Privacy notice

1. Who we are

Irate is operated by ApexOne, the trading name of APX 1 Pty Ltd (ACN 690 198 684) as trustee for the APX1 Trust (ABN 65 471 502 316), based in New South Wales, Australia ("Irate", "we", "us"). This notice explains how we handle personal information when you visit irate.ai, contact us, or work with us as a client, partner or supplier.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where other privacy laws apply to you, such as the EU or UK GDPR, India's Digital Personal Data Protection Act 2023, the UAE Personal Data Protection Law or US state privacy laws, we also honour the rights those laws give you.

2. Our two roles

• Our own records. For website visitors, enquiries, business contacts and marketing, we decide how the information is used. This notice covers that information.
• Client data. When a client connects Irate to its security tools, we process the alerts, logs and telemetry in that environment (which can include its staff's names, usernames, email addresses, device names and IP addresses) only on the client's instructions, under our agreement and data processing addendum with them. The client decides what is processed. If your employer uses Irate and you have a question about that data, please contact your employer first; we will help them respond.

3. What we collect

• What you send us. When you use a form or email us: your name, work email, company, role, phone number if you give it, your message, and whether you opted in to the monthly intel brief. The incident form may also include details of a security incident you are dealing with; we treat those as confidential.
• Technical data. Like every website, ours receives your IP address, browser type, the pages requested and the time. Our hosting and network providers keep these request logs for a short time to deliver the site and protect it from attack.
• Business relationship data. Contact details, correspondence, meeting notes, contracts and billing records for clients, partners and suppliers.
• Platform account data. For people with access to the Irate console: name, work email, role, and audit records of what they viewed, approved or changed, with the time and source address.

We do not ask for sensitive information such as health, racial or religious information. Please do not include it in a form. You do not have to give us any personal information, but without contact details we cannot reply.

4. Cookies and tracking

This website uses no analytics, advertising or tracking cookies, and loads no third-party scripts. Your browser may keep a small setting on your own device, such as whether you prefer reduced motion; it is never sent to us. Our network provider may set a strictly necessary security cookie to tell people from automated attacks. The Irate console uses session cookies only to keep you signed in.

5. How we use it

• To reply to you, arrange a demo, scope an engagement or respond to an incident you report.
• To deliver, support, secure and bill for our services.
• To send the monthly intel brief and occasional product news, but only if you opted in. Every email has an unsubscribe link.
• To keep the website and platform secure, investigate misuse and keep audit records.
• To meet legal, tax and regulatory obligations and to establish or defend legal claims.

We do not sell personal information, rent it, or share it with anyone for their own advertising.

6. AI and automated processing

• We do not use client data, or anything you send through this website, to train or fine-tune AI models, ours or anyone else's.
• Irate investigates security alerts automatically. It does not make decisions about individuals that have legal or similarly significant effects, and any change to a client's environment needs approval from a person.

7. Who we share it with

• Service providers that host and run our systems for us: Vercel (website hosting), Cloudflare (network, security and email routing), Amazon Web Services (platform hosting) and our email delivery provider. They may use the information only to provide their service to us.
• Our team and related entities in Australia, the UAE, India and the US, on a need-to-know basis and under confidentiality obligations.
• Professional advisers such as lawyers, accountants and auditors.
• Authorities where the law requires it, or where needed to protect people, our clients or our systems.
• A buyer or investor as part of a merger, acquisition or financing, under confidentiality and only so that this notice continues to apply.

Clients can request our current list of sub-processors for client data at any time.

8. Where it is held

Client data on the Irate platform is hosted in AWS Sydney (ap-southeast-2). Website and business records may be processed by our service providers in other countries, including the United States, and accessed by our team in the countries listed above. Before information leaves Australia or your region, we take reasonable steps to make sure the recipient protects it to a standard comparable to this notice, including contractual safeguards such as standard contractual clauses where the GDPR applies.

9. How long we keep it

• Enquiries that do not lead to a relationship: up to 12 months after our last contact.
• Client, partner and supplier records: for the relationship and five years after it ends, in line with Australian tax and corporate record-keeping law.
• Client data on the platform: as set out in the client's agreement, then deleted or returned when the agreement ends.
• Website request logs: a short period set by our providers, usually days to weeks.
• Marketing preferences: until you unsubscribe, after which we keep only what we need to stop emailing you.

10. Security

Our information security management is certified to ISO/IEC 27001 and our controls are covered by a SOC 2 Type I report. Client data is isolated per client, encrypted in transit and at rest, and access is limited and logged. The Trust page has the detail. No system is perfectly secure; if we have a data breach that is likely to cause you serious harm, we will notify you and the relevant regulator as the law requires.

11. Your rights

Depending on where you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is wrong, out of date or incomplete;
• delete it, or restrict or object to how we use it;
• give it to you in a portable format;
• stop sending you marketing, at any time;
• withdraw consent you have given, without affecting what we did before.

Email [email protected]. We may need to confirm your identity first. There is no charge, and we aim to reply within 30 days. If we cannot do what you ask, we will explain why. If your request is about client data, we will pass it to the client and help them respond.

12. Complaints

Please tell us first at [email protected] and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the data protection authority where you live.

13. Children

Our website and services are for businesses. They are not directed at anyone under 18 and we do not knowingly collect children's information.

14. Changes to this notice

We will update this notice when our practices change and show the date at the top. If a change materially affects clients, we will tell them directly before it takes effect.

15. Contact

Privacy: [email protected]. Security issues: [email protected]. Everything else: [email protected].