Privacy Policy

1. About this policy

1. This policy explains how Mineralis (ABN 75 859 760 720, ACN 682 966 230) (we, us, our) handles personal information in connection with the Mineralis service.
2. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we are not bound by the Privacy Act, we apply this policy as a matter of contract with you.
3. Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form.
4. This policy forms part of our End User Licence Agreement and Terms of Service.

2. What personal information we collect and hold

We do not deliberately collect sensitive information as defined in the Privacy Act, and you should not submit it to the Service.

3. How we collect personal information

1. Directly from you, when you register, verify your email address, enrol a mobile number, buy compute tokens, submit data, create API credentials, or contact us.
2. Automatically, when you use the Service - through server logs and the technical information listed in clause 2.
3. From third parties: from Google, where you choose to sign in with a Google account; and from our payment provider, which tells us the outcome, amount and reference of a payment (and may tell us the payer's name and email address as recorded by that provider).
4. Where it is reasonable and practicable, we collect personal information directly from you. If we receive unsolicited personal information we do not need, we will destroy or de-identify it as APP 4 requires.

4. Why we collect, hold, use and disclose it

We use personal information for these purposes, and for purposes related to them that you would reasonably expect:

1. to create, verify, secure and administer your account;
2. to provide the Service, run your processing jobs and return the results;
3. to meter usage, take payment, credit compute tokens, and issue invoices and receipts;
4. to prove that you accepted our terms and this policy, and which version you accepted;
5. to provide support, respond to your enquiries and handle complaints;
6. to detect, investigate and prevent fraud, abuse, unauthorised access and misuse of the Service, and to keep the Service secure and available;
7. to maintain and improve the Service, including through aggregated and de-identified analysis of how it is used and how it performs;
8. to send you service messages about your account, your runs, security matters and changes to our terms - you cannot opt out of these while you hold an account;
9. to send you marketing about our products and services, subject to clause 9; and
10. to comply with our legal obligations, including tax and accounting record keeping, and to establish, exercise or defend a legal claim.

We do not use personal information for automated decision making that produces a legal or similarly significant effect on you.

5. Dealing with us anonymously or pseudonymously

You may read our public pages, including this policy and our terms, without identifying yourself. You cannot hold an account anonymously or under a pseudonym: we must be able to identify the account holder in order to authenticate you, bill you, issue a valid tax invoice, and prove your acceptance of our terms. That is a lawful and practical exception under APP 2.2.

6. The data you upload

1. Assay data, sample identifiers, configuration and results remain yours. We process them only to provide the Service to you, as clause 7.2 of our terms describes.
2. We do not sell, rent or trade your uploaded data, and we do not use it to train models made available to other customers without your prior written consent.
3. You must not submit personal information about other people to the Service. If you do, you remain the entity responsible for it under privacy law, you must have any consent the law requires, and you must tell us so that we can handle it appropriately.
4. Results are stored against your account so that you can retrieve them. You are responsible for keeping your own copies.

7. Who we disclose personal information to

We do not sell personal information, and we do not disclose it to data brokers or to advertising networks.

8. Overseas disclosure

1. Some of the providers named in clause 7 are located overseas or may process information overseas. The countries in which recipients are likely to be located include the United States, and other countries in which Google and PayPal operate infrastructure and support functions, including in the European Union, the United Kingdom, Singapore and India.
2. Before disclosing personal information to an overseas recipient we take steps that are reasonable in the circumstances, as APP 8.1 requires, to ensure the recipient does not breach the APPs - principally by selecting established providers that publish binding privacy commitments and by contracting on their data protection terms.
3. Where you choose to pay through our payment provider, you are dealing with that provider directly and it handles your payment information under its own privacy policy and its own overseas arrangements.
4. We do not warrant that an overseas recipient will always comply with Australian privacy law, and you may not be able to seek redress in Australia against an overseas recipient. By providing personal information to us and using the Service, you acknowledge this.

9. Direct marketing

1. We may send you information about our products, features and services by email, using the address on your account.
2. Every marketing message contains a functional unsubscribe facility, as the Spam Act 2003 (Cth) requires, and we action unsubscribe requests within 5 business days.
3. You may also opt out at any time by emailing the contact address published on our website.
4. Opting out of marketing does not stop service messages about your account, your runs, security or changes to our terms.
5. We do not disclose your personal information to a third party for that party's own direct marketing.

