Privacy Policy

1. Who we are and the scope of this policy

This Privacy Policy applies to Erstan's websites, applications, APIs, AI features, Agents, integrations, support, and related services (together, the Service). In this policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

This policy is issued by ERSTAN PTY LTD (ABN 98 697 458 914), an Australian private company with its registered office in Heidelberg VIC 3084, Australia. Its main business location recorded on the ABR is VIC 3006, Australia. ERSTAN PTY LTD operates Erstan and is the entity referred to as Erstan, we, and us in this policy. The company's current ABN details are available through ABN Lookup.

This policy should be read with our Terms of Service, any collection notice presented when information is collected, and any data processing addendum or Order that applies to a Customer. If a signed data processing addendum or Order sets a different requirement for Customer Content, that document controls for its subject matter.

2. Customer and Erstan roles

Erstan is a business service. The organisation that creates an account or buys the Service is the Customer. A Customer and its account or workspace administrators decide which users may access the Service, what information they submit, which Agents they run, and which model providers and connected services they enable.

For account registration, authentication, security, billing, support, product communications, and our own legal obligations, Erstan decides why and how personal information is handled. For personal information contained in files, prompts, messages, business records, or other material processed for a Customer (Customer Content), the Customer generally determines the purpose and Erstan acts as its service provider or processor, subject to the contract and applicable law.

3. Personal information we collect and hold

The information we handle depends on how the Service is configured and used. It may include:

• Identity and account information: name, business email address, identity provider identifiers, account and workspace membership, roles, settings, invitations, and access requests.
• Authentication and security information: password hashes, session and device information, security tokens, IP addresses or hashes, browser and user-agent information, login activity, API-key metadata, permissions, and audit events.
• Customer Content: prompts, chat messages, AI inputs and outputs, documents, files, extracted text, embeddings, tasks, comments, emails and attachments, workflows, execution inputs and results, tool calls, approvals, feedback, optional assistant memories, and records retrieved from or written to connected systems.
• Integration information: the provider and connected account, configuration, scopes and permissions, connection status, provider identifiers, OAuth tokens or API credentials, and information exchanged with the connected service.
• AI and usage information: provider and model, whether a BYOK or Erstan-managed credential was used, token counts, estimated and billable cost, Credit and allowance activity, execution identifiers, timestamps, errors, and response feedback.
• Billing information: plan, subscription and trial status, invoice email, billing country and tax information, invoices, transaction and payment status, auto-recharge choices, and payment-provider customer, subscription, invoice, checkout, or payment identifiers. Stripe collects payment-card details during hosted checkout; Erstan generally receives payment status and identifiers rather than the full card number.
• Support and communications: enquiries, support messages, meeting notes, feedback, beta-access details, notification history, communication preferences, and information you give us when we investigate a problem.
• Technical and operational information: request IDs, logs, timestamps, device and browser details, feature interactions, performance and diagnostic events, failures, and security or abuse signals.

Customer Content may contain sensitive information or personal information about people who are not Service users. Erstan does not require sensitive information to create an ordinary account. A Customer must only submit sensitive or third-party information when it has authority to do so, the information is necessary for its use case, and the Service and connected providers are configured appropriately.

4. How we collect personal information

We collect personal information:

• directly from you when you register, configure the Service, submit content, buy a plan, contact us, or provide feedback;
• from the Customer, its administrators, and other authorised users, including through invitations, workspaces, tasks, comments, and shared content;
• from identity providers such as Google, Microsoft, or a Customer's configured identity provider;
• from payment providers, model providers, and connected services when you authorise a connection or transaction;
• automatically when you use the Service, through session technology, browser storage, logs, audit events, and usage metering; and
• when the Service generates, extracts, summarises, classifies, embeds, or infers information as part of an instruction.

If required information is not provided, we may be unable to create or secure an account, process a payment, connect a service, respond to a request, or provide the relevant feature.

5. How we use personal information

We use personal information where reasonably necessary to:

• create, authenticate, administer, and support accounts, workspaces, users, and permissions;
• provide requested features, store and display Customer Content, run Agents, and maintain history and continuity;
• send information to and receive results from configured AI providers, tools, and connected services;
• meter usage, apply plan and storage allowances, maintain Credit ledgers, process billing, and prevent duplicate charges;
• secure the Service, detect abuse, investigate incidents, keep audit records, and enforce our terms;
• send service, security, billing, support, beta-access, and administrative communications;
• diagnose failures, monitor performance, understand feature operation, and improve reliability and usability;
• respond to enquiries, complaints, access or correction requests, disputes, and legal processes; and
• comply with law, protect rights and safety, and establish, exercise, or defend legal claims.

