1. Who we are
Provance is operated by Chad and Gabsy Pty Ltd (ABN 70 633 285 631), Victoria 3104, Australia (“Provance”, “we”, “us”). This policy covers the website at provancelabs.org, the Provance app at app.provancelabs.org, the Provance API and SDKs, and email we send you.
Questions about privacy, or a request about your information: [email protected].
2. Your data and our role
We handle two kinds of information, and our role differs:
- Account, billing and website information (who you are, how you pay, how you use the service). We decide how this is used. Under Australian law we are the entity that holds it; under the GDPR and UK GDPR we are the controller.
- Customer content: what your organisation puts into Provance or has Provance produce, such as Engine projects and documents, domain configurations, gold standards, generated conversations, and the conversation data you upload to the Compliance Pack. We process it on your organisation's behalf and under its instructions. Under the GDPR we are a processor for it. If your content contains personal information about other people, your organisation is responsible for having the right to give it to us.
3. What we collect
- Account details: your name, email address and password (stored only as a one-way hash), the organisations you belong to and your role in each.
- Billing details: your organisation's billing contact, billing country, plan and invoice history. Card details go directly to our payment provider, Stripe; we never see or store full card numbers.
- Customer content: as described above. Personal details we detect in it are removed before it is stored (see section 5).
- Your own AI model keys, if you add one for Engine, so we can call your provider for you.
- Usage and technical records: what you used and when (for allowances and billing), an audit trail of significant actions, and service logs such as IP address, request identifiers and errors.
- Messages you send us, for example by email.
The website collects no personal information through forms, analytics or advertising tools. Our website host processes the technical details of each request (such as your IP address) to deliver the page.
4. How we use it, and why
- To provide the service you signed up for: running your projects, runs and checks, keeping your evidence, sending verification and invitation emails, and supporting you. (GDPR basis: performing our contract with you.)
- To bill you and keep financial records. (Contract, and our legal obligations.)
- To keep the service secure and reliable: preventing abuse, enforcing fair use and our Acceptable Use Policy, and fixing faults. (Our legitimate interests in running a safe service.)
- To tell you about important changes to the service, your plan or these policies. (Contract and legitimate interests.)
- To meet legal obligations, such as tax record-keeping and responding to lawful requests.
We do not sell personal information and we do not use it for advertising. Provance does not train AI models on your content or on your personal information, and we guarantee this in our Terms of Service. We will ask for your consent before using your information for anything else.
5. How personal details in your content are handled
Provance removes personal details from customer content before it is stored or sent to any AI model. Names (except a first name), street addresses, phone numbers, email addresses, dates of birth, and identity, card and bank numbers are replaced with placeholders or with reserved fictional values that belong to no one. We keep only the type and number of details replaced, never the details themselves.
Each organisation chooses how personal details are handled: remove them (the default), refuse any upload that contains them, or, for your own conversations returned to you or sent to your own storage, pass them through as your responsibility. The choice is recorded. Whatever the setting, AI models only ever receive de-identified text, and nothing that still contains a detected personal detail can be exported.
Detection is automated and pattern-based, so it can miss details, for example a full name written in ordinary prose. Please do not upload personal information you do not need to, and do not upload sensitive information (such as health information) unless you have a lawful basis and have told us about it.
Some things are stored as you entered them: the text you type into an Engine project (such as your concept and intake answers) and the names of files you upload. Prompts built from them are de-identified before any model sees them.
6. AI model providers
Provance uses AI models from third-party providers to generate, check and review content. They receive de-identified text only. The providers we use, and where, are listed on our Sub-processors page. For organisations in health or government, some hosted providers are not used at all. That page also describes how long each provider keeps what it receives.
If you add your own model key for Engine, your requests (de-identified first) go to that provider under your own agreement with it, and that provider's terms and privacy policy apply to what it receives.
8. Information sent overseas
Provance is hosted in Australia (Amazon Web Services, Sydney region). Some of our service providers process information outside Australia, including in Singapore and the United States, and our website is delivered through a global network. The Sub-processors page lists each location.
Before disclosing personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles. Where the GDPR or UK GDPR applies, we rely on an adequacy decision or on safeguards such as standard contractual clauses in the provider's data processing terms. For personal data that customers send to Provance from the European Economic Area, the UK or Switzerland, our Data Processing Agreement includes the EU standard contractual clauses.
We plan to offer an Australia-only option, in which all processing, including hosted AI models, stays in Australia. Until it is available, the providers listed on the Sub-processors page outside Australia are used.
9. How long we keep it
Australian law sets our default minimum periods. Because Provance exists to keep evidence of how AI work was done, where another law or standard that may apply to you requires longer, we keep records for that longer period:
- Model logs (the de-identified text sent to a model): at least 6 months. After the period your organisation sets, the text is removed and only its hash is kept.
- Documentation (projects, documents, conversations, versions, checks and their results): 6 years by default. Government organisations can follow their records authority instead.
- Billing, usage and tax records: 7 years (Australian law requires 5 years for tax records and 7 for company financial records).
- Compliance Pack uploads: you can delete the uploaded conversation text at any time; the outcomes, usage and audit trail are kept as above.
If your organisation closes its account, its access ends straight away. Information that no minimum period covers is deleted at closure, and is gone from our backups within 90 days. Records that a minimum period covers are removed in stages as each period ends, and every removal is recorded. The hashes in the evidence chain are kept so that evidence you have already shared can still be verified; they do not contain your content.
10. How we protect it
We use measures suited to the risk, including encryption in transit, role-based access within each organisation, separation of each organisation's data, an audit trail of significant actions, and append-only evidence records that cannot be quietly altered. No system is perfectly secure; if you believe there is a problem, tell us at [email protected].
11. Your rights
Under the Australian Privacy Act 1988 you can ask to access the personal information we hold about you and to correct it. If the GDPR or UK GDPR applies to you, you can also ask us to delete it, restrict or object to how we use it, give you a copy in a portable format, or withdraw consent you have given.
Email [email protected] with your request. We may need to confirm your identity. We will respond within 30 days, and we will not charge you for a reasonable request. Some rights have limits, for example where we must keep records by law.
If your request is about content your organisation put into Provance, we will usually refer you to that organisation, because we process that content on its behalf.
12. Complaints
If you are unhappy with how we have handled your information, contact us first at [email protected] and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au), or, if the GDPR applies, to your local data protection authority (in the UK, the Information Commissioner's Office).
14. Children
Provance is a business service for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you think we have, contact us and we will delete it.
15. Data breaches
If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. Where the GDPR or UK GDPR applies, we will notify the relevant authority within 72 hours where required. If a breach affects content we process for your organisation, we will tell your organisation without undue delay so it can meet its own obligations.
16. Changes to this policy
We will post any change on this page with a new “Last updated” date. If a change materially affects how we use your information, we will tell account owners by email before it takes effect.