10. Cookies, local storage and analytics

1. The Service uses browser session storage to keep you signed in for the life of the browser tab, and local storage to remember a payment you have started so it can be completed if your browser closes mid-payment. This information stays in your browser.
2. Firebase Authentication and the Google reCAPTCHA component used for SMS verification set their own cookies and storage, which are necessary for sign-in and for abuse prevention to work.
3. We do not use advertising cookies, cross-site tracking or third party advertising networks.
4. You can block or clear cookies and storage in your browser, but sign-in will not work if you do.

11. Data quality, security and breaches

1. We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date, complete and relevant (APP 10). Please tell us when your details change.
2. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure (APP 11). Those steps include encryption in transit, encryption at rest through our cloud provider, access control on the principle of least privilege, optional two-step verification on accounts, hashed and revocable API credentials, hashed account identifiers in our database, server-side authorisation on every request, and audit records of privileged actions.
3. No system is completely secure. We cannot guarantee the security of information transmitted to or from the Service, and you provide it at your own risk.
4. If we suspect a data breach we will investigate promptly. If we have reasonable grounds to believe an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner as required by Part IIIC of the Privacy Act.

12. How long we keep personal information

1. We keep account and usage information while your account is open and for as long as we need it for the purposes in clause 4.
2. After your account closes we keep your uploaded data for 30 days so that you can export it, and then delete it, except where a law requires otherwise.
3. We keep financial records, invoices and tax records for at least 5 years, as the Income Tax Assessment Act 1936 (Cth), the A New Tax System (Goods and Services Tax) Act 1999 (Cth) and the Corporations Act 2001 (Cth) require.
4. We keep records of your acceptance of our terms and this policy for 7 years after your account closes, so that we can establish or defend a claim within the limitation period under the Limitation Act 2005 (WA).
5. When we no longer need personal information for any purpose for which it may be used or disclosed, and we are not required by law to retain it, we destroy it or de-identify it (APP 11.2). Backups are deleted on their ordinary rotation cycle.

13. Accessing and correcting your personal information

1. You may ask for access to the personal information we hold about you (APP 12), and you may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading (APP 13).
2. Email the contact address published on our website with your request. We will ask you to verify your identity before we release anything.
3. We will respond within 30 days. We do not charge for making a request. We may charge a reasonable cost-based fee for giving access to a large volume of information, and we will tell you what it is before we do the work.
4. You can see and change much of your information yourself, in the application: your display name, your two-step verification enrolment, your API credentials, your run history and your invoices.
5. We may refuse access or correction where the Privacy Act permits - for example where granting it would unreasonably affect another person's privacy, where the request is frivolous or vexatious, or where the information relates to existing or anticipated legal proceedings. If we refuse, we will tell you in writing why, and how to complain.
6. If we refuse to correct information, you may ask us to attach a statement to it noting that you consider it inaccurate, and we will take reasonable steps to do so.

14. Complaints

1. If you think we have breached the Australian Privacy Principles or mishandled your personal information, email the contact address published on our website with the details. Marking it Privacy complaint helps us route it.
2. We will acknowledge your complaint within 5 business days and give you a written response within 30 days. If we need longer we will tell you why and when to expect an answer.
3. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

Office of the Australian Information Commissioner
GPO Box 5218, Sydney NSW 2001
Telephone 1300 363 992
www.oaic.gov.au

For consumer matters in Western Australia you may also contact Consumer Protection at the Department of Energy, Mines, Industry Regulation and Safety on 1300 30 40 54.

15. Government related identifiers

We do not adopt a government related identifier - such as a tax file number, Medicare number, driver's licence number or passport number - as our own identifier for you, and we do not use or disclose one except where the Privacy Act permits (APP 9). Do not send us these numbers.

16. Children

The Service is not intended for anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact the contact address published on our website and we will delete it.

17. Changes to this policy

1. We may update this policy. The current version is always published at /privacy with its version number and effective date.
2. For a material change we will give you at least 14 days notice by email or by prominent notice in the application, and ask you to accept the new version when you next sign in.
3. Continuing to use the Service after a new version takes effect means you accept it.

18. Contact us

Mineralis (ABN 75 859 760 720, ACN 682 966 230)

Privacy enquiries: the contact address published on our website

Service: https://ionos-web-865919028469.australia-southeast1.run.app