Privacy Policy

Valencia AI ("we", "us", or "our") is committed to protecting your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, disclose, and store your personal information when you use our website at valencia-ai.com and our compliance document services.

1. Information We Collect

Information you provide directly

When you use our intake form or purchase our services, we may collect:

• Full name and position/title
• Email address
• Phone number
• Organisation name and trading name
• Australian Business Number (ABN)
• Organisation type and service details (e.g. NDIS registration groups, aged care service categories)
• Payment information (processed securely by Stripe; we do not store your card details)

Information collected automatically

When you visit our website, we may automatically collect:

• IP address and approximate location
• Browser type and operating system
• Pages visited and time spent on the site
• Referring website or source

2. How We Use Your Information

We use your personal information to:

• Process your orders and generate personalised compliance documents
• Send you your purchased documents via email
• Communicate with you about your order, including confirmations and support
• Generate AI-powered compliance documents tailored to your organisation
• Improve our services and website experience
• Comply with our legal and regulatory obligations
• Send administrative notifications, such as order reminders or service updates

3. Third-Party Service Providers

We use the following trusted third-party providers to operate our services. Your data may be shared with these providers only as necessary:

Stripe (Payment Processing)

We use Stripe to securely process payments. When you make a purchase, your payment card details are sent directly to Stripe and are never stored on our servers. Stripe's privacy policy is available at stripe.com/au/privacy.

Supabase (Data Storage)

Customer and order data is stored in Supabase, a cloud-hosted database platform. Supabase encrypts data at rest and in transit. Their privacy policy is available at supabase.com/privacy.

Resend (Email Delivery)

We use Resend to send transactional emails, including document delivery and order confirmations. Your name and email address are shared with Resend for this purpose. Their privacy policy is available at resend.com/legal/privacy-policy.

Cloudflare (Hosting and Security)

Our website is hosted on Cloudflare Pages. Cloudflare may collect web traffic data such as IP addresses for security and performance purposes. Cloudflare may also provide website analytics. Their privacy policy is available at cloudflare.com/privacypolicy.

Anthropic (AI Document Generation)

Some of our compliance documents are generated using AI technology provided by Anthropic (Claude). Organisation details you provide may be sent to Anthropic's API to generate personalised documents. Anthropic does not use API inputs for model training. Their privacy policy is available at anthropic.com/privacy.

4. Cookies and Tracking

Our website may use:

• Essential cookies — required for the website to function correctly (e.g. session management)
• Analytics — Cloudflare may collect anonymised analytics data to help us understand how visitors use our site

We do not use advertising cookies or share browsing data with advertisers. You can control cookies through your browser settings.

5. Data Retention

We retain your personal information for as long as necessary to:

• Fulfil the purposes for which it was collected (e.g. delivering your documents)
• Comply with legal obligations, including Australian tax record-keeping requirements (generally 5 years)
• Resolve disputes and enforce our agreements

If you request deletion of your data, we will remove your personal information from our active systems within 30 days, except where retention is required by law.

6. Data Security

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest
• Access controls limiting who can view your data
• Secure payment processing through Stripe (PCI-DSS compliant)
• Regular review of our data handling practices

7. Overseas Disclosure

Some of our third-party service providers (Stripe, Supabase, Resend, Cloudflare, Anthropic) may store or process data on servers located outside of Australia, including in the United States. Before disclosing personal information overseas, we take reasonable steps to ensure the overseas recipient handles your information in accordance with the APPs.

8. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct any inaccurate or incomplete information
• Deletion — request that we delete your personal information (subject to legal retention requirements)
• Complaint — lodge a complaint if you believe we have breached the APPs

To exercise any of these rights, please contact us using the details in Section 10.

9. Complaints

If you believe we have breached the Australian Privacy Principles, you may lodge a complaint with us using the contact details below. We will investigate and respond to your complaint within 30 days.

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

10. Contact Us

If you have any questions about this Privacy Policy or wish to make a request regarding your personal information, please contact us:

• Email: [email protected]
• Website: valencia-ai.com

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.