Privacy statement

Your answers stay in your browser

The Health Check has no accounts. Your answers are held in your browser's session storage, and your report is generated on your own device. We do not receive or store your individual answers or your report unless you ask us to help (see "When you ask us to help" below). Closing the browser tab clears them.

Anonymous statistics, stored in Australia

When a report is generated, we record a small set of anonymous aggregate signals so we can understand trends and publish benchmarks on how Australian organisations are tracking: sector, headcount band, whether APRA-regulated or EU-exposed, the maturity score and exposure rating, obligation counts, and the broad categories of AI use and data handling your answers indicate (for example the kinds of AI tools, whether AI touches personal or health information, whether it is used in decisions about people, and which specific obligations were triggered). Nothing that identifies you or your organisation is collected: no names, emails, IP addresses, organisation name, logo or free text. These statistics are stored in Sydney, Australia (AWS ap-southeast-2) and never leave Australian infrastructure.

Report links carry your answers

When you copy a report link, your answers are encoded into the link itself so the report can be regenerated by whoever opens it. That is what makes reports shareable without a server, and it also means anyone you give the link to can see the assessment results. Share report links as you would share the report.

Email, only if you ask

If you choose to subscribe for obligation updates, your email address (and the maturity level of your report, so updates can be relevant) is processed by AIRiskAware and stored with MailerLite, our email provider. Nothing else from your assessment is sent. Every email includes an unsubscribe link, and unsubscribing removes you from the list.

When you ask us to help

When you choose to email yourself your report, or to book a call, you are asking us to help, so we keep the details of your assessment (your answers and the obligations they triggered, along with your role, sector and exposure rating) so a specialist can prepare. We email you your report as a link, and that link also contains your answers so you can reopen it. The email is sent through our email provider, Resend. This is the consented exception to the promise above: unless you ask us to help, your answers stay in your browser and are not kept by us. We use what we keep only to support you, and if you request a consultation your details are sent to the AIRA team as a referral so a specialist can reach out. It is stored in our database in Sydney, Australia, kept only as long as needed to help you, and you can ask us to delete it at any time by emailing contact@airiskaware.com.

Pack access by email

If you buy a pack (the Pro Pack, the Control Pack, or the CPS 230 Pack), the email address you pay with is stored so that entering it on your report unlocks document generation for that pack, on this device and any other. It is used only to confirm your purchase. The documents themselves, your organisation name and your logo are still built entirely in your browser and are never sent to us.

What the infrastructure sees

This site is hosted on Vercel, which collects standard server request logs (IP address, user agent, pages requested) for operation and abuse prevention. We run no advertising trackers and no third-party analytics scripts on this site.

We also use Vercel Analytics, a cookieless, privacy-preserving traffic measurement tool. It records which pages are visited and basic device and referral information without setting any cookies, without tracking individual users across sessions, and without sharing data with advertising networks.

Funnel stage events

To understand where people drop out of the assessment, we record anonymous funnel-stage signals (assessment started, assessment completed, Pro Pack page viewed, Pro Pack redeem clicked, email captured) and your inbound referral source (?ref= tag) alongside the aggregate statistics described above.

We also record a few more anonymous funnel signals so we can see how the assessment flows: which persona you are shown (for example founder, board member or risk lead), each section you finish (with a rough time-on-section bucket, never an exact timing), the section you were on if you leave before finishing, when the report is viewed, and which call-to-action on the report you click (its label only). Each of these carries the persona so we can read the funnel by audience.

These are non-identifying funnel signals. None of these events carry answer content, names, emails or any information that could identify you or your organisation.

Contact

Privacy questions can be raised through AIRiskAware contact. If you have subscribed and want your email removed, use the unsubscribe link in any email or contact us and we will remove it.