This policy explains how Cantilever Labs Pty Ltd (ACN 699 248 149) (we, us, the Provider) handles personal information in connection with Custara and the website at custara.ai. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Custara is operated by Cantilever Labs Pty Ltd, an Australian company. Our registered office is in New South Wales, Australia.
Cantilever Labs is part of a group of companies under common ultimate control through the Martin Family Trust. Decision Standards Institute Ltd (ACN 699 264 376), which owns and governs the DSI 001 standard, is a separate entity outside that control. This policy covers Cantilever Labs' handling of personal information only. DSI's privacy policy is published at decision-standards-institute.org/privacy.
You may browse the custara.ai website without identifying yourself. If you register interest, request access or use the service, we will need enough information to respond and provide the service.
We collect only the personal information reasonably necessary for the purposes described in this policy.
Information you provide directly:
Information collected automatically:
Information we do not collect:
We use personal information to provide, maintain and improve Custara; create and manage your account; respond to enquiries and support requests; communicate about the service, including service updates and security notices; process payments and manage subscriptions; detect, prevent and address security incidents and technical issues; comply with legal obligations; and produce Service Data, aggregated and de-identified, to operate and improve Custara.
We do not use your personal information, your Content or your Evidence Content to train artificial intelligence or machine-learning models, and we do not make decisions that have a legal or similarly significant effect on you by automated means.
We do not sell personal information. We do not use your information to send you marketing without your consent. Where we send marketing communications with your consent, you can opt out at any time.
If you are in the EU or EEA, our lawful bases for processing your personal information are:
We may share personal information with service providers who help us operate Custara and our communications, group companies, assessors at your direction, legal and regulatory authorities where required, and in connection with a merger, acquisition or sale of all or substantially all of our assets subject to the acquiring entity assuming our obligations under this policy.
We do not share Evidence Content with any third party except at your direction, as described above or as required by law.
When you use Custara, the Content you upload remains yours. We process your Content as a data processor on your behalf. Our terms of use set out the data handling commitments, including that Evidence Content is not used to train models and is not accessed except as necessary to provide the service.
Aggregated and de-identified data derived from your use of Custara may be provided to Standards Foundry IP Pty Ltd and to Decision Standards Institute Ltd for the purpose of calibrating and publishing governance indices. This data does not identify you or your organisation and does not include Evidence Content. This use is described in our terms of use and, where applicable, in the data and evidence clause set in your customer agreement.
We retain personal information only for as long as we need it for the purposes described in this policy or as required by law.
When retention periods expire, we take reasonable steps to destroy or de-identify the information.
The custara.ai website does not set non-essential cookies and does not use third-party analytics or advertising trackers. Standard server logs are recorded by our hosting provider to operate and secure the site.
The Custara application may use session cookies strictly necessary for authentication and security. These cookies do not track you across other websites and are deleted when you close your browser or your session expires.
If we introduce any non-essential cookies in the future, we will update this policy and provide you with the ability to manage your preferences.
Our website and service infrastructure is hosted on servers that may be located outside Australia, including in the United States. Where personal information is transferred outside Australia, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.
If you are in the EU or EEA, we rely on appropriate safeguards for international transfers, including standard contractual clauses where applicable.
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include encryption of data in transit, access controls, and regular security reviews.
No system is completely secure. If you become aware of any security incident affecting your account, please contact us immediately at security@custara.ai.
If we become aware of an eligible data breach that is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and affected individuals in accordance with Part IIIC of the Privacy Act 1988 (Cth). If you are in the EU or EEA, we will also notify the relevant supervisory authority where required under the GDPR.
Under the Australian Privacy Principles, you may request access to the personal information we hold about you, ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, and withdraw consent for marketing communications at any time.
If you are in the EU or EEA, you may also request erasure of your personal information, request restriction of processing, request portability of your personal information, object to processing based on legitimate interests, and lodge a complaint with your local supervisory authority.
Contact us at privacy@custara.ai to exercise any of these rights. We will respond within a reasonable period and in accordance with applicable law. If we decline a request, we will tell you why.
Custara is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected such information, we will take reasonable steps to delete it.
If you have a concern about how we have handled your personal information, contact us at privacy@custara.ai. We will acknowledge your complaint within five business days and aim to provide a substantive response within 30 business days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
We may update this policy. If we make material changes, we will notify you by email or in-product notice at least 30 days before the changes take effect. The current version, with its effective date, is the version published on this page.
Privacy enquiries: privacy@custara.ai
Security incidents: security@custara.ai
Cantilever Labs Pty Ltd
ACN 699 248 149
New South Wales, Australia
