Platform Privacy

Last Updated 21 August 2026

1. Purpose and scope of this notice

1.1 What this notice covers

This notice describes how personal information is handled in connection with the Rhombus AI platform — the hosted ETL and DataOps service through which customers connect data sources, build and run pipelines, and deliver processed data to destination systems.

It covers:

personal information we collect from registered platform users in order to provide and administer their accounts; and
personal information contained within customer datasets and pipelines, which we process on our customers’ behalf.

1.2 What this notice does not cover

This notice does not cover personal information collected from visitors to our public website (www.rhombusai.com), including cookies, analytics identifiers and contact form submissions. That processing is described in the Sovereign Orbis Pty Ltd Privacy Policy at https://rhombusai.com/privacy-policy.

Nor does it cover our handling of personnel and job applicant information.

1.3 Relationship to the customer agreement

Where a customer has entered into a Services Agreement and Data Processing Agreement (DPA) with us, those documents govern our processing of that customer’s data. If this notice conflicts with an executed DPA, the DPA prevails. This notice is provided for transparency and does not vary any contractual term.

2. Who we are

The Rhombus AI platform is operated by:

Sovereign Orbis Pty Ltd (ACN 674 180 299), which owns the intellectual property in the platform; and
Rhombnode Pty Ltd (ACN 686 223 227), its wholly owned subsidiary, which holds customer contracts and delivers the service.

In this notice, “Rhombus AI”, “we”, “us” and “our” refer to both entities collectively. Rhombnode Pty Ltd is the contracting entity for customer agreements unless the relevant agreement states otherwise.

Postal address: Michael Crouch Innovation Centre (G22), Hilmer Building (E10), Gate 2, UNSW, High Street, Kensington NSW 2033, Australia

Privacy contact: rhombusinsights@rhombusai.com

Security contact: rhombusinsights@rhombusai.com

3. Our two roles

Our obligations depend on which category of personal information is involved.

Category	Our role	What this means
Account data	Controller	We determine why and how it is processed.
Customer data (personal information inside customer datasets and pipelines)	Processor	We process it only on the documented instructions of the customer, who is the controller.

3.1 Account data (we act as controller)

Account data means personal information we collect from registered platform users in order to provide and administer their accounts:

name;
work email address;
hashed authentication credentials;
organisation and role membership;
billing contact details;
support communications; and
platform usage and audit records associated with a user account (for example sign-in events, pipeline actions and administrative changes).

3.2 Customer data (we act as processor)

Customer data means the data a customer connects to, ingests into, transforms within, or delivers through the platform. It may contain personal information about individuals who are not our users — for example a customer’s own customers, patients, employees or contacts.

We do not control what personal information a customer places into the platform. The customer decides what data to connect, for what purpose, and on what lawful basis. We process it only to provide the service as instructed.

3.3 Connection credentials and secrets

To connect to customer source and destination systems, the platform stores credentials and access tokens supplied by the customer (for example API keys, database credentials and OAuth tokens). These are held as secrets, encrypted, and used solely to execute the pipelines the customer has configured. They are treated as customer confidential information and, where they identify an individual, as customer data under this notice.

4. How we use account data

We use account data to:

create, authenticate and administer user accounts;
provide, maintain and support the platform;
communicate about service availability, security, changes and support requests;
administer billing and manage the customer relationship;
maintain security and audit records, investigate misuse, and meet legal obligations; and
analyse aggregated platform usage to improve reliability and performance.

Our lawful bases, where the GDPR applies, are performance of a contract, our legitimate interests in operating and securing the service, and compliance with legal obligations. Where we rely on consent — for example for optional marketing communications — that consent may be withdrawn at any time.

We do not sell personal information, and we do not use account data for advertising.

5. How we process customer data

5.1 Processing on instruction

We process customer data only:

to provide, maintain and support the platform in accordance with the customer agreement;
on the customer’s documented instructions, including instructions given through configuration of the platform; and
as required by law, in which case we will inform the customer unless legally prohibited.

5.2 Restrictions

We do not:

use customer data for our own purposes, including product research, benchmarking or marketing, except as permitted in clause 5.3;
use customer data to train or fine-tune machine learning models. Our AI service provider states that inputs to and outputs from the inference service are not used by it, or by the developers of the underlying models, to train those models;
disclose customer data except as described in section 7; or
grant personnel access to customer data other than on a least-privilege, need-to-know basis for support, security or operational purposes, subject to access controls, logging and confidentiality obligations.

5.3 Service operation data

We generate and use operational metadata about pipeline execution — run times, volumes, error rates, resource usage and similar telemetry — to operate, secure, troubleshoot and improve the service. Where this metadata is derived from customer data, it is handled as customer data.

Errors are redacted before they are recorded. Error output passes through a centralised redaction step before it reaches application logs, job results or the platform interface. Record-level values from customer data are removed at that point, so operational logs and error reports hold diagnostic information rather than customer content.

5.4 Sensitive information

Customers may process sensitive information, including health information, through the platform where their agreement permits it. Where they do, we handle it as a processor on their instruction, subject to the controls described in section 8 and any additional requirements in the DPA.

We do not collect sensitive information from platform users in our capacity as controller, and users should not submit sensitive information through support channels.

6. Artificial intelligence processing

The platform uses Anthropic Claude foundation models, accessed through Amazon Bedrock, to provide natural-language workflow generation, data analysis, document processing and generation of data-transformation code.

Hosting. The models are not hosted by us. Inference is delivered as an AWS-managed service through Amazon Bedrock.

Where inference happens. Production inference runs in the AWS ap-southeast-2 (Sydney) Region. We do not use global or cross-Region inference profiles for production customer workloads. Model inference therefore occurs in Australia.

What is sent. Depending on the function requested, the information transmitted to Amazon Bedrock may include:

user prompts and relevant conversation history;
customer-provided instructions;
workflow and pipeline configuration;
table names, column names, data types, schema metadata and summary statistics;
limited sample values from customer data, where the requested analysis or transformation requires them;
text or images extracted from documents, where document-processing functionality is used;
generated transformation code; and
validation results, execution errors and output previews used to correct generated code.

We limit each request to the context required to perform the requested function. The complete source dataset is not transmitted. Customer content may nevertheless be included where the requested function requires data samples, extracted document content or output previews — so customers should assume that personal information within the data they process may form part of a model input.

Who can see it. This information leaves our AWS account boundary when submitted to Amazon Bedrock, but does not leave AWS infrastructure and is not sent directly to Anthropic or any other model provider. AWS states that model providers do not have access to Bedrock customer prompts, completions, logs or model deployment accounts. We do not use any model or retention mode requiring provider data sharing.

Retention. AWS states that Amazon Bedrock does not retain model inputs or outputs by default for the configuration we use. Where we enable AWS model invocation logging, the resulting records are stored in our own AWS logging and storage services under our access and retention controls. Conversations, generated code and workflow records may separately be retained by the platform under section 10.

Generated code. Generated code is executed within our controlled AWS infrastructure, not in a model provider’s environment, and only within authorised customer pipeline runs and enabled schedules. Generated Python is subject to automated safety review, sandboxed execution restricted to project-scoped inputs, and output validation before its results are accepted by the pipeline. Code failing a required check is rejected or returned for controlled correction. Generated code and its validation status are available to authorised users for review.

Human decision-making. The platform does not make automated decisions producing legal or similarly significant effects about individuals. Pipeline logic generated by AI is applied to data at the customer’s direction.

7. Disclosure and subprocessors

7.1 Subprocessors

We engage third parties to help deliver the platform. Each is bound by written terms imposing confidentiality and data protection obligations no less protective than those we owe our customers, and is assessed under our vendor management process before engagement.

Subprocessor	Purpose	Processing location
Amazon Web Services	Cloud infrastructure and data storage	ap-southeast-2 (Sydney), Australia
Amazon Web Services (Amazon Bedrock)	Managed model inference for AI-assisted pipeline generation, analysis and document processing	ap-southeast-2 (Sydney), Australia
Auth0 (Okta)	Customer authentication and identity services for platform users	United States
Fivetran	Data movement supporting pipeline processing	Australia

Anthropic develops the Claude foundation models made available to us through Amazon Bedrock. It is not a subprocessor for this processing activity, because AWS states that model providers cannot access Bedrock customer prompts, completions, service logs or model deployment accounts. We disclose it here for transparency.

The current list is maintained in our Trust Center at https://app.aus.vanta.com/rhombusai.com/trust/3j2zjdc3647t5kjqybjxq. We will give customers 30 days’ notice before adding or replacing a subprocessor that processes customer data, and customers may object in accordance with the DPA.

7.2 Other disclosures

We may also disclose personal information:

to professional advisers, auditors and insurers, under confidentiality obligations;
where required by law, court order or a lawful request from a regulator or law enforcement agency, and where legally permitted we will notify the affected customer first; and
in connection with a merger, acquisition or sale of assets, subject to the recipient being bound by obligations no less protective than those in this notice. Customers will be notified of any such change affecting customer data.

8. Security

We maintain an information security program aligned to the AICPA Trust Services Criteria and independently examined by a third-party auditor. Controls include:

Encryption in transit. Connections and data flows to the platform and supporting infrastructure are encrypted in transit using TLS 1.3.
Encryption at rest. Customer data and account data are encrypted at rest.
Tenant isolation. Customer data, configurations, credentials, processing activities and system resources are logically segregated to prevent unauthorised access, modification or disclosure between tenants in the multi-tenant environment.
Secrets management. Encryption keys and customer-supplied credentials are held in a managed secrets store, with custody and rotation governed by our Cryptography Policy.
Access control. Role-based access, multi-factor authentication and periodic access reviews.
Logging and monitoring. Security and audit events are logged, retained in accordance with our Operations Security Policy, and protected against unauthorised modification.
Personnel. Background screening, confidentiality agreements and annual security and privacy training.
Resilience. Backups, infrastructure redundancy, and documented business continuity and disaster recovery plans, tested periodically.

No system can be guaranteed absolutely secure. We do not disclaim responsibility for the security of data in our custody; where an incident occurs, we respond as described in section 9.

9. Data breach response

We maintain a documented Incident Response Plan covering identification, containment, assessment and reporting of data breaches.

Where we are the controller (account data), we assess eligible data breaches under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) and, where notification is required, notify affected individuals and the Office of the Australian Information Commissioner. Where the GDPR applies, we notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach where required, and affected individuals where the breach is likely to result in a high risk to their rights and freedoms.

Where we are the processor (customer data), we notify the affected customer without undue delay and in any event within 48 hours of becoming aware of a breach affecting their data, and provide the information and assistance the customer reasonably needs to meet its own notification obligations. The customer, as controller, determines whether and how to notify data subjects and regulators.

Our subprocessor agreements require the subprocessor to notify us of actual or suspected unauthorised access to or disclosure of data in its custody.

Suspected security issues may be reported to rhombusinsights@rhombusai.com.

10. Retention and deletion

Account data is retained for the duration of the account and for 90 days after closure, after which it is deleted or de-identified, except where a longer period is required by law or for the establishment or defence of legal claims.

Customer data is retained for as long as the customer’s agreement is in effect, in accordance with the retention settings the customer configures.

On termination, we will, at the customer’s election, return or securely delete customer data — including data held in backups, in accordance with the backup cycle — within 30 days of the end of the agreement, unless retention is required by law. Copies held in backups are purged in the normal backup rotation and in any event within 90 days. Deletion is performed in accordance with our Data Management Policy, and certification of deletion is available on request.

Connection credentials and secrets are revoked and destroