This policy is provided for review and must be confirmed by legal counsel before public launch.
This Privacy Policy explains how Airfree collects, uses, discloses, and protects personal information, and the rights you have over your data. We are committed to handling personal information in accordance with the Australian Privacy Act 1988 (including the Australian Privacy Principles) and the EU General Data Protection Regulation (GDPR) where it applies.
1. Who we are
This policy applies to Airfree Services Pty Ltd (ABN 12 345 678 901), the intellectual-property and infrastructure holding company of the Airfree group of companies, together with its trading subsidiaries — Airfree Geospatial Pty Ltd, Airfree Maps Pty Ltd, Airfree Mail Pty Ltd, Airfree Clouds Pty Ltd and Airfree Government Pty Ltd. For personal information handled under this policy, Airfree Services Pty Ltd (or the relevant subsidiary providing the Service to you) is the data controller.
2. Information we collect
We collect personal information that you provide, that is generated when you use the Services, and, in limited cases, that we receive from third parties such as identity providers.
- Account and identity data: name, email address, organisation, role, and the credentials managed by our single sign-on identity provider.
- Usage and device data: log data, IP address, browser and device information, pages and features used, and diagnostic data.
- Content data: the files, geospatial datasets, and other content you upload to or create in the Services.
- Location and geospatial data: where you enable location features or upload spatial data, which may relate to identifiable places or people.
- Billing data: where you subscribe to paid Services, billing contact details and transaction records (card details are handled by our payment processor, not stored by Airfree).
- Communications: correspondence when you contact us for support or enquiries.
3. How and why we use your information
We use personal information to provide, operate, secure, and improve the Services; to authenticate users and manage accounts; to process payments; to provide support; to communicate with you about the Services; to detect and prevent fraud, abuse, and security incidents; and to comply with our legal obligations.
4. Legal bases for processing
Where the GDPR applies, we rely on one or more of the following legal bases: performance of a contract with you; your consent (which you may withdraw at any time); our legitimate interests in operating and securing the Services, balanced against your rights; and compliance with legal obligations. Under Australian law, we collect and handle personal information consistently with the Australian Privacy Principles.
5. Disclosure of your information
We do not sell personal information. We disclose it only as needed to operate the Services: to service providers and sub-processors acting on our behalf under contract; within the Airfree group of companies; to your organisation where you use the Services under its account; and to authorities where required by law or to protect rights and safety.
6. International transfers
Airfree operates a self-hosted platform and prioritises data residency in Australia. Where personal information is transferred or accessed across borders — for example by a sub-processor — we take reasonable steps to ensure it receives a comparable level of protection, using appropriate safeguards such as Standard Contractual Clauses where the GDPR requires them.
7. Data retention
We keep personal information only for as long as necessary for the purposes described in this policy or as required by law, after which it is deleted or de-identified. Retention periods are set out in our Data Retention Policy.
8. Security
We apply administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorised access, including encryption in transit, access controls, tenant isolation, and least-privilege database access. See our Security Policy for more detail.
9. Your rights
Subject to applicable law, you have rights over your personal information. To exercise a right, contact us via /contact or our Privacy Officer, and we will respond within the time required by law.
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to correct information that is inaccurate or out of date.
- Erasure — ask us to delete your personal information where there is no lawful basis to retain it.
- Restriction and objection — where the GDPR applies, restrict or object to certain processing.
- Portability — where the GDPR applies, receive certain data in a structured, machine-readable format.
- Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.
- Complain — lodge a complaint with us and, if unsatisfied, with the Office of the Australian Information Commissioner (OAIC) or your local supervisory authority.
10. Cookies
We use cookies and similar technologies to operate and improve the Services. How we use them, and your choices, are described in our Cookie Policy.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a revised "last updated" date and, where changes are material, take reasonable steps to notify you.
12. Contact and Privacy Officer
For any privacy question, request, or complaint, contact our Privacy Officer via /contact. We will acknowledge and respond within the timeframes required by the Australian Privacy Act and the GDPR.