River Monitor — Privacy Policy

DRAFT, not legal advice, for lawyer review. This is a starting draft written with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in mind. It has not been reviewed by a lawyer. Version 1.2 draft, 31 October 2026. Square-bracketed items must be completed.

1. Who we are

Himil Pty Ltd (ABN [ABN]) trading as AI Cubed ("we") runs River Monitor. Privacy contact: [PRIVACY EMAIL], [POSTAL ADDRESS]. [Lawyer to confirm whether the Privacy Act applies to us (for example the small business exemption for annual turnover under A$3 million). We intend to follow the APPs either way.]

2. What we collect

• Account: email address, optional name, password (stored only as a scrypt hash, never in readable form), email-confirmation status, saved dams and sites, alert preferences, language, and plan.
• Security and logs: IP address, browser type, login times and failed-login counts, used to keep accounts safe and limit abuse. Session cookies are essential and are not used for advertising.
• Payments (when billing is on): Stripe collects your card and billing details. We receive only a Stripe customer ID, subscription status, plan, and the last digits and expiry of the card if Stripe shows them. We do not store card numbers.
• Waitlist and email alerts: email address, organisation and interests, if you give them.
• Field kit (field partners only): observer name or ID, readings, sample details, notes, photos and, only if you tick the consent box, the photo or device GPS location. See section 5.

We don't knowingly collect sensitive information (APP 3), and we ask field partners not to submit any.

3. How we use it

To run your account; to send emails you asked for (confirmations, password resets, alerts and reports); to process subscriptions; to keep the service secure; to review field data and use approved records to check and calibrate our estimates; and to improve River Monitor. We don't sell personal information and we don't use it for third-party advertising.

4. Who we share it with (APP 6 and APP 8)

• Stripe (payment processor), when billing is on. Stripe may process data in the United States and other countries under its own privacy policy.
• Email delivery provider [to be named] once real emails are switched on.
• Hosting: [server location, for example a home server in Australia, or provider and region].
• Advisers and authorities where the law requires it.

Where personal information goes overseas, we take reasonable steps under APP 8 to make sure it's handled consistently with the APPs. [Lawyer to review the overseas-disclosure wording.]

5. Field photos, location and consent

• Field submissions need a consent tick confirming that you agree to these terms and have permission for any photo.
• When a photo is uploaded, we remove all embedded metadata (EXIF), such as camera serial number and time stamps. GPS coordinates are kept only if you ticked "share location". Otherwise location is removed from both the photo and the record.
• Please avoid photographing people. If a person can be identified, you must have their permission. We may blur or delete such photos.
• Approved field records may be published in aggregated form, for example "gauge reading at Kratié on [date]", without the observer's name unless they ask to be credited.

6. How long we keep it

• Account data: while your account is open, then deleted or anonymised within [90] days of closure.
• Security logs: [90] days. Failed-login counters reset on success.
• Billing records: 7 years, as required for Australian tax records.
• Emails in our review outbox: [90] days.
• Field data: approved readings and samples are kept indefinitely as scientific records, with the observer's name removed after [2] years if they ask. Rejected submissions and their photos: deleted within [90] days.

7. Security (APP 11)

Passwords are hashed with scrypt. Session and reset tokens are stored only as hashes. Cookies are HttpOnly and SameSite=Strict. Logins are rate-limited and accounts lock after repeated failures. Admin access is password-protected. No system is perfectly secure: if a data breach is likely to cause serious harm, we will follow the Notifiable Data Breaches scheme where it applies.

8. Access, correction and complaints (APP 12 and APP 13)

You can see and change most account details on your account page. To get a copy of your data, correct it, or delete your account, email [PRIVACY EMAIL]. We'll reply within 30 days. If you're unhappy with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

9. Users outside Australia

Field partners and users may be in Cambodia, Lao PDR, Thailand, Viet Nam or elsewhere, and local data protection laws may also apply (for example Thailand's PDPA and Viet Nam's Decree 13/2023). [Lawyer to review.]

10. Changes

We'll post updates here and email account holders about material changes.