Archanaut Privacy Policy

Last Updated: 16 October 2026

Archanaut Pty Ltd (ABN 93 670 225 395) ("Archanaut", "we", "our", or "us") is committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth). This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use the ARCHANAUT ScanQ platform and related services.

1. Information We Collect

1.1 Personal Information

We collect personal information when you:

• Register for an account on the ARCHANAUT ScanQ platform
• Subscribe to our services
• Contact us for support or inquiries
• Subscribe to our newsletter or marketing communications
• Participate in surveys, webinars, or training programs

Personal information we collect includes:

• Name and professional title
• Email address and phone number
• Business address
• NatHERS accreditation details and professional credentials
• Payment and billing information
• Account login credentials

1.2 Assessment Data

When you use the platform to conduct energy assessments, we collect:

• Dwelling addresses and location coordinates
• Building characteristics (construction type, materials, dimensions)
• Photographs and visual documentation of building elements
• Energy performance measurements and calculations
• Assessment reports and compliance documentation
• Assessor notes, observations, and data overrides
• Audit trail information (timestamps, user actions, data sources)

1.3 Automatically Collected Information

We automatically collect technical information including:

• IP address and device information
• Browser type and version
• Operating system
• Usage data (pages visited, features used, time spent)
• Log files and error reports
• Cookies and similar tracking technologies

1.3a Product Analytics

We use PostHog (hosted on EU servers, posthog.com) to collect pseudonymous product analytics — including which features are used, assessment workflow stages reached, and certificate export events. This data is linked to your account by a stable internal identifier (not your email address or name) and is used solely to improve the platform.

Australian users are enrolled by default. You can opt out at any time through Account Settings → Privacy.

EU/EEA users are not enrolled by default and must explicitly opt in before any analytics data is captured.

1.4 Third-Party Data Sources

To optimize assessment workflows, we automatically retrieve data from authoritative sources:

• NCC climate zone datasets
• Cadastral and dwelling valuation records (PSMA Australia, Geoscape)
• Aerial and satellite imagery (Google Maps)
• Map tile rendering (OpenStreetMap)
• Geospatial and mapping services
• Public dwelling records and land parcel data

1.5 Consent and Your Choices

We are committed to obtaining, recording, and managing your consent in accordance with the 2024 Privacy Act reforms:

• How We Obtain Consent: When you register for an account, you provide explicit consent for us to collect and use your personal information for service delivery. Consent is obtained through clear opt-in mechanisms during registration and account setup.
• How We Record Consent: Your consent preferences are recorded in your account settings and maintained throughout your use of the platform. We keep records of when and how consent was obtained.
• How We Manage Consent: You can review and update your consent preferences at any time through your account settings. You have the right to withdraw consent, subject to legal and contractual obligations.
• Separate Consent: We obtain separate consent for different purposes:
• Service delivery and platform access (required for account operation)
• Marketing communications (optional — you can opt out at any time)
• Platform improvement and analytics (enabled by default for Australian users; you can opt out through Account Settings → Privacy; EU/EEA users must opt in)
• Withdrawing Consent: To withdraw consent, contact us at [email protected] or update your account settings. Note that withdrawing consent for essential services may affect your ability to use the platform.

Your consent is always voluntary, informed, and specific to the purposes described in this Privacy Policy.

2. How We Use Your Information

2.1 Service Delivery

• Provide access to the ARCHANAUT ScanQ: Certify platform
• Process and validate energy assessments
• Submit assessment data to the Accurate Engine (CSIRO) for NatHERS rating calculations
• Generate assessment reports and compliance documentation
• Maintain audit trails for NatHERS compliance

2.2 Account Management

• Create and manage your user account
• Process payments and manage subscriptions
• Verify professional accreditations
• Provide customer support and technical assistance

2.3 Platform Improvement

• Analyze usage patterns to improve features and workflows
• Develop and refine automated optimization algorithms
• Conduct quality assurance and accuracy testing
• Train and improve AI and machine learning models that power ScanQ features, subject to the AI training data terms in section 2.7 below

