Privacy Policy

CogniWeave is a product of Human Nexus Pty Ltd (ABN 62 680 664 126), a company incorporated in New South Wales, Australia. We operate the CogniWeave workspace at memweave.humannexus.dev. This policy explains how we collect, hold, use, and disclose your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

We collect the following categories of personal information:

• Account information: first name, last name, work email address, company name, company size.
• Workspace content: files, documents, emails, and other materials you upload to your workspace. This content belongs to you.
• Usage data: log events, retrieval queries, timestamps, and feature interactions used to operate and improve the service.
• Communications: messages you send to us through the contact form or by email.

We do not collect sensitive information as defined under the Privacy Act 1988 (Cth) unless you choose to upload documents that contain it. If your workspace contains health records, legal files, or other sensitive material, that material is held in your tenant-isolated workspace and is not accessed by us except as required to deliver the service or as required by law.

We collect and hold personal information to provide and operate the CogniWeave service, process your enquiries, communicate with you about your account, maintain the security and integrity of the service, and comply with our legal obligations. We do not use your personal information, workspace content, or retrieval queries to train any AI model. We do not sell personal information to third parties.

Personal information and workspace data are stored on infrastructure operated by Supabase Inc., with data residency options available on request. We apply AES-256 encryption at rest and TLS 1.2 or higher in transit. Access to personal information is restricted to personnel who require it to perform their role. We maintain an append-only audit log of all retrieval events within your workspace.

We may disclose personal information to: Supabase Inc. (infrastructure and database), Resend Inc. (transactional email), and professional advisers under confidentiality obligations. We do not otherwise disclose personal information to third parties without your consent unless required or authorised by Australian law. Where we disclose personal information to overseas recipients (including cloud infrastructure providers operating outside Australia), we take reasonable steps to ensure that those recipients handle the information consistently with the Australian Privacy Principles, in accordance with APP 8.

Under the Privacy Act 1988 (Cth), you have the right to: request access to the personal information we hold about you (APP 12); request correction of personal information that is inaccurate, out of date, or incomplete (APP 13); request deletion of your personal information and workspace data at any time by contacting us. We will respond to access and correction requests within 30 days.

We use session cookies strictly necessary for authentication. We do not use advertising cookies, cross-site tracking, or behavioural profiling.

We will update this policy when our practices change. We will notify registered users of material changes by email before they take effect.

Privacy enquiries: humans@humannexus.com.au. If you believe we have breached the Australian Privacy Principles, you may also lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.