Privacy Policy

1. Scope and our approach

We manage personal information in line with applicable Australian privacy law, including the Australian Privacy Principles where they apply to us. This policy does not govern information that cannot reasonably identify an individual.

Arena creates synthetic personas from statistical, geographic, customer-provided, and generated data. Synthetic personas are not intended to represent identifiable residents. Do not use Arena to create a profile of an identifiable person.

2. Information we collect

Depending on how you use the Service, we may collect:

• Account and contact information: name, username, email address, organisation, role, and authentication records.
• Commercial information: plan, billing contact, subscription status, invoices, payment status, usage, credits, and transaction records. Payment providers may process card or bank details; we do not intend to store full payment card numbers.
• Customer Content: project and map information, scenario titles, proposals, geography labels, prompts, uploaded material, interventions, instructions, feedback, and support messages.
• Generated and usage information: synthetic personas, transcripts, events, run ledgers, model selections, token use, cost, timestamps, exports, and actions taken in the Service.
• Technical information: IP address, device and browser information, session and security events, logs, request metadata, and diagnostic information.
• Public and licensed data: geographic, census, planning, and other data from public authorities, open-data services, licensors, or a customer.

3. Sensitive information and information about others

The Service is not designed to receive sensitive information or personal information about identifiable people. Unless we approve it in writing, you must not submit health information, biometric information, political opinions, religious beliefs, racial or ethnic origin, sexual orientation, criminal records, precise personal location, government identifiers, financial account credentials, or similarly sensitive material.

If we approve a use involving personal or sensitive information, you must have a lawful basis, give all required notices, obtain all required consents, and follow our written safeguards. If we receive this material unexpectedly, we may restrict or delete it where lawful and reasonable.

4. How we collect information

We collect information:

• directly from you when you register, pay, configure a project, run a simulation, contact us, or otherwise use the Service;
• from your organisation or an account administrator;
• automatically through necessary cookies, similar storage, logs, and security systems;
• from service providers involved in hosting, billing, support, security, analytics, or AI processing; and
• from public, open, licensed, and customer-nominated data sources.

Where reasonable, you may contact us without identifying yourself. We need account and billing details to provide paid or authenticated features.

5. Why we use information

We use information to:

• provide, operate, authenticate, meter, bill, support, and improve the Service;
• create scenarios, run AI models, generate synthetic outputs, and maintain event ledgers;
• administer organisations, subscriptions, credits, and customer requests;
• secure the Service, prevent abuse, investigate incidents, and enforce our terms;
• communicate service notices and, where permitted, marketing with a simple opt-out;
• comply with law, resolve disputes, and protect people, rights, and property; and
• produce aggregated or de-identified statistics that do not reasonably identify an individual.

6. AI processing and human access

Arena sends relevant Customer Content and run context through Vercel AI Gateway to the model providers selected for a run, which may include OpenAI, Anthropic, and Google. These systems generate probabilistic outputs and may infer new information from submitted material.

We do not use Customer Content to train general-purpose AI models. We require contracted AI providers to process Customer Content to provide the Service, subject to their business or API terms, rather than to train their general-purpose models.

Authorised personnel and contractors may access Customer Content when reasonably necessary to deliver a managed service, respond to support, investigate security or abuse, comply with law, or maintain the Service. Access is limited by role and confidentiality obligations. We do not use Arena to make decisions about an identifiable person's legal rights, employment, credit, insurance, healthcare, housing, or access to essential services.

7. When we disclose information

We may disclose information to:

• your organisation, account administrators, and people you authorise;
• hosting, database, infrastructure, security, communications, support, analytics, and payment providers;
• Vercel AI Gateway and the AI model providers selected for a run, including OpenAI, Anthropic, and Google;
• professional advisers, auditors, insurers, and financiers under appropriate duties of confidence;
• regulators, courts, law enforcement, or other parties where required or authorised by law; and
• a successor or transaction counterparty in a proposed or completed corporate transaction, subject to appropriate safeguards.

We do not sell personal information or Customer Content.

8. Overseas processing

Some providers process information outside Australia. AI and cloud providers may process information in the United States and other countries where they or their subprocessors operate. Locations can vary with customer configuration, model choice, and provider infrastructure. We take reasonable steps required by applicable law when arranging overseas disclosures. Contact us for current provider-location information relevant to your account.

9. Security and data breaches

We use administrative, technical, and organisational safeguards designed for the nature of the information we hold. No system is completely secure. You must protect account credentials and promptly report suspected unauthorised access.

We assess suspected data breaches and notify affected people and the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme requires it.

10. Retention

We retain information while needed to provide the Service and for legitimate security, dispute, and legal purposes. If an account closes, we delete Customer Content from active systems within 30 days unless law, an unresolved dispute, a security need, or your written instruction requires longer retention. Isolated backup copies age out under our normal backup cycle. We may retain billing, consent, security, and legal records for applicable limitation, tax, and regulatory periods. Aggregated or de-identified information may be retained where it no longer reasonably identifies anyone.

11. Cookies and similar technologies

We currently use necessary session, authentication, security, and preference technologies. We do not currently use advertising cookies in Arena. Read our Cookie Notice for more detail.

12. Access, correction, deletion, and complaints

You may ask to access or correct personal information we hold about you, or request deletion where applicable. We may need to verify your identity. Legal exceptions may apply, and we will explain a refusal where required.

To make a request or privacy complaint, email info@scopomap.com.au with “Privacy” in the subject. We aim to acknowledge complaints promptly and respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes and contact

We may update this policy as our practices or legal obligations change. We will publish the updated version and its effective date and give additional notice where a change materially affects how we handle existing personal information.

Privacy contact: info@scopomap.com.au · (02) 8821 7077
SCOPOMAP PTY LTD, ACN 665 148 863, New South Wales, Australia