We may use aggregated or de-identified information for analytics, capacity planning, product development, and reporting where it is no longer reasonably identifiable. We will not use personal information for a materially unrelated purpose without a lawful basis, consent where required, or further notice.

6. AI and automated processing

How AI features handle information

When a user runs an AI feature or Agent, Erstan may send the prompt, instructions, relevant conversation history, files, extracted text, tool results, and other context needed for that request to the configured model provider. The response and related execution information may be stored so the Customer can view history, resume work, audit actions, provide feedback, and troubleshoot results. Where enabled, Erstan may create embeddings, use tenant-scoped response caching, or store optional user-approved memories to provide search and continuity features.

The Customer or its administrator may choose a bring-your-own-key (BYOK) connection or an Erstan-managed connection, subject to the available plan and policy. With BYOK, the Customer's relationship and settings with the provider apply. With an Erstan-managed connection, Erstan selects and contracts with the provider. In both cases, the selected provider processes the information it receives under the terms, privacy commitments, and data controls applicable to that connection.

Output, inferences, and decisions

AI can generate or infer personal information and can produce inaccurate, incomplete, or biased results. Customers must use appropriate human review, particularly for sensitive information or a decision that could significantly affect a person's rights, access, safety, employment, finances, or other interests. The Customer controls the instructions, data, permissions, approvals, and intended use of Customer-configured Agents.

Erstan also uses automated rules to authenticate sessions, detect security or abuse signals, route and retry work, meter usage, and apply plan, Credit, storage, or access controls. If an automated control restricts account access or payment functionality and you believe it is wrong, an account administrator may contact us for review.

7. Who receives personal information

We may disclose personal information to:

• The Customer and authorised users: account and workspace administrators, team members, assignees, reviewers, or other people to whom the Customer grants access.
• Customer-selected providers: AI providers such as OpenAI, Anthropic, Google, or xAI, and connected services such as Oracle NetSuite, Slack, and other tools the Customer enables. An integration may use a connection service to authenticate or route tool requests.
• Service providers: providers that support cloud hosting and storage, databases, identity and access management, payment processing such as Stripe, transactional email, monitoring, security, support, and professional advice. Our production deployment uses Microsoft Azure infrastructure.
• Authorities and affected parties: regulators, courts, law enforcement, advisers, insurers, or others where disclosure is required or permitted by law, needed to protect rights or safety, or necessary to investigate fraud, abuse, or a security incident.
• Corporate transactions: a prospective or actual buyer, investor, lender, adviser, or successor in connection with a financing, merger, reorganisation, or sale, subject to appropriate confidentiality and legal protections.

We require service providers to handle information for the authorised purpose and with appropriate protections where applicable. We do not sell personal information or disclose Customer Content for third-party targeted advertising.

8. Overseas storage and disclosure

Erstan and its providers may store or process personal information outside Australia. Overseas recipients are likely to be located in the United States. The destination can also depend on the region, model provider, identity provider, or connected service selected by the Customer and may include other countries in which that provider operates.

Because Customers choose different providers and, in some cases, hosting regions, it is not practicable to identify every possible country in advance. Customers should review a connected provider's location and data-residency information before enabling it. Where Australian privacy law applies, we take reasonable steps required for cross-border disclosures. Any agreed data residency commitment in an Order or data processing addendum also applies.

9. Cookies and browser storage

The Service uses cookies and similar browser storage that are needed to sign users in, complete identity-provider flows, protect sessions, remember a selected account or workspace, preserve interface preferences, prevent duplicate actions, and maintain drafts, chat continuity, or short-lived handoffs. Depending on the login mode, authentication information may be held in a secure, HTTP-only cookie or in browser storage used by the application.

You can clear cookies and site data through your browser or sign out of the Service. Blocking essential storage may prevent authentication or other features from working. We do not use application data for third-party targeted advertising. If we introduce non-essential cookie or tracking uses, we will provide additional notice and choice where required.

