Privacy Policy

Subjourney Pty Ltd (ACN 696 822 983) · Last updated: 27 October 2026

Introduction

Subjourney Pty Ltd (Subjourney, we, us or our) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose and protect personal information when you install and use the Subjourney application (the Application) and the related services (the Services), and when you visit our website.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy should be read together with our Terms and Conditions of Use.

By using the Application or the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Application or the Services.

1. The personal information we collect

1.1 Information you provide to us.

Account information — such as your name and email address when you register for an account.
Payment information — when you take out a paid subscription. Payment card details are collected and processed by our third-party payment processor, not stored by us (see clause 4).
Communications — if you contact us for support or otherwise, we collect your contact details and the contents of your messages.
Feedback — if you send us feedback, suggestions or ideas, we collect and may retain that information.

1.2 Information we collect automatically. When you use the Application or the Services, we may automatically collect:

Device and log information — such as device and operating system type, application version, IP address, and error and diagnostic logs.
Usage information — such as the dates and times you access the Services, the features you use, and your AI credit balance and usage (including the number and size of AI requests).
AI feature logs — when you use an AI-powered feature, we log information about that request, which may include the prompt you submitted together with the project context sent with it (see clause 3). This information can contain content you have chosen to include, including personal information. We use these logs to operate and meter AI credits, to produce reporting, and to improve the Services. Some of this information is processed by our analytics provider (see clause 4).
Cookies and similar technologies — our website uses cookies that are strictly necessary for it to work and, if you agree, analytics cookies. See clause 11.

1.3 Your local content. The projects, documents and files you create or import in the Application are stored locally on your own device. We do not collect, store or retain copies of that content on our systems, with one exception: when you use an AI-powered feature, the content you submit to that feature is transmitted to third-party AI providers to be processed, and the associated prompt is logged as described in clause 1.2. Aside from that, your local content remains under your control on your device.

1.4 Sensitive information. We do not seek to collect sensitive information (such as information about your health, racial or ethnic origin, political or religious beliefs, or criminal record) about you. Please do not submit sensitive information about yourself or others through the Services unless it is necessary, and remember that anything you include in content submitted to AI features is sent to our AI providers. If we do collect sensitive information, we will use it only for the purpose for which it was provided, a directly related secondary purpose, or with your consent or as required or authorised by law.

1.5 Children. The Application is not intended for, or directed at, anyone who is not of legal age to enter into a binding contract with us. If we become aware that we have collected personal information from a person who lacks that capacity without appropriate consent, we will take reasonable steps to delete it.

1.6 Collecting from you and from third parties. Where reasonable and practicable, we collect personal information directly from you. If we collect personal information about you from a third party, we will take reasonable steps to make you aware of that collection, unless doing so is unreasonable or impracticable.

2. How we use personal information

We use personal information to:

provide, operate, maintain and secure the Application and the Services;
create, manage and administer your account, and process payments for subscriptions;
meter and enforce AI credit usage and limits;
produce internal reporting and analytics, and improve and develop the Application and the Services;
respond to your enquiries and provide support;
send you service-related communications, and (where permitted) marketing communications (see clause 6);
detect, prevent and investigate fraud, abuse, security incidents and breaches of our Terms; and
comply with our legal obligations and enforce our legal rights.

We do not sell your personal information. Where we use information to improve the Services, we use de-identified or aggregated information wherever practicable.

3. Content processed by third-party AI providers

Certain features of the Application use third-party artificial intelligence providers (currently including OpenAI and Anthropic) to process the content you submit to those features. When you use an AI feature:

the content sent from your device to the relevant AI provider to generate a result may include not only any text you enter, but also relevant context from your project — such as the files you have added, the project's current state, and its contents (for example, the graph, personas, issues and other elements you have created) — to the extent needed to carry out your request;
that content may include any personal information contained in your project or the files you have added;
the AI provider processes, and may temporarily store, that content under its own terms and privacy policy, and may do so outside Australia; and
we do not send your account or billing details to these AI providers.

You are responsible for ensuring you have the right to submit the content you send to AI features. A current list of the AI and other providers we use is available on request (see clause 13).

4. How we disclose personal information

We may disclose personal information to:

AI providers — as described in clause 3.
Analytics providers — such as PostHog, which processes usage information and AI feature logs (which may include prompts) to help us understand and improve the Services.
Payment processors — our third-party payment processor handles subscription payments and processes your payment details under its own terms and privacy policy.
Hosting and IT providers — who provide the infrastructure and tools we use to run the Services.
Professional advisers — such as our lawyers and accountants, where reasonably required.
Authorities and other parties — where we reasonably believe disclosure is necessary to comply with the law, respond to a lawful request, enforce our Terms, or protect the rights, safety or property of any person.
In a business transfer — if we are involved in a merger, acquisition, restructure or sale of assets, personal information may be disclosed to the parties and advisers involved and transferred as part of that transaction.
With your consent — in any other case where you have agreed to the disclosure.

5. Overseas disclosure

Some of the providers described in clause 4 are located, or store and process information, outside Australia. This means your personal information may be disclosed to and processed in countries other than Australia, including the United States and countries in the European Union. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

6. Direct marketing

From time to time we may send you marketing communications about the Services where we are permitted to do so and where you would reasonably expect to receive them. You can opt out of marketing communications at any time by using the unsubscribe link in the communication or by contacting us using the details in clause 13, and we will action your request within a reasonable time. We do not use sensitive information for direct marketing.

7. Storage and security

We take reasonable technical and organisational measures to protect the personal information within our control from loss, misuse, and unauthorised access, disclosure, alteration or destruction. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Because your projects and files are stored locally on your device, you are responsible for the security of your device and for keeping your own backups of that content.

If a data breach involving your personal information occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), including notifying you and the Office of the Australian Information Commissioner where required.

8. How long we keep personal information

We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, including to operate the Services, meet our legal obligations, resolve disputes, and enforce our agreements. We retain certain records, such as billing and transaction records, for up to 7 years to meet our tax and legal record-keeping obligations. When personal information is no longer needed, we take reasonable steps to delete or de-identify it. Because your local content is stored on your device, it remains there under your control until you delete it, even after you stop using the Services.

9. Your rights and choices

Under the Australian Privacy Principles, you may:

Access the personal information we hold about you (APP 12);
Correct personal information that is inaccurate, out of date or incomplete (APP 13); and
Complain if you believe we have mishandled your personal information (see clause 13).

To make a request, contact us using the details in clause 13. We may need to verify your identity before responding, and we will respond within a reasonable time and in accordance with the Privacy Act.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. We do not sell your personal information, and we do not use it for third-party targeted advertising.

10. If you are in the EEA or the UK

If you are located in the European Economic Area or the United Kingdom, additional rights may apply to you under the General Data Protection Regulation (GDPR) or equivalent laws, including rights to erasure, restriction, objection, and data portability. Where those laws apply to our handling of your personal information, we will handle it accordingly, and you may have additional rights and remedies. You may contact us using the details in clause 13 to exercise any such rights.

11. Cookies and consent

11.1 What cookies are. Cookies are small files that a website stores in your browser. Our website also uses similar technologies, such as your browser's local storage. In this clause we refer to all of these as cookies.

11.2 The cookies we use. We group the cookies on our website into two categories:

Strictly necessary — cookies the website needs to work and to keep you signed in, including those set by our authentication provider (Clerk), and the cookie that records your cookie choices. These are always on, because the website cannot work properly without them.
Analytics — cookies set by our analytics provider, PostHog, to help us understand which pages and features people use, so we can improve the website and the Services. PostHog processes this information in the European Union. These cookies are off by default and are only set if you agree to them.

11.3 Your consent. When you first visit our website, we ask whether you agree to analytics cookies. You can accept all cookies, reject all cookies other than strictly necessary ones, or choose by category. Analytics cookies are not set, and analytics information is not collected through our website, unless and until you agree. We remember your choice for up to six months, in a strictly necessary cookie, and then ask you again.

11.4 Changing your mind. You can change or withdraw your consent at any time through Cookie settings, at the foot of every page of our website. If you withdraw your consent to analytics cookies, we stop collecting analytics information through the website, and remove the analytics cookies we placed in your browser. Withdrawing your consent does not affect any collection that took place before you withdrew it.

11.5 Your browser's controls. You can also block or delete cookies through your browser's settings. If you block strictly necessary cookies, some parts of the website, such as signing in, may not work.

11.6 The Application. This clause applies to our website. The Application collects usage information as described in clause 1.2.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will publish the updated version and revise the "last updated" date at the top of this page. Where a change is material, we will take reasonable steps to notify you. Your continued use of the Application or the Services after a change takes effect constitutes your acceptance of the updated Privacy Policy.

13. How to contact us

If you have any questions about this Privacy Policy, wish to access or correct your personal information, or want to make a complaint, please contact us team@subjourney.com.