Privacy note
A plain explanation of the information we hold.
This is a draft, and it has not been checked by a lawyer.
It was written by us, not by a lawyer, and it still has to be reviewed by a qualified Australian lawyer before a customer relies on it. The Privacy Act 1988 has rules about what a privacy notice must contain, and this note has not been checked against them. Every square-bracket blank below has to be filled in, and anything marked [to be confirmed] is not a fact yet.
What we hold about you
Two small piles, and they do not mix.
On your own server
Everything you actually do with the assistant: your work, your files, your conversations with it. That pile is yours, and it sits on the machine we rent for you. We do not copy it into our console or billing records. The encrypted nightly backup is the only data we hold away from your server, and it is encrypted before it leaves the machine.
In our billing records
The basics we need to charge you and keep the tax office happy: your name, email address, billing address, your server plan, your credit top-ups and balance, what you have paid, and the fact that you became a customer. We do not need, and do not keep, your card number. Stripe holds that, not us.
Where it lives
- Your own box: a machine we rent from OVHcloud, in whichever of their regions is closest to you. That is where your content is.
- Our billing records: our own small systems, and Stripe's records for the payments themselves.
What we never do
- We do not read your content, or look at your work, for any purpose of ours.
- We do not sell your information to anyone, ever.
- We do not use your content to train any AI model, ours or anyone else's.
- We do not hand your data to a third party to advertise to you.
- We do not give your details to another customer, or use one customer's data to serve another.
Who else touches it
- OVHcloud rents us the machine. They hold the disk your data sits on. [to be confirmed: what their own terms let them do with data on their hardware]
- [to be confirmed: who runs the gateway, and under whose terms] runs the small gateway that passes your AI requests through, using our keys. It handles the traffic, not your stored work.
- Stripe takes your payment. They hold your card details; we never see them.
- The AI model providers [to be confirmed: which model providers we actually send requests to]. These are the ones to look at closely. When the assistant asks a model to do something, the words of that request leave your server and go to the model provider's systems. That is how the assistant works. They see the content of the request.
Do the model providers train on what they see?
This is a question, not a promise. We have not yet had a written answer from every provider about whether content sent through a commercial API account may be used to train their models, and for how long they keep it. Until we have that answer in writing, treat this as unresolved. We are not going to sell you on it.
These are the questions we have put to each provider:
- Is content sent through our paid API account used to train your models? Yes or no.
- If yes, can we turn that off, and does it apply to paying business accounts?
- How long do you keep the content of an API call, and where is it stored?
- Does your answer change when we are passing our customers' requests through the API rather than our own?
When we have answers, we will put the plain-English version right here, and we will tell you if your data flows anywhere new.
How long we keep things
- Your content on your own server: for as long as you are a customer.
- After you leave: 30 days, then we delete it.
- Backup copies: deleted with the rest at the end of those 30 days. We will give you the honest date rather than say “instantly”.
- Billing and tax records: kept for as long as Australian tax law makes us keep them. [to be set by a lawyer: how many years that is] [to be confirmed]
Asking for a copy, or for deletion
Email [email protected]. Say what you want (a copy, deletion, or both) and we will do it without asking why. We will tell you what has been done and what is left at any point you ask. If you are unhappy with how we handled it, email [email protected] and we will deal with it properly. You can also complain to the Office of the Australian Information Commissioner. [to be confirmed]
Contact
Steward Host · Tal Noam Ferdman, sole trader · ABN 30 262 961 643 · 345c Mona Vale Rd, St Ives NSW 2075, Australia · [email protected] · stewardhost.com
Effective 16 October 2026. Last updated 16 October 2026.