Privacy Policy

1. Introduction

GAUGЯ, operated by Venin Pty Ltd (ABN pending) ("we", "us", or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By using GAUGЯ, you consent to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our services.

2. Information We Collect

Personal Information

We may collect the following types of personal information:

• Account Information: Name, email address, phone number, business name, and ABN
• Authentication Data: Passkeys, two-factor authentication credentials, and login activity
• Business Records: Distillery production records, excise calculations, and ATO submission data
• Payment Information: Billing details processed securely through Stripe
• Usage Data: How you interact with our platform, including features used and pages visited

Automatically Collected Information

When you access GAUGЯ, we automatically collect certain information including your IP address, browser type, device information, and access times. This information helps us improve our service and ensure security.

3. How We Use Your Information

We use your personal information for the following purposes:

• To provide and maintain the GAUGЯ platform
• To process your excise calculations and generate ATO-ready reports
• To communicate with you about your account, including service updates and support
• To process payments and manage your subscription
• To improve our services and develop new features
• To detect, prevent, and address technical issues or security breaches
• To comply with legal obligations, including ATO record-keeping requirements

4. Data Storage and Security

Your data is stored securely using industry-standard practices:

• Database: Your data is stored in Neon PostgreSQL databases with encryption at rest
• Hosting: Our servers are hosted in Australia (Sydney region) to ensure data sovereignty
• Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.3
• Access Controls: Strict access controls and audit logging protect your data from unauthorized access
• Backups: Regular automated backups ensure your data is protected against loss

While we implement robust security measures, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security but will notify you of any breaches as required by law.

5. Third-Party Services

We use the following third-party services to operate GAUGЯ:

• Stripe: Payment processing (PCI-DSS Level 1 compliant)
• Resend: Email communications
• Sentry: Error monitoring (sanitized data only, no PII)
• Neon: PostgreSQL database hosting (Australian data residency)
• Anthropic Claude: AI assistant (DRAM) - requires explicit user consent
• LogRocket: Session replay for debugging (sensitive routes excluded)
• Mixpanel: Product analytics (aggregated usage data only)

These providers are bound by their own privacy policies and have been selected for their commitment to data protection. We do not sell your personal information to third parties.

5.1 International Data Transfers

In accordance with Australian Privacy Principle 8 (APP 8), we disclose that some of our third-party service providers are located overseas. Your core business data remains stored in Australia, but certain processing may occur in the following locations:

Safeguards

We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles:

• Contractual protections: Data processing agreements with all providers
• Data minimization: Only necessary information is transferred
• Encryption: All transfers encrypted via TLS 1.3
• Consent: AI features require explicit opt-in before any data transmission
• Sanitization: PII removed from error monitoring and analytics data

For more details about our data residency practices, see our Data Residency Statement.

6. Your Rights Under Australian Privacy Law

Under the Australian Privacy Principles, you have the following rights:

• Access: You can request access to the personal information we hold about you
• Correction: You can request correction of inaccurate or incomplete information
• Complaint: You can lodge a complaint if you believe we have breached the APPs
• Data Export: You can request a copy of your data in a portable format
• Deletion: You can request deletion of your personal information, subject to legal retention requirements

To exercise these rights, please contact us at privacy@venin.space.

7. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while your account is active and for 7 years after closure for legal compliance
• Excise Records: Retained for 5 years as required by ATO regulations
• Payment Records: Retained for 7 years as required by Australian tax law
• Usage Logs: Retained for 12 months for security and service improvement purposes

After the retention period, your data will be securely deleted or anonymized.

8. Cookies and Tracking

GAUGЯ uses cookies and similar technologies to:

• Maintain your authenticated session
• Remember your preferences
• Analyze usage patterns to improve our service

You can control cookies through your browser settings, but disabling them may affect your ability to use certain features of GAUGЯ.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

10. Contact Information

If you have any questions about this Privacy Policy or our data practices, please contact us:

• Email: privacy@venin.space
• Website: gaugr.au

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.