers upload or connect (Customer Data) | The customer organisation | The customer’s agreement with us, including our Terms of Service, and this Policy |
| Organisation in our own right | Account, contact, billing, support, website and marketing information | CampusQ | This Policy |
1.5 Customer Data. Where we process Customer Data, we do so on behalf of, and on the instructions of, the customer organisation. That organisation is responsible for its own privacy obligations to the individuals concerned, including giving notice and obtaining any consent required. If your information is in Customer Data and you want to access, correct or ask about it, please contact the relevant organisation first. We will assist that organisation to respond.
1.6 Definitions. Personal Information, sensitive information and health information have the meanings given in the Privacy Act 1988 (Cth). Capitalised terms not defined here have the meanings given in our Terms of Service.
What We Collect and How
2.1 Information we collect.
| Category | Examples | Source |
|---|---|---|
| Account and identity | Name, job title, organisation, work email, phone, role and permissions in the Service | You, or your organisation’s administrator |
| Authentication and security | Login credentials (stored only in hashed form), multifactor authentication settings, sign in session details including IP address and browser, audit logs | You and your device, automatically |
| Customer Data | Policies, procedures, governance and board records, reports, evidence files and correspondence, which may incidentally contain names, contact details and roles of staff, students, clients or other individuals | Your organisation, by upload or Integration |
| AI interaction data | Requests, Inputs, the Outputs generated, and related diagnostic logs | You, via the Service |
| Usage Data | Audit trail of actions taken, request and error logs, AI usage per task | Automatically |
| Commercial and billing | Billing contact, invoices, purchase orders, payment status (we do not store full payment card numbers) | Your organisation |
| Support and communications | Support tickets, emails, call notes, feedback, survey responses | You |
| Marketing and enquiries | Name, organisation, contact details, enquiry details, interests, event attendance, communication preferences | You (including through website forms), event organisers, professional networking platforms, or publicly available sources |
| Website | Form submissions and standard server request data | You and your browser |
| Suppliers and partners | Contact and commercial details of individuals at our suppliers, resellers and advisers | Those organisations |
2.2 How we collect it. We collect Personal Information directly from you where reasonable and practicable. We also collect it from your organisation (for example, when an administrator creates your account or uploads documents), from Integrations your organisation authorises, from service providers who help us operate the Service, and automatically through the Service and Sites.
2.3 SharePoint and other Integrations. If your organisation connects Microsoft SharePoint or another Integration, we retrieve content only from the locations your organisation’s administrator grants and nominates. Our SharePoint Integration is designed for read only access. We do not create, change or delete content in your organisation’s environment. Your organisation controls these permissions and may revoke them at any time within its own Microsoft environment. Personal Information within ingested content is Customer Data.
2.4 Sensitive information. We do not seek to collect sensitive information or health information. The Service is designed to assess compliance documentation, not to hold individual records. Our Terms of Service require customers to minimise or redact sensitive information before submitting it. If sensitive information is nonetheless contained in Customer Data, we handle it only as a service provider to the customer and with the safeguards described in this Policy.
2.5 Unsolicited information. If we receive Personal Information we did not ask for and could not have collected under the APPs, we will destroy or deidentify it where lawful and reasonable to do so.
2.6 Anonymity. You may contact us anonymously or under a pseudonym for general enquiries. It is not practicable to provide the Service, support or invoicing without identifying you.
2.7 Children. The Service and Sites are intended for organisations and adult professionals. We do not knowingly collect Personal Information directly from individuals under 18.
How We Use Information, AI and Disclosure
3.1 Purposes. We use Personal Information to:
- provide, operate, maintain and secure the Service and Sites;
- create and manage accounts, authenticate users and enforce access controls;
- process Customer Data to generate assessments, findings and reports for the customer that submitted it;
- provide support, training and onboarding;
- invoice, collect payment and manage our customer relationships;
- monitor, investigate and prevent security incidents, fraud, misuse and breaches of our Terms;
- measure, troubleshoot and improve the performance and reliability of the Service using Usage Data;
- send service, security and administrative notices;
- send marketing communications, where permitted by law (see 3.5);
- comply with our legal obligations and respond to lawful requests; and
- establish, exercise or defend legal claims.
We use Personal Information for a secondary purpose only where you would reasonably expect it and it is related to the primary purpose (directly related for sensitive information), where you consent, or where otherwise permitted by the APPs.
3.2 How AI is used. ReportReady AI Features use large language models accessed through Amazon Bedrock, operated within our AWS environment in Australia. When an AI Feature runs, the relevant Customer Data is sent to the model to produce an Output for that customer only. Customers can also choose Rules Based Assessment, which does not use AI, although some supporting features (such as document summaries) may use AI where enabled.
3.3 Our AI commitments.
- No training. Customer Data, Inputs and Outputs are not used to train, retrain or fine tune any AI model, whether ours or a third party’s.
- No model provider access. Under our Amazon Bedrock configuration, model providers do not receive, store or use Customer Data, Inputs or Outputs, and AWS does not use them to train models.
- No shared indexes. Customer documents are sent to the model only for the specific task requested. They are not stored in any shared retrieval index. Our AI reference indexes contain only our own regulatory and module content. One customer’s data is never used to generate another customer’s Outputs.
- Limited logs. Prompts and responses may be kept in secure operational logs in Australia for a limited period for security, troubleshooting and quality assurance, then deleted.
- Human oversight. Outputs are decision support. They are not legal advice, and no decision with legal or similarly significant effect on an individual is made by automated means in the Service.
3.4 No sale, no benchmarking. We do not sell or rent Personal Information. We do not benchmark customers against one another or share any customer’s Customer Data or compliance results with another customer.