10. Security and data incidents

We use reasonable administrative, technical, and organisational safeguards designed for the nature of the information and the Service. These include role- and tenant-based access controls, protected transport, hashing or encryption for certain credentials, secret and token controls, audit records, monitoring, backups, and procedures for investigating suspected incidents.

No online system is completely secure. Customers are responsible for choosing appropriate users, administrators, integrations, model providers, permissions, approval settings, and endpoint protections. Please report suspected unauthorised access promptly to privacy@erstan.com.

We assess eligible data incidents and will notify affected individuals and the Office of the Australian Information Commissioner where required by the Notifiable Data Breaches scheme or other applicable law.

11. Retention and deletion

We keep personal information only for as long as reasonably needed for the purpose for which it was collected, the Customer's instructions, security and continuity, dispute resolution, and legal, tax, accounting, or regulatory obligations. The period varies with the kind of information, account status, feature configuration, sensitivity, risk, and any retention term in an Order.

For example:

• Customer Content and execution history are generally retained while the relevant account, workspace, or record remains active, unless a Customer deletes it or an agreed retention setting applies;
• short-lived authentication state, transient files, delivery events, and operational feed data expire or are purged on shorter technical schedules;
• security and audit records are kept for a period appropriate to investigation, accountability, and configured enterprise requirements; and
• billing, payment, consent, contract, and transaction records may be kept longer where needed for accounting, fraud prevention, legal claims, or compliance.

When information is no longer required, we take reasonable steps to delete or de-identify it. Deletion from backups and replicated systems occurs through ordinary rotation and recovery cycles. We may retain limited records where law requires it, where needed to protect legal rights, or where deletion would affect another person's information. A connected provider may retain information under its own terms and settings after it leaves Erstan's control.

12. Access, correction, deletion, and other choices

Depending on applicable law, you may ask to access personal information we hold about you, have inaccurate or incomplete information corrected, or request deletion, restriction, objection, or a portable copy. Some information can be reviewed or changed through account settings. Optional assistant memories can be reviewed and deleted through the relevant Service controls.

To make a request, email the Privacy Officer at privacy@erstan.com with the subject Privacy request. Describe the account and information involved, but do not send passwords or API keys. We may need to verify your identity and authority. We do not ordinarily charge for a request, and we aim to respond within a reasonable period, generally within 30 days. If an exception applies, we will explain the outcome and any available complaint route as required by law.

If the request concerns Customer Content controlled by your employer or another Customer, please contact that Customer first. Account administrators may also manage access and delete workspaces, files, integrations, memories, and other records through available controls. A request is not an absolute right to erase information that we or the Customer must retain.

13. Service communications and direct marketing

We may use business contact details to send requested beta-access updates, product information, event invitations, or other direct marketing where permitted. You can opt out using an unsubscribe method in the message or by contacting privacy@erstan.com. We will record the opt-out and stop the relevant marketing within a reasonable period.

An opt-out does not prevent essential security, billing, account, transaction, legal, or support messages. Customers control notifications they send through their own Agents and connected services and are responsible for the privacy and marketing rules that apply to those messages.

14. Privacy questions and complaints

Email the Privacy Officer at privacy@erstan.com with the subject Privacy complaint. Please explain what happened, the account or Customer involved, what outcome you seek, and how we can contact you. Do not include passwords, secret keys, or more personal information than is necessary.

We will acknowledge and investigate the complaint, involve the relevant Customer or provider if appropriate, and respond within a reasonable period, generally within 30 days. If you are not satisfied, you may be able to complain to the Office of the Australian Information Commissioner or another regulator with jurisdiction.

15. Children

The Service is intended for business users who are at least 18 years old, and children should not create accounts. Customer Content may concern a child if a Customer has a legitimate use case and the authority, notices, consent, and safeguards required by law. Contact us if you believe a child has submitted account information directly without appropriate authorisation.

16. Changes to this policy and contact details

We review this policy as the Service, our providers, and privacy law change. We will publish an updated version here and change the date above. If a change materially affects how we handle existing personal information, we will provide additional notice to the Customer or affected users where reasonably practicable or required by law.

ERSTAN PTY LTD's registered office is in Heidelberg VIC 3084, Australia. Privacy questions, requests, and complaints can be sent to the Privacy Officer at privacy@erstan.com. A postal address for written correspondence appears on the Customer's Order Form, checkout receipt, or invoice and will also be provided on request. You may request a copy of this policy in an accessible or alternative form by contacting us.