Privacy Policy

1.1 Information you provide directly:

• Full name and email address
• Business name, ABN, and industry
• Phone number (if provided for SMS alerts)
• Payment information (processed securely by Stripe — we do not store card details)
• Contracts and documents you upload to the platform
• Responses to onboarding questions

1.2 Information collected automatically:

• Usage data (pages visited, features used, time spent)
• Device and browser information
• IP address and approximate location
• Error logs and performance data

We use your information to:

1. Provide and improve the Controva Service;
2. Analyse contracts and generate AI-powered insights;
3. Send deadline alerts and notifications;
4. Process subscription payments;
5. Respond to customer support requests;
6. Send product updates and important notices;
7. Comply with legal obligations;
8. Detect and prevent fraud or misuse.

We will not use your information for any purpose not listed above without your consent.

We treat your contract data with the highest level of confidentiality:

1. Your contracts are used solely to provide the Service to you;
2. Your contract data is never sold to third parties;
3. Your contract data is not used to train AI models;
4. Only authorised Controva personnel can access your data and only when required for support purposes;
5. All contracts are encrypted at rest using AES-256 encryption;
6. All data in transit is encrypted using TLS 1.2 or higher.

We do not sell your personal information. We may share information with:

1. Stripe — for payment processing. Stripe's privacy policy applies to payment data;
2. Supabase — our database and infrastructure provider, located in secure data centres;
3. Resend — for sending email notifications;
4. Anthropic — AI processing of contract text. Anthropic does not retain or train on your data under our API agreement;
5. Legal or regulatory authorities where required by Australian law.

All third-party providers are bound by data protection agreements and may not use your data for their own purposes.

1. Your data is stored on secure servers. We use Supabase infrastructure with data centres in Australia or the United States with appropriate data transfer safeguards.
2. We retain your data for as long as your account is active plus 90 days after account deletion.
3. You may request deletion of your data at any time by contacting privacy@controva.co or through your account settings.
4. Some data may be retained longer where required by Australian law.

Under the Australian Privacy Act you have the right to:

1. Access the personal information we hold about you;
2. Correct inaccurate or outdated personal information;
3. Request deletion of your personal information;
4. Opt out of direct marketing communications;
5. Make a complaint about how we handle your personal information.

To exercise any of these rights contact us at privacy@controva.co. We will respond within 30 days.

We use essential cookies required for the platform to function. We do not use advertising or tracking cookies. You can disable cookies in your browser settings but this may affect platform functionality.

We implement industry-standard security measures including encryption at rest and in transit, access controls, regular security reviews, and secure authentication. However no system is completely secure and we cannot guarantee absolute security. You use the Service at your own risk.

Controva is not intended for use by persons under 18 years of age. We do not knowingly collect personal information from minors.

We may send you product updates and feature announcements. You can unsubscribe at any time using the link in any email or by contacting us. We will not send you third-party marketing without your explicit consent.

If you believe we have breached the Australian Privacy Principles you may lodge a complaint by:

1. Contacting us directly at privacy@controva.co — we will investigate and respond within 30 days;
2. If unsatisfied, contacting the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

We may update this Privacy Policy from time to time. We will notify you of material changes by email at least 14 days before they take effect. Continued use of the Service after changes constitutes acceptance of the updated Policy.

For any privacy questions or requests contact: