Privacy Policy

1. About This Policy

This Privacy Policy applies to all personal information collected by Continual through our website, web portal, and mobile application (collectively, the "Platform"). We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained therein.

This policy applies to information about identified or reasonably identifiable individuals. Business records, maintenance notes, photographs, and AI conversations can contain personal information, including information about employees and contractors.

2. Who We Are

Continual is an Australian company that provides autonomous maintenance software to manufacturing businesses. In this policy, "we", "us", and "our" refer to Continual.

For maintenance records and other content an organisation submits to the Platform, that organisation generally determines why the information is collected and how it is used. We process that information on its behalf to provide the Services. Where the GDPR applies, these roles are generally described as the organisation being the data controller and Continual being its data processor.

We also determine how personal information is used for our own account administration, billing, support, service security, and product analytics. For these activities, we act as a controller where the GDPR applies. Your organisation's own privacy notices explain its use of information about you, including employment-related decisions.

If you have any questions about this policy or how we handle your personal information, please contact us using the details at the end of this document.

3. Personal Information We Collect

We may collect the following categories of personal information:

• Account information: Your name, email address, job title, and company name when you register or create an account.
• Check and maintenance data: Inspection results, pass/fail values, notes, and photos submitted through the Platform during checks. This data includes identifying information such as who performed a check and when.
• Documents and AI interactions: Uploaded machine manuals and other documents, questions and conversations with the AI Assistant, attached images, and generated responses, summaries, and reports. These may include personal information contained in the content you or your organisation provide.
• Usage and activity data: Information about how you use the Platform, including features accessed, timestamps, and actions taken. This helps us understand how the product is being used and identify areas for improvement.
• Technical and device data: IP address, browser type and version, operating system, device identifiers, and session data collected automatically when you access the Platform.
• Diagnostic information: Error reports, performance traces, logs, and recordings of interactions with the web portal and mobile app used to investigate problems. These recordings, known as session replays, may include visible screen text, images, and information displayed during your session. Diagnostic information may also include user identifiers, IP addresses, and request details.
• Communications: Any information you provide when you contact us for support, send us feedback, or otherwise communicate with us.
• Billing contact information: Name and contact details for billing purposes. Payment card details are processed directly by our payment provider and are not stored by us.

4. How We Collect Personal Information

We collect personal information in the following ways:

• Directly from you: When you sign up, log in, submit checks, upload photos or documents, use AI features, or contact us.
• From your employer: If your organisation has a Continual account and has added you as an Authorised User, your account may be created with information provided by your employer.
• From connected services: When your organisation enables an integration with a maintenance system, we may receive relevant maintenance records and associated user information from that system.
• Automatically: Through cookies, analytics tools, and server logs when you interact with our website or Platform.

5. Why We Collect and How We Use Your Information

We collect and use personal information for the following purposes:

• To create and manage your account and provide access to the Platform.
• To process, store, and display check results and maintenance data submitted through the Platform.
• To generate compliance reports, dashboards, and operational insights for your organisation.
• To provide AI-assisted answers, document search, maintenance summaries, and reports using relevant Platform content.
• To send transactional emails, including account notifications, alerts, and system updates.
• To respond to support requests and enquiries.
• To understand how the Platform is used and to improve its features and performance.
• To ensure the security and integrity of the Platform.
• To comply with our legal and regulatory obligations.

We will only use your personal information for the purposes for which it was collected, or for a directly related purpose. We will not use your information for direct marketing without your consent, and you may opt out at any time.

AI features

When AI features are used, relevant questions, conversation history, maintenance records, document excerpts, and images may be sent to external AI providers to generate a response. Document search also sends document text and search queries to an embedding provider, which converts text into numerical representations used to find relevant content.

We do not use customer data to train our own models. We use external services to generate responses, create search embeddings, and monitor and evaluate AI behaviour. AI monitoring records may include prompts, responses, and information returned by tools. The providers are listed in Section 7. Their retention and data-use terms apply to their processing; use of an AI feature does not mean that its content is immediately deleted by every provider.

Please only submit information needed for the task, and avoid including sensitive personal information in prompts, photographs, or documents. AI outputs support your organisation's work and should be reviewed by authorised users before they are relied on for decisions affecting people.

6. Disclosure of Personal Information

We may disclose your personal information to:

• Third-party service providers that support hosting, storage, authentication, email and push notifications, analytics, diagnostics, and AI features. We use these services to deliver and operate the Platform (see Section 7 for providers and overseas processing).
• Your employer or organisation that administers the Continual account to which you belong. Managers and administrators within your organisation may be able to view check completion records, activity data, and other information you submit through the Platform.
• Law enforcement or regulatory authorities where required by law, court order, or to protect the rights or safety of Continual, our users, or the public.
• Successors in the event of a business sale or restructure, in which case we will notify affected individuals before personal information is transferred.

We do not sell personal information to third parties.

7. Subprocessors and Overseas Processing

Our primary operational database and customer file storage are hosted in Sydney, Australia. The primary API hosting region is also Sydney. This does not mean that all information remains in Australia: supporting services, provider administration, support, and subprocessors may involve overseas processing.

Some of our third-party service providers are located or store data outside Australia. In accordance with APP 8, we take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.

Locations indicate the primary hosting region we use or the provider's broader service-processing footprint. Global means processing can take place in multiple countries. Support teams and subprocessors may process information in other locations, so a listed country is not an exclusive data-residency guarantee. You can contact us for further information about the providers relevant to your organisation's use of the Platform.

8. Security

We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it from unauthorised access, disclosure, alteration, or destruction. These measures include:

• HTTPS/TLS encryption for customer connections and encryption at rest for our primary database and file storage.
• Server-enforced role permissions and controls that separate customer operational data.
• Private file storage with public access blocked and time-limited access links.
• Additional encryption for connected maintenance-system credentials using a managed key-management service.
• Application monitoring and controls to redact configured secrets from error telemetry. These controls do not make all diagnostic information anonymous.

We are working towards GDPR compliance and an information security management system aligned with ISO/IEC 27001. This work is ongoing, and Continual is not currently ISO/IEC 27001 certified. These objectives do not change our obligations under applicable law or your privacy rights.

While we take these precautions, no system is completely secure. If you suspect a security incident affecting your account, please contact us immediately at support@continualapp.com.

9. Retention and Deletion

We retain personal information for as long as your account is active and for a reasonable period afterwards to meet our legal, compliance, and business obligations. In practice:

• Account and usage data is retained for the duration of your organisation's subscription, plus up to two years after termination.
• Check records and maintenance data (including photos) are retained for the duration of your subscription and made available for export for 30 days after termination, after which they may be deleted.
• Support communications are retained for up to three years.

Stored AI conversations, uploaded documents, and generated reports form part of the information we hold to provide the Services. Diagnostic logs, session replays, AI monitoring records, and copies held by service providers can have different retention periods from the underlying maintenance record. Backup and version-history copies may remain after information is removed from the active service, until their retention periods expire. Contact us to discuss retention or deletion requirements for your organisation, including these copies.

You may request deletion of your personal information at any time (see Section 10). We assess requests under applicable law and, for information processed on behalf of your organisation, coordinate with that organisation. Where information must be retained, we will explain the reason and any applicable limits on deletion.

10. Your Rights and Complaints

Under the Privacy Act 1988, you have the right to request access to the personal information we hold about you, and to request correction of any information that is inaccurate, incomplete, or out of date.

To make a privacy request, please contact us using the details in Section 13. We will respond within the period required by applicable law and aim to respond within 30 days. We may need to verify your identity before processing the request. For records managed by your employer or organisation, you can contact its administrator directly; we can help direct your request to the organisation responsible.

Where the GDPR or similar laws apply, you may also have rights to request erasure, restrict or object to processing, obtain a portable copy of certain information, and withdraw consent where processing relies on consent. These rights depend on the circumstances and are subject to applicable exceptions. Withdrawing consent does not affect the lawfulness of earlier processing. You may also complain to the data protection authority in your country where applicable.

If you believe we have mishandled your personal information or breached the APPs, we encourage you to contact us first so we can try to resolve the matter. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our website and Platform for the following purposes:

• Authentication: To keep you logged in and maintain your session securely.
• Preferences: To remember settings such as your preferred theme.
• Analytics: To understand how users interact with the Platform and website. This data helps us improve features and user experience.
• Diagnostics: We collect errors, performance information, and selected session recordings from both the web portal and mobile app to help us reproduce and resolve problems.

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of the Platform. Browser cookie controls do not necessarily stop server-side logging, mobile analytics, or all diagnostic collection.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal obligations. Material changes will be communicated to registered users via email or an in-platform notification before they take effect. The most recent version is always available on our website.

This policy explains our practices; it does not replace consent where consent is required for a particular use of your information. Where a change requires your consent under applicable law, we will seek it separately.

13. Contact Us

If you have any questions about this Privacy Policy, want to access or correct your personal information, or wish to make a privacy complaint, please contact us:

If you are not satisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.