What we know about you, where we keep it, and how to get it back.
Trust is not a badge you put on a page. It is the set of operational choices that the badge is meant to certify. This is the ledger of those choices.
AU data residency
Primary storage runs on Supabase in Sydney, AWS ap-southeast-2. Application compute runs on Fly.io in the syd region. Your data never leaves AU jurisdiction without an explicit DPA modification signed by both parties.
Encryption and isolation
Priors Bank privacy
The Priors Bank is a category-level pool of posteriors. What enters it is a de-identified probability distribution, not your spend numbers. The pipeline is tested before the pool ever surfaces a prior.
If a category drops below five contributors, the aggregate falls back to published industry benchmarks (Binet-Field, Nielsen, WARC) rather than a pooled prior.
Gaussian DP noise is added to each posterior before pooling. The budget is tracked per category aggregate and audited quarterly.
Contributor slots are keyed by HMAC with a rotating secret. A pooled prior cannot be traced back to a client identity.
Opting out is effective immediately for future pooling. You retain full read access to the Priors Bank for your own modelling runs. Past contributions can be flagged for removal on request.
Plain-English detail: IP and data ownership.
Audit trail
Every mutating API call is written to an append-only audit_log table with actor, resource, before-hash, after-hash, and request ID. The table is write-once at the Postgres role level; even the Acera API role cannot rewrite history. Enterprise clients can request their audit stream as a signed export.
Data subject rights
Under the Australian Privacy Act 1988 and the GDPR, you may exercise the following rights in respect of personal information we hold about you.
How we handle each request is documented in the Privacy Policy. To make a request, email privacy@aceralabs.com.au.
Breach notification
Notify the lead supervisory authority within 72 hours of becoming aware, per GDPR Article 33. Affected data subjects notified without undue delay where the risk is high.
Notifiable Data Breaches scheme under the Privacy Act 1988: OAIC and affected individuals notified as soon as practicable and within 30 days where the breach is eligible.
Compliance roadmap
We will not claim certifications we do not hold. This is where we actually are.
Subprocessor register
Full list with roles, data regions, and transfer bases. The canonical register is maintained at /legal/subprocessors.
| Name | Purpose | Data access |
|---|---|---|
| Anthropic | LLM inference (Claude) | Prompt context + analytical outputs. Not used to train models. |
| Supabase | Postgres database + auth | All structured personal data, encrypted at rest. |
| Fly.io | Compute (region syd) | Data in transit; compute processing. |
| Cloudflare | CDN, DNS, Turnstile | Request metadata only. No raw uploaded data. |
| Stripe | Billing | Billing information only. Acera never holds card data. |
| PostHog | Product analytics | Anonymised events + session IDs. Disabled if you decline cookies. |
| Sentry | Error monitoring | Error traces. PII scrubbed at the SDK. |
| Resend | Transactional email | Recipient address + transactional content. |
| Zoho | Operational mail (hello@, privacy@, etc.) | Inbound and outbound mail content. |
Contact
Mailbox provisioning is in progress. If a mailbox below bounces, email hello@aceralabs.com.au with the intended subject line and we will route it.