Privacy Policy

1. Introduction

ComplyHub is a compliance management software-as-a-service (SaaS) platform operated by Vivacity Coaching and Consulting Pty Ltd (ABN 40 140 059 016) ("we", "us", "our").

We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information when you use our platform, website, and related services.

2. Information We Collect

2.1 Personal Information You Provide

When you register, subscribe, or interact with ComplyHub, we may collect:

• Name, email address, phone number, and job title
• Organisation name, ABN, and RTO registration details
• Billing and payment information (processed by secure third-party providers)
• User credentials and authentication data
• Communications and support enquiries

2.2 Data You Enter Into the Platform

As a SaaS compliance management system, ComplyHub stores data you and your authorised users enter, including:

• Compliance documentation, policies, and procedures
• Trainer and assessor records, qualifications, and evidence
• Student support records and enrolment information
• Governance meeting minutes and action items
• Audit evidence and continuous improvement records

Important: You are responsible for ensuring that any personal information you enter into ComplyHub about third parties (such as students, trainers, or staff) is collected and handled in accordance with your own privacy obligations.

2.3 Usage Data and Metadata

We automatically collect technical and usage information, including:

• IP address, browser type, device information, and operating system
• Pages visited, features used, and session duration
• Login times, user activity logs, and audit trails
• Error logs and performance metrics

2.4 Cookies and Analytics

We use cookies and similar tracking technologies to improve your experience and analyse platform usage. This includes:

• Essential cookies: Required for platform functionality and security
• Analytics cookies: Help us understand how users interact with the platform
• Marketing cookies: Used for advertising and campaign measurement (with consent)

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect platform functionality.

3. How We Use Your Information

We use personal information for the following purposes:

• Providing, maintaining, and improving the ComplyHub platform
• Processing subscriptions, billing, and account management
• Communicating service updates, security alerts, and support responses
• Sending product updates and educational content (with consent)
• Analysing usage patterns to enhance features and user experience
• Ensuring platform security and preventing fraud or misuse
• Complying with legal obligations and regulatory requirements
• Responding to lawful requests from government authorities

4. Third-Party Service Providers

We engage trusted third-party processors to operate our platform. These providers are contractually bound to protect your data and use it only for specified purposes.

4.1 Infrastructure and Hosting

• Supabase: Database hosting, authentication, and backend services (data stored in AWS Sydney region)
• Lovable / Vercel: Application hosting and content delivery

4.2 Analytics and Monitoring

• Metricool: Website and marketing analytics
• Google Analytics: Usage analysis and audience insights

4.3 Communications

• Mailgun: Transactional email delivery (reports, notifications)
• Keap (Infusionsoft): CRM and marketing automation

4.4 Payment Processing

• Stripe: Secure payment processing (we do not store credit card details)

Some third-party providers may store data in jurisdictions outside Australia. We take reasonable steps to ensure overseas recipients handle data in accordance with the APPs or equivalent protections.

5. Data Storage and Security

5.1 Data Location

Primary application data is hosted on infrastructure located in Australia (AWS Sydney region via Supabase). Some supporting services may process data in other jurisdictions as outlined in Section 4.

5.2 Security Controls

We implement industry-standard security measures, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based access controls and row-level security policies
• Multi-factor authentication options for user accounts
• Regular security assessments and vulnerability monitoring
• Automated backups with point-in-time recovery capabilities
• Audit logging of system access and data changes

5.3 Data Retention

We retain personal information for as long as your account remains active or as needed to provide services. After account termination, we retain data for a reasonable period to comply with legal obligations, resolve disputes, and enforce agreements. Compliance records may be retained longer where required by regulatory standards.

6. Disclosure of Personal Information

We may disclose personal information:

• To third-party service providers as described in Section 4
• To your organisation's administrators and authorised users
• Where required or authorised by law, court order, or regulatory authority
• To protect the rights, safety, or property of ComplyHub, our users, or others
• In connection with a business transfer, merger, or acquisition (with notice)

We do not sell, rent, or trade personal information to third parties for marketing purposes.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

7.1 Access

Request access to personal information we hold about you. We will respond within a reasonable timeframe and may charge a reasonable fee for access requests.

7.2 Correction

Request correction of inaccurate, incomplete, or outdated personal information. You can update most account information directly through the platform.

7.3 Erasure

Request deletion of personal information where we no longer need it for the purposes for which it was collected. Some data may be retained where required by law or legitimate business purposes.

7.4 Opt-Out

Unsubscribe from marketing communications at any time using the link in our emails or by contacting us directly.

8. Complaints

If you believe we have breached the Australian Privacy Principles or have a complaint about how we handle personal information, please contact us using the details below.

We will investigate complaints and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be notified via the platform or email. Continued use of ComplyHub after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy enquiries, access requests, or complaints, please contact: