PRIVACY & YOUR INFORMATION
Handle less.
Protect more.
Use the initial check without an account
The free initial check runs in your browser. Its five categorical answers are held only in page memory, are not sent to the application server, and disappear when you refresh or leave. They are not transferred when you sign in. Normal hosting request logs may still be processed to serve the site.
Information the signed-in application uses
Sign in with ChatGPT supplies an account identifier and email, and may supply a display name. The application saves your organisation name, privacy contact, incident descriptions, assessment answers, decisions and revision history. Payment records include references, amounts and status; card details are handled by Stripe.
Minimise incident data
Describe categories of affected information rather than uploading or pasting names, account numbers, medical records, passwords or compromised datasets. This service does not need those records to guide an assessment.
Storage and access
Application records are stored in a GPT Sites-managed Cloudflare D1 database. Access is restricted by the signed-in account identifier. GPT Sites, its infrastructure providers and authorised service administrators may process data to operate the service. This release makes no Australian-only residency, Azure hosting, certification or automatic-deletion claim.
Optional AI processing
AI summaries are optional and disabled until configured. When enabled, generating a summary requires consent to send the saved incident description, information types, containment and risk reasoning to OpenAI. The application requests non-storage of the response; this is not a guarantee of zero provider retention. Review the provider’s data terms before use.
Retention and deletion
Incident data and revisions remain available until you delete the incident. Deletion removes its content and revision history from the active application database. A minimal deletion record remains to track consumed assessment credits. Payment and account records remain for service operation and accounting. Provider backups may have separate retention. This release has no automatic retention expiry.
Before commercial launch
The operator must publish its legal entity, privacy contact, access and correction process, complaint process, approved retention periods and cross-border disclosures. Until then, this notice describes the public preview application and is not a final customer privacy policy.