AIRA — Privacy Policy

Draft — not yet in force

This document is a prepared draft awaiting final business details and professional legal review. It is published here for transparency about what AIRA intends; it does not yet bind anyone. It will take effect once those details are finalised.

Effective date: To be confirmed before this policy takes effect. Last updated: Draft — pre-launch.

1. About this policy

This Privacy Policy explains how AIRA ("AIRA", "we", "us", "our") collects, uses, stores, and discloses your personal information when you use useairanow.com, the AIRA Assessment, the AIRA Score, and the paid AIRA products (the "Service"). AIRA is operated by Ben Alec Iasiello (ABN 94 982 927 795), a sole trader based in South Australia, Australia.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are in the EU or UK, Section 14 explains how your rights are handled.

This is the plain-English version we've tried to make genuinely readable. It is also the legally operative policy. If anything here is unclear, email support@useairanow.com.

2. The short version

  • We collect the answers you give in the Assessment, your email, your purchase records, and a small amount of technical data.
  • We use it to calculate your Score, generate your paid Kit, deliver and support the product, and meet our legal obligations.
  • To generate a paid Kit, your assessment answers and any free text are sent to Anthropic, an AI provider in the United States.
  • Your database records are stored with Supabase in Sydney, Australia. Some of our other providers are overseas.
  • You can access, correct, export, or delete your data at any time. You can complain to us and, if needed, to the Office of the Australian Information Commissioner (OAIC).

The rest of this policy is the detail.

3. What personal information we collect

We only collect what we need to run the Service. Depending on how you use it, this includes:

Information you give us

  • Email address — when you save your Score, create an account, or buy a product.
  • Account details — if you sign in with Google, we receive basic profile information (such as your name and email) from Google; if you use an email magic link, we use your email address. Optionally, a phone number if you provide one for account recovery.
  • Assessment answers, made up of:

- *Demographics (Step 1)* — your role/occupation type, industry, employment status, and tenure. We also ask you to confirm you are 16 or older (via age or date of birth) and, optionally, your country. - *Context and resources (Step 2)* — financial-situation indicators, including your savings cushion (a broad range such as "less than 1 month" through "6 months or more", with a "prefer not to say" option), how much time you spend learning each week, and your learning budget (a broad dollar range). - *Work patterns (Step 3)* — your answers on a 1–5 agreement scale (Likert) to questions about how your work is done (for example, how routine or rules-based your tasks are, how much judgement they need, and how much you use AI tools). - *Additional details (Step 4, optional)* — a free-text field where you can add anything you like. This is optional and you control what you write.

  • Your generated content — the AIRA Kit produced for you, and any support-chat messages or emails you send us.

Information we collect automatically

  • Purchase data — handled by LemonSqueezy. We receive a record such as the order ID, amount, and product bought. We do not receive or store your full card number.
  • IP address — collected temporarily for rate limiting and bot/fraud protection, and not retained beyond 30 days.
  • Cookies and similar technology — essential cookies (your session and sign-in) always operate; analytics cookies only run with your consent (see Section 8).
  • Usage events — anonymised product-usage events via PostHog, subject to your cookie/analytics consent.

Because the Assessment touches on your work and financial situation, we treat this information as personal and handle it carefully. Some of it (such as your savings range) is financially sensitive even though it is not "sensitive information" as strictly defined in the Privacy Act.

What we do NOT collect

  • Full card numbers (LemonSqueezy handles payment details).
  • Your browsing activity outside the AIRA website.
  • Social-media account data.
  • Government identifiers (such as licence or passport numbers).
  • A phone number, unless you choose to give one for account recovery.

4. Why we collect and use it (purpose)

We use your personal information only for the purposes below, and for directly related purposes you'd reasonably expect:

  • To calculate your AIRA Score — a fixed, rule-based calculation done on our own systems (no AI is used to compute the Score).
  • To generate your paid Kit — this involves sending assessment data to Anthropic (see Section 6).
  • To deliver the product and manage your account — saving your results, unlocking what you bought, handling retakes and regenerations.
  • To provide support — answering your questions, including via our support bot and email.
  • To take payment — via LemonSqueezy.
  • To keep the Service secure and reliable — rate limiting, fraud prevention, and error monitoring.
  • To meet legal and tax obligations — including keeping financial transaction records.
  • To understand and improve the Service — using anonymised analytics, where you've consented.

We do not sell your personal information, and we do not use it for third-party advertising.

5. How we collect it

We collect most information directly from you when you complete the Assessment, create an account, or contact us. We collect technical data (like your IP address and usage events) automatically when you use the site. We receive payment records from LemonSqueezy, and basic profile data from Google if you choose Google sign-in.

6. Use of AI, and disclosure to Anthropic

This is important, so we've given it its own section.

To generate a paid Starter or Kit, your assessment answers — including any free text you wrote in Step 4 — are sent to Anthropic (the maker of the Claude AI models) via its API. Anthropic processes this data to help produce your personalised Kit content. Our support bot also uses Anthropic to answer product questions.

We take steps to limit what the AI sees and does with your free text:

  • Free-text input is treated strictly as data, not instructions, and is sanitised before processing, so that hidden commands can't hijack the output.
  • The system is instructed to pull only the literal facts it needs for personalisation (such as your occupation, industry, and task descriptions) and not to repeat your free text back word-for-word in the Kit.

Under Anthropic's API terms as we understand them, your data is not used to train Anthropic's models, and is retained by Anthropic for a limited period (around 30 days) for abuse monitoring before deletion. Anthropic is based in the United States (see Section 9). We have a data processing agreement with Anthropic. You can avoid AI processing entirely by using only the free Assessment and Score and not buying a Kit.

7. The AIRA Score is a self-report tool

We want to be clear about what your data produces. The AIRA Score is a snapshot of the answers you give, turned into a number by a fixed formula — not a prediction about your job, income, or future. We don't combine your answers with outside data about you to profile you, and we don't make automated decisions that have a legal or similarly significant effect on you. More on how the Score works is in our public knowledge base.

8. Cookies and analytics

  • Essential cookies (your aira_session and sign-in cookies) always operate — the site can't work without them.
  • Analytics cookies (PostHog) only operate with your consent. If you are in the EU or UK, you'll see a consent banner on your first visit with clear "Accept" and "Reject" options and no pre-ticked boxes. Elsewhere, analytics default to off with a one-time, dismissable prompt to opt in.
  • Analytics events are anonymised and used to understand how the product is used, not to identify you personally.

9. Who we share it with, and overseas disclosure (APP 8)

We share your personal information only with the service providers we need to run AIRA. Some of these are located, or store data, outside Australia — so by using the Service you acknowledge your information may be disclosed overseas as set out below. We have data processing agreements in place with each.

| Provider | What they do | Where |
| **Supabase** | Our database and authentication — stores your account, assessment answers, and Kits | **Sydney, Australia (ap-southeast-2).** |
| **Vercel** | Website and application hosting | United States / global edge |
| **Anthropic** | AI generation of paid Kits and support answers (see Section 6) | United States |
| **LemonSqueezy** | Payments, tax, and receipts (Merchant of Record) | United States |
| **PostHog** | Anonymised product analytics (with your consent) | EU Cloud region |
| **Sentry** | Error and crash monitoring | European Union (Germany) |
| **Resend** | Sending transactional emails (receipts, account emails) | United States |

We may also disclose personal information if required by law, to enforce our Terms, or to protect the rights, safety, or property of AIRA, our users, or others.

10. Where your data is stored

Your core account and assessment data is stored with Supabase in Sydney, Australia (ap-southeast-2), so that Australian users' primary records stay in Australia. Some processing and secondary copies occur overseas with the providers listed in Section 9. Backups are held for up to 7 days (database point-in-time recovery) and up to 30 days (Kit content storage).

11. How long we keep it (retention)

  • Assessment answers, Kits, and support-chat history — kept until you delete your account.
  • Purchase records — kept for 7 years after account deletion, because Australian tax and financial-records law requires it. When you delete your account, we remove the personal identifiers (such as your name and account link) and keep only the financial transaction record.
  • IP addresses — not kept beyond 30 days.
  • Operational logs (errors, cron jobs, payment webhooks, AI-generation logs) — kept for 30 to 90 days, then purged. AI-generation logs have their personal link removed and are kept up to 30 days for cost/error auditing.
  • Backups — up to 7 days (database) and 30 days (Kit content).
  • Blocked under-16 attempts — not retained; if the age check fails, the details of that attempt aren't stored.

12. How we protect it (APP 11)

We take reasonable steps to protect your information, including row-level security on every user table in the database, encryption of data in transit, restricted server-side write access, and error monitoring. No system is perfectly secure, but if a data breach likely to cause serious harm occurs, we will act in line with the Notifiable Data Breaches scheme under the Privacy Act.

13. Your rights: access, correction, and deletion

You have the right to access the personal information we hold about you, to ask us to correct it, and to ask us to delete it.

  • Access / export your data — you can download everything we hold about you as a JSON file from your account (via /api/account/export). You can also ask us at support@useairanow.com.
  • Correct your data — update your details in account settings, or retake the Assessment to change your answers.
  • Delete your data — choose "Delete account" in your account settings. This wipes your account, assessment answers, Kits, retake and regeneration history, and support chats. As explained in Section 11, we keep the de-identified financial record of any purchase for 7 years to meet tax law, and we forward a deletion request for your analytics events to PostHog to remove them under PostHog's process.

We don't charge for access or correction requests in normal cases. If we ever refuse a request (for example, where the law allows us to), we'll explain why and how you can complain.

14. EU / UK users

If you are in the EU or UK, you have the rights above plus the standard rights under the GDPR / UK GDPR — including access, rectification, erasure, restriction, portability, and objection. The cookie-consent banner (Section 8) applies to you, and our "right to be forgotten" is handled by the same account-deletion process (Section 13). To exercise any of these rights, contact support@useairanow.com.

15. Direct marketing

At launch we send transactional emails only (such as receipts and account notices) — not marketing or newsletter emails. If we introduce optional marketing communications later, they will be opt-in and you'll be able to unsubscribe at any time, consistent with APP 7 and the Spam Act 2003 (Cth).

16. Children

The Service is for people aged 16 and over. We don't knowingly collect personal information from anyone under 16; if an age check indicates you're under 16, we block the Assessment and don't keep the attempt. If you believe a child under 16 has given us personal information, contact us and we'll delete it.

17. Complaints

If you have a privacy concern or complaint, please contact us first at support@useairanow.com (attention: Privacy Officer). We'll acknowledge your complaint and aim to resolve it within a reasonable time, usually within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

  • Website: oaic.gov.au
  • Phone: 1300 363 992
  • Post: GPO Box 5288, Sydney NSW 2001

18. Changes to this policy

We may update this policy from time to time. If we make a material change, we'll update the "Last updated" date and, where reasonable, let you know. The current version will always be available at useairanow.com/privacy.

19. How to contact us

For any privacy question or request, contact our Privacy Officer:

  • Email: support@useairanow.com
  • Post: a postal address will be provided here before this policy takes effect. In the meantime, please contact us by email.