Privacy Policy

At a glance

• We process account and usage information, plus content you submit or create, to provide and protect the features you request.
• Content may be handled by LocAI systems, infrastructure providers, search services, or partners needed for the feature you choose.
• We may use aggregated or de-identified information to research, evaluate, develop, and improve products. Identifiable customer content is not currently used for model training; materially different use requires additional notice and permission where required.
• Some AI prompts, image files, research queries, or outputs may remain in operational systems after a download link expires. See the retention sections below.

1. Scope

This Privacy Policy explains how LOCAI TECHNOLOGY PTY LTD ("LocAI", "we", "us", or "our") collects, uses, discloses, stores, and protects information when you use our website, dashboard, APIs, desktop and developer tools, billing flows, AI chat and research, image generation and editing, voice and audio features, document tools, support channels, events, and other current or future products and services (together, the "Services"). New features may have additional or different notices when they collect or use information in a new way.

We operate from Australia and handle personal information in line with the Australian Privacy Principles where they apply. Users in other jurisdictions may also have local privacy rights, including rights under the GDPR or similar laws.

2. Information We Collect

We may collect information you provide directly, information generated when you use the Services, and information we receive from trusted third parties.

• Account information: email address, name, organization, login records, invite status, account role, and dashboard preferences.
• Billing information: prepaid wallet activity, invoice details, checkout session identifiers, payment status, transaction metadata, and Stripe customer references. We do not store full card numbers.
• API usage metadata: API key identifiers, model name, protocol, request time, token counts, response status, latency, cost, and operational logs needed for billing, abuse prevention, debugging, and reliability.
• Customer content and creative materials: prompts, instructions, chat messages, API inputs and outputs, uploaded documents and other files, source images, generated or edited images, audio recordings, transcripts, speech preferences, research questions, search terms, retrieved public results, citations, and feedback. This can include personal, confidential, or sensitive information if you choose to include it.
• Website and device information: IP address, browser type, pages visited, referring URLs, approximate location, cookie identifiers, and similar diagnostics.
• Communications: emails, support requests, sales inquiries, partnership messages, attachments, and feedback you send to us.
• Information from others: information supplied by an organisation that gives you access, a person who refers or invites you, payment and identity providers, integration partners you choose, public sources, and other lawful sources.

3. How We Use Information

• Provide, secure, maintain, and improve the Services.
• Create accounts, authenticate users, issue API keys, manage access, and deliver dashboard features.
• Process prepaid wallet top-ups, invoices, refunds, fraud checks, taxes, and billing support.
• Measure API usage, calculate costs, apply limits, troubleshoot incidents, and protect service availability.
• Process audio and voice-related content when you request transcription, speech input, or other voice features, and return the requested result.
• Generate or edit images, process files, retrieve public research sources, provide citations, and deliver other features you or your organisation request.
• Respond to support, privacy, security, legal, sales, and partnership requests.
• Understand use of the Services; perform research, analytics, testing, quality assurance, fraud prevention, security reviews, and service reliability work.
• Maintain, personalize, develop, test, and launch new or existing LocAI products, services, features, models, tools, business operations, and customer experiences.
• Create aggregated or de-identified statistics, evaluations, benchmarks, and other information that is not reasonably linked to an identified person.
• Send operational notices and, where permitted, relevant product, event, partner, or marketing communications. You can opt out of marketing messages.
• Protect legal rights, investigate complaints or suspected misuse, enforce agreements, complete corporate transactions, and comply with lawful requests.

Where the GDPR or a similar law applies, our lawful basis depends on the purpose and context. It may include performing our contract with you, complying with legal obligations, pursuing legitimate interests such as securing and improving the Services, or your consent where consent is required. When an organisation submits personal information to LocAI through its API account, that organisation may control the purpose and lawful basis while LocAI processes the information to provide the requested service.

4. AI Inputs, Outputs, and Model Training

LocAI processes customer inputs and outputs to provide model responses, route requests, operate tools, perform abuse checks, support billing, and maintain reliability. We treat customer API content as customer content.

We use customer content to provide the feature requested, secure and maintain the Services, and provide support. We may use aggregated or de-identified information for research, analytics, evaluation, and service development. We do not currently use identifiable customer API content, prompts, files, images, audio, transcripts, or outputs to train or fine-tune models. If we introduce a feature or arrangement that uses identifiable customer content for model training, fine-tuning, evaluation, or another materially different secondary purpose, we will explain that use and obtain any separate agreement, setting choice, or consent required by law before applying it to your content. Business customers may have additional controls in a written agreement.

5. Disclosure to Service Providers, Partners, and Other Parties

We may disclose the categories of information described above, limited to what is reasonably relevant, to the following categories of recipients for the purposes described in this Policy:

• Infrastructure and service providers: cloud and VPS hosts, data centres, network, database, storage, backup, content delivery, cybersecurity, monitoring, analytics, communications, customer-support, and software providers.
• AI, model, and research providers: providers of computing, model inference, image generation, speech processing, search, retrieval, data processing, evaluation, or other tools used to deliver a feature. Information sent may include the specific prompt, file, audio, image, or search query needed for that feature.
• Payment and financial partners: Stripe and related financial, fraud-prevention, tax, accounting, refund, chargeback, and payment-support providers.
• Integrations and customer-selected recipients: applications, platforms, data sources, and partners you or your organisation connect, instruct us to use, or choose to receive an output.
• Commercial and channel partners: resellers, distributors, implementation partners, research or education collaborators, and co-service providers where they help provide a requested or agreed product or service. Where permitted, we may also share relevant contact or interest information for a joint offer you request or agree to receive. A partner that determines its own purposes may handle information under its own privacy notice.
• Affiliates and corporate transactions: current or future related entities, investors, lenders, potential or actual acquirers, successors, and transaction advisers in connection with financing, restructuring, due diligence, merger, acquisition, or sale of all or part of a business, subject to lawful safeguards.
• Professional advisers: lawyers, accountants, auditors, insurers, and compliance advisers.
• Authorities and legal recipients: regulators, courts, law enforcement, government bodies, or other persons where disclosure is required or authorised by law, or reasonably necessary to protect people, rights, property, safety, or service integrity.

We do not sell personal information for money. We do not currently disclose personal information for cross-context behavioural advertising. If a future activity is treated as a sale or sharing under an applicable privacy law, we will provide any required notice and choice before that activity begins. We do not authorise a service provider to use customer content for its own unrelated purposes merely because it processes that content for LocAI.

Where an organisation uses LocAI to process information about its own users, employees, customers, or other people, that organisation may be responsible for deciding what information to submit and for providing notices and obtaining permissions. LocAI processes that information to provide the organisation’s requested service and under any applicable written data-processing terms.

6. Image Generation, Editing, and Files

When you request image generation or editing, we process your prompt, any source image you provide, clarification answers, job and conversation identifiers, and the resulting image to complete the task, manage your history, enforce safety rules, support edits, calculate charges, and resolve failures. Prompts and job details are stored in LocAI’s image-job records; source and generated image files are stored on service infrastructure. A signed download link normally expires after 24 hours. Link expiry limits access through that link and does not itself mean the underlying file or job record has been deleted.

Image files and records may remain for operational, security, support, accounting, backup, or legal needs until removed under applicable retention procedures. You may request deletion by contacting us. We are reviewing automated file-retention controls; until a deletion is confirmed, do not upload material that requires guaranteed deletion by a particular date.

7. Research and External Search

When you use a LocAI research or web-search feature, the search query and necessary search parameters may be sent from LocAI’s search service to the search engines enabled for that request. The current search configuration includes Bing, GitHub, Presearch, and Yandex; the configuration may change. Search providers receive the query they process and may handle it under their own privacy terms. LocAI’s operational search cache has a 15-minute expiry by default; storage persistence, backups, or system logs may follow separate retention schedules. LocAI records tool-usage metadata, including a hash of the query, for billing, abuse prevention, and reliability. Do not include sensitive or confidential details in a search request unless you are authorised to disclose them to the relevant search providers.

8. Cookies and Analytics

We use cookies and similar technologies for authentication, session management, security, preferences, analytics, and product measurement. Some cookies are essential for the Services to work. You can control cookies through your browser, but disabling essential cookies may limit access to logged-in features.

9. Security

We use technical and organizational safeguards designed to protect information, including access controls, encryption in transit, secret management practices, webhook verification, account controls, logging, and operational review. No online service can guarantee absolute security, so users should also protect API keys, passwords, devices, and account access.

10. Retention

We retain information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, enforce agreements, protect the platform, maintain business records, and support billing or audit requirements. Retention periods may vary by data type, product setting, contract, legal requirement, and operational need.

For LocAI-Talk transcription, the Gateway writes a temporary audio file for duration validation and removes that temporary file when validation finishes. The audio is then forwarded to the voice-processing worker. The voice billing ledger stores request metadata and a content hash, not the raw recording or transcript. A successful result may be held in an encrypted retry cache for up to one hour. These statements describe the Gateway and billing path; system, security, infrastructure-provider, or backup retention may differ. Contact us for current product-specific retention details before submitting information that requires a fixed deletion deadline.

11. International Transfers

LocAI is based in Australia, and our service providers, processors, infrastructure, partners, or users may be located in other countries. Information may be transferred to, stored in, or processed in Australia and other jurisdictions. Where required, we use appropriate contractual, technical, and organizational safeguards for international transfers.

12. Your Choices and Rights

Depending on your location, the data involved, and LocAI’s role, you may have rights to request access to or correction or deletion of personal information, receive a portable copy, restrict or object to certain processing, withdraw consent, or complain to a privacy regulator. California residents may have additional rights under applicable California law, including rights to know, correct, or delete personal information and to opt out of a sale or sharing where those activities occur. LocAI does not sell personal information for money. We will not discriminate against you for exercising a privacy right.

If you submitted information through an organisation’s API account, contact that organisation as well; it may need to handle your request as the party that controls the information. LocAI will assist or respond as required by applicable law and our agreement with that organisation.

To make a privacy request, contact us at info@locai.com.au. We may need to verify your identity and account relationship before acting on a request.

13. Sensitive Information and Children

Do not submit sensitive information, including health, biometric, financial, identity, racial or ethnic, religious, political, criminal, or precise location information, unless the feature is appropriate and you have authority and any required consent. LocAI voice features are not biometric identity or authentication services. The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can review it.

14. Enterprise and Partner Terms

Some enterprise, reseller, education, research, or partner arrangements may be governed by separate written agreements, data processing terms, security terms, or order forms. If those terms conflict with this Privacy Policy for a covered customer relationship, the written agreement controls for that relationship.

15. Changes

We may update this Privacy Policy from time to time. When changes are material, we will take reasonable steps to notify affected users, such as by posting an updated policy, sending email, or providing an in-product notice. The date at the top shows the latest update.

16. Contact and Complaints

For privacy, security, support, legal, partnership, or data rights questions, contact us any time:

LOCAI TECHNOLOGY PTY LTD
ABN 49 676 179 114
Suite 3, 38 Rowe St, Eastwood NSW 2122