Privacy Policy

Last updated: April 8, 2026

1. Information We Collect

We collect information you provide directly to us, such as when you create an account, upload evidence, or contact us for support. This includes your name, email address, organization details, and any evidence files you upload.

We also automatically collect certain information about your device and how you interact with our services, including IP addresses, browser type, operating system, and usage data.

2. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our services
  • Process and store evidence packages securely
  • Send you technical notices, updates, and support messages
  • Monitor and analyze usage patterns to improve user experience
  • Comply with legal obligations

Our legal bases for processing (under GDPR) include: performance of a contract with you, compliance with legal obligations, our legitimate interests in operating and improving the Service, and your consent where specifically requested.

3. Data Security

We implement industry-standard security measures to protect your data. Evidence files are encrypted at rest and in transit. Cryptographic signatures and timestamps ensure the integrity of all uploaded evidence cannot be altered after capture.

4. Data Retention

We retain different categories of data for different periods based on legal requirements and business necessity:

  • Account information: Retained for as long as your account is active and for 30 days after account deletion to allow recovery.
  • Evidence files and metadata: Retained for as long as your account remains active and for 90 days after account termination, unless longer retention is required by law or requested by you.
  • Audit and chain-of-custody logs: Retained for a minimum of 7 years to support legal and regulatory requirements.
  • Usage analytics: Aggregated and anonymized data may be retained indefinitely. Identifiable usage data is retained for up to 2 years.
  • Support correspondence: Retained for 3 years after the last interaction.

You may request deletion of your account and associated data at any time by contacting us at privacy@provio.com.au. Certain data may be retained where required by law or legitimate business interest (e.g., audit logs).

5. Third-Party Services

We use third-party services including Supabase for database and storage, and certified Timestamp Authorities (DigiCert, FreeTSA) for RFC 3161 timestamping. These services have their own privacy policies governing the use of your data.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to operate and improve the Service. The types of cookies we use include:

  • Strictly necessary cookies: Required for the Service to function (e.g., authentication session tokens). These cannot be disabled.
  • Functional cookies: Remember your preferences and settings to enhance your experience.
  • Analytics cookies: Help us understand how the Service is used so we can improve it. We use privacy-respecting analytics and do not share this data with advertisers.

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service. We do not use cookies for advertising or cross-site tracking.

7. International Data Transfers

Provio is operated by Provio Technologies Pty Ltd, an Australian company. Your data may be stored and processed in Australia and other jurisdictions where our service providers operate, including the United States and the European Economic Area.

Where we transfer personal data outside of your jurisdiction, we ensure appropriate safeguards are in place, including:

  • Standard Contractual Clauses (SCCs) approved by the European Commission for transfers from the EEA
  • Data processing agreements with all sub-processors
  • Compliance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth)

8. Your Rights Under the GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation:

  • Right of access: Request a copy of the personal data we hold about you.
  • Right to rectification: Request correction of inaccurate or incomplete personal data.
  • Right to erasure: Request deletion of your personal data where there is no compelling reason for continued processing.
  • Right to data portability: Receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to restrict processing: Request that we limit the processing of your personal data in certain circumstances.
  • Right to object: Object to processing based on legitimate interests or for direct marketing purposes.
  • Right to withdraw consent: Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact our Data Protection Officer at dpo@provio.com.au. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

9. Your Rights Under the CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights:

  • Right to know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources of collection, the purposes, and the third parties with whom we share it.
  • Right to delete: Request deletion of personal information we have collected from you, subject to certain exceptions.
  • Right to opt-out of sale or sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising.
  • Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights.
  • Right to correct: Request correction of inaccurate personal information.
  • Right to limit use of sensitive personal information: Direct us to limit the use and disclosure of your sensitive personal information.

To exercise your CCPA rights, contact us at privacy@provio.com.au or write to us at the address below. We will verify your identity before processing your request. You may also designate an authorized agent to make a request on your behalf.

10. Data Protection Officer

We have appointed a Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions or wish to exercise your data protection rights, please contact our DPO:

Data Protection Officer
Provio Technologies Pty Ltd
Email: dpo@provio.com.au

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a prominent notice on the Service at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@provio.com.au.

Provio Technologies Pty Ltd
ABN: [To be provided]
Australia