3.5 Direct marketing. We may send business contacts information about ReportReady and other CampusQ products where permitted by the Spam Act 2003 (Cth) and APP 7. Every marketing email includes a functional unsubscribe. We do not send marketing to individuals merely because their information appears in Customer Data.
3.6 Who we disclose to. We disclose Personal Information only as follows:
| Recipient | Purpose |
|---|---|
| Amazon Web Services (hosting, storage, Amazon Bedrock AI services) | Hosting and processing of the Service and Customer Data |
| Microsoft (where your organisation enables an Integration) | Retrieving content your organisation authorises |
| Providers of CRM (including HubSpot), email, support, accounting and payment services | Managing enquiries, operating our business and supporting customers |
| Your organisation’s administrators | Account management and visibility of activity within your organisation |
| Professional advisers, auditors and insurers | Under duties of confidentiality |
| A purchaser or successor in a merger, acquisition or restructure | Subject to equivalent confidentiality and privacy protections |
| Regulators, courts and law enforcement | Where required or authorised by law, and, for Customer Data, after notifying the customer where lawful |
3.7 Subprocessors. We engage third party service providers to support the delivery of the Service, including hosting, infrastructure and AI processing. We remain responsible for their performance in accordance with our Terms of Service. We will notify customers of material changes to Subprocessors that process Customer Data and provide information about relevant Subprocessors on reasonable written request, subject to confidentiality.
Storage, Overseas Disclosure, Security and Retention
4.1 Australian hosting. Customer Data, including Inputs and Outputs processed by AI Features, is hosted and processed in Amazon Web Services’ Australian regions. We do not move Customer Data out of Australia for storage or AI processing.
4.2 Limited overseas access. Certain business service providers may process account, contact, billing, marketing and support information outside Australia. Customer Data remains subject to the Australian hosting and processing commitments in our Terms of Service. Limited remote access to Customer Data from outside Australia may occur where strictly necessary for support or incident resolution, subject to appropriate security and confidentiality safeguards. Where Personal Information is disclosed overseas, we take reasonable steps to comply with applicable requirements under the Australian Privacy Principles.
4.3 Security. We take reasonable steps to protect Personal Information from misuse, interference, loss, and unauthorised access, modification or disclosure. Our controls include:
- encryption of data in transit and at rest, including backups;
- logical separation of each customer’s data, enforced at the application data layer;
- private storage of uploaded files, accessible only through access controlled channels;
- role based access controls and multifactor authentication;
- passwords stored only in salted, hashed form;
- network protections and audit logging;
- secure development practices; and
- business continuity and disaster recovery arrangements, including encrypted backups held in Australia.
No system is perfectly secure. You are responsible for keeping your credentials confidential and notifying us promptly of any suspected compromise.
4.4 Data breaches. We maintain an incident response plan. If we become aware of a data breach affecting Customer Data, we will notify the affected customer without undue delay and give them the information reasonably available to help them meet their own obligations. Where a breach is likely to result in serious harm, we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), including notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals, coordinating with the customer where the breach involves Customer Data.
Retention
| Information | Retention |
|---|---|
| Customer Data |
Retained during the Subscription Term and available for export for 30 days following termination or expiry. Following that period, Customer Data is deleted from active production systems within a reasonable period, subject to applicable legal retention obligations. Residual copies in backups are deleted or overwritten in accordance with our backup retention processes. |
| AI diagnostic logs | Up to 90 days |
| Account and audit logs | Retained for as long as reasonably necessary for security, operational, legal and audit purposes, in accordance with our retention policies. |
| Billing and tax records | 7 years, as required by Australian tax law |
| Support records | Up to 3 years after the support ticket is closed, unless a longer period is required by law. |
| Marketing contacts | Until you unsubscribe or the information is no longer needed, then suppressed to honour your preference |
When information is no longer needed for any permitted purpose, we take reasonable steps to destroy or deidentify it.
Your Rights, Complaints, Cookies and Contact
5.1 Access and correction. You may request access to, or correction of, Personal Information we hold about you as an organisation in our own right. We will respond within 30 days. We do not charge for a request, but may charge a reasonable fee for providing access where permitted. If we refuse a request, we will tell you why in writing and how to complain. For Personal Information within Customer Data, see clause 1.5.
5.2 Verification. We will take reasonable steps to verify your identity before acting on a request, to protect your information from being disclosed to the wrong person.
5.3 Overseas privacy laws. If you are located outside Australia, you may have additional rights under the law of your jurisdiction, such as the European Union or United Kingdom General Data Protection Regulation. Contact us and we will respond in accordance with the law that applies.
5.4 Complaints. If you believe we have breached the Australian Privacy Principles, please contact CampusQ using the details below and provide sufficient information for us to investigate your concern. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are dissatisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992
5.5 Cookies. We use cookies and similar technologies for authentication, session management, security and functionality, including refreshing access credentials. We may also use analytics to understand usage and improve the Service and Sites. Analytics do not access Customer Data or Outputs. Where required by law, we will obtain consent for non-essential cookies.
5.6 Links to other sites. The Sites and Service may link to third party websites, such as regulator publications. We are not responsible for their privacy practices.
5.7 Changes to this Policy. We may update this Policy to reflect changes in law, technology or our practices. We will publish the updated Policy with its effective date and provide customers with at least 30 days' notice of material changes by email or within the Service, except where an earlier change is required by law or necessary to address a security or legal risk.
5.8 Contact us.
CampusQ Pty Ltd
Level 5, 61 York Street, Sydney NSW 2000
info@campusq.com.au