Privacy Policy

1. Overview

T365 AI Studio ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information in compliance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

We collect the following categories of personal information:

• Account information: Name, email address, and authentication credentials
• Organisation information: Organisation name and billing details
• Microsoft 365 configuration data: Tenant settings, policies, and configurations that you authorise us to back up
• Usage data: Pages visited, features used, and interaction patterns (anonymised)
• Technical data: IP address, browser type, and device information

3. How We Use Your Information

• Providing and maintaining the Service
• Processing backups, compliance scans, and configuration restores
• Sending service notifications and security alerts
• Improving the Service through anonymised usage analytics
• Complying with legal obligations

4. Data Storage and Security

All data is stored in Australian data centres (Google Cloud Platform, australia-southeast1 region). Microsoft 365 configuration data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. We implement access controls, audit logging, and regular security reviews.

5. Data Sharing

We do not sell your personal information. We may share data with:

• Service providers: Payment processing (Stripe), email delivery (Resend), and infrastructure (Google Cloud Platform)
• Legal requirements: When required by Australian law or to protect our legal rights

6. Your Rights

Under the Australian Privacy Act, you have the right to:

• Access: Request a copy of your personal information
• Correction: Request correction of inaccurate information
• Deletion: Request deletion of your account and associated data
• Export: Download your data in a portable format
• Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

You can exercise these rights through your Account Settings page or by contacting us at privacy@t365.io.

7. Data Retention

We retain your data for as long as your account is active. When you delete your account, we implement a 30-day grace period during which you can cancel the deletion. After this period, all personal data and backup data is permanently deleted from our systems.

8. Cookies and Analytics

We use essential cookies for authentication and session management. We use anonymised analytics (PostHog) to understand how the Service is used. No personally identifiable information is included in analytics events.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. Continued use of the Service after changes constitutes acceptance.

10. Contact

For privacy-related enquiries, contact our Privacy Officer at privacy@t365.io or visit our contact page.