2.4 Communications

• Send service updates and platform notifications
• Provide training materials and user guides
• Send marketing communications (with your consent)
• Respond to inquiries and support requests

2.5 Compliance and Legal

• Comply with NatHERS UIP requirements
• Meet regulatory and government obligations
• Maintain records for audit and compliance purposes
• Protect against fraud and security threats
• Enforce our Terms of Service

2.6 Automated Processing and AI

In accordance with the 2024 Privacy Act reforms, we disclose our use of automated processing:

• Platform Optimization: We use artificial intelligence and machine learning to improve platform features, including:
• Computer vision models to assist with building element identification from photographs
• Automated data extraction from dwelling records and imagery
• Workflow optimization algorithms to streamline assessment processes
• No Automated Decision-Making Affecting Users: We do not use automated processing to make decisions that significantly affect your rights or access to services. All assessment validations, account decisions, and compliance determinations involve human review and oversight.
• Human Oversight: Assessors maintain full control over assessment data and decisions. AI tools provide suggestions and assistance, but final decisions rest with the professional assessor.
• Transparency: When AI assists with data extraction or suggestions, this is clearly indicated in the platform interface, and assessors can review, modify, or override any AI-generated suggestions.

If our use of automated processing changes in ways that significantly affect users, we will update this Privacy Policy and notify you in accordance with Section 8.

2.7 AI Training Data Use

Archanaut may use de-identified or aggregated assessment data (including inputs, outputs, and usage patterns) to train, evaluate, and improve AI and machine learning models that power ScanQ features. This use is governed by the AI training data licence set out in section 7B of the Archanaut Terms of Use.

• What is used: De-identified or aggregated assessment data and usage patterns
• What is not used: Client personal information collected by assessors; any data that has not been de-identified
• Purpose: Solely to improve the accuracy and quality of ScanQ features
• No sale: Archanaut does not sell your data or any AI models trained using your data to third parties
• Opt-out / opt-in: Basic and Pro tier users may opt out via account settings. Enterprise tier users are not subject to AI training data use by default and may opt in. Free tier users acknowledge AI training data contribution as a condition of free access.

3. Information Sharing and Disclosure

3.1 NatHERS and Government Authorities

We share assessment data with:

• Accurate Engine (CSIRO) — mandatory for NatHERS compliance
• NatHERS Administrator for accreditation and compliance purposes
• Government agencies as required by law or regulation

3.2 Service Providers

We engage trusted third-party service providers who process data on our behalf:

• Cloud Infrastructure: Google Cloud Platform (GCP), Amazon Web Services (AWS) — for data storage and platform hosting
• Geospatial & Address Data: Geoscape (PSMA Australia) — for address lookup and geocoding; Google Maps — for mapping and satellite imagery; OpenStreetMap — for map tile rendering
• Property Data: Cotality, Domain.com.au — for property valuation and sales data where integrated
• Payment Processing: Stripe — for subscription billing and secure payment processing
• Security & Monitoring: Internal security tooling and third-party security consultants — for security assessments and monitoring

All service providers are bound by confidentiality agreements and process data only as instructed by us.

3.3 Business Transfers

If Archanaut is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

3.4 Legal Requirements

We may disclose your information if required by law, court order, or government authority, or to protect our rights, property, or safety.

3.5 Cross-Border Data Transfers

While we prioritize Australian data residency, some of our service providers may process or store data outside Australia:

• Primary Data Location: All primary data storage is in Australian data centers (GCP Australia region)
• Overseas Service Providers: Some service providers (such as Google Maps, Stripe, and certain cloud infrastructure providers) may process data in overseas locations including the United States and other jurisdictions
• Safeguards: When we transfer personal information overseas, we ensure service providers are bound by contractual obligations, transfers comply with APP 8, and appropriate technical security measures are in place
• Your Consent: By using our platform, you consent to these overseas transfers subject to the safeguards described above

3A. NatHERS-Specific Data Handling

This section applies only where ScanQ is used for NatHERS for Existing Homes assessments. It does not apply to other use cases of ScanQ outside the scope of the NatHERS for Existing Homes programme.

3A.1 Quality assurance and audit

For quality assurance or audit purposes, the User agrees for Archanaut and associated third-party software applications (including those located overseas) to collect their personal information. This information may be disclosed to the NatHERS Administrator or persons appointed by the NatHERS Administrator to act on its behalf. Archanaut may also provide to the NatHERS Administrator material relevant to the User's use of the platform, assessments performed, and Home Energy Rating Certificates generated.

3A.2 Consent required for platform access

If a User does not consent to personal information being collected, used, and disclosed as required for NatHERS compliance, it will not be possible for that User to access or use the platform for NatHERS for Existing Homes assessments.

3A.3 Personal information handled under multiple policies

Where applicable to NatHERS use, personal information is handled in accordance with this Privacy Policy, the Australian Government Department of Climate Change, Energy, the Environment and Water's Privacy Policy, and the Privacy Act 1988 (Cth).

3A.4 Client personal information

When assessors use the platform to conduct NatHERS for Existing Homes assessments, client personal information is collected through the platform. This may include sensitive information such as photographs, videos, building plans, appliance records, and information that could relate to a client's personal or family life, financial status, or cultural or religious background. This information may be disclosed to Archanaut and third-party software platforms that support assessment generation, and to the NatHERS Administrator, AASPs, or persons appointed to act on their behalf for quality assurance and audit purposes.

4. Data Storage, Security and Retention

4.1 Data Location

• Primary storage: Australian-based data centers (GCP Australia region)
• Backup storage: Redundant cloud storage (Azure Australia region) with Australian data residency

4.2 Security Measures

• End-to-end encryption (TLS 1.2+ in transit, AES-256 at rest)
• Role-based access control (RBAC) via Azure Entra ID
• Multi-factor authentication (MFA) for user accounts
• Continuous security monitoring and audit logging
• Regular security assessments and penetration testing
• Compliance with PSPF and ISM security frameworks

4.3 Data Retention

• Assessment Data: 7 years (NatHERS compliance requirement)
• Account Information: Duration of active account plus 7 years
• Audit Trails: 7 years for compliance and regulatory purposes
• Marketing Data: Until you unsubscribe or request deletion

4.4 Data Breach Response

In accordance with the Notifiable Data Breaches (NDB) scheme, we will notify the OAIC and affected individuals as soon as practicable — typically within 72 hours of becoming aware of an eligible data breach. To report a suspected breach, contact [email protected].

5. Your Privacy Rights

5.1 Right to Access

Email [email protected] with your access request. We will respond within 30 days.

5.2 Right to Correction

Email [email protected] with details of the inaccurate information. We will respond within 30 days.

5.3 Right to Deletion

Email [email protected] with your deletion request. We will respond within 30 days. Note that some information may be retained due to NatHERS 7-year retention requirements or legal obligations.

5.4 Right to Complain

Lodge a complaint at [email protected]. If unsatisfied, contact the Office of the Australian Information Commissioner (oaic.gov.au, phone 1300 363 992, email [email protected]).

5.5 Marketing Opt-Out

Click "unsubscribe" in any marketing email, update your account preferences, or contact [email protected].

6. Cookies and Tracking Technologies

We use cookies to maintain your login session, remember your preferences, and analyze platform usage. You can control cookies through your browser settings, though disabling them may affect platform functionality.

7. Children's Privacy

The platform is designed exclusively for professional use by accredited NatHERS assessors aged 18 and over. We do not knowingly collect personal information from individuals under 18 years of age.

8. Changes to This Privacy Policy

Material changes will be notified via email and posted on our website at least 30 days before taking effect. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

9. Contact Us

Archanaut Pty Ltd

ABN: 93 670 225 395 · ACN: 670 225 395

Email: [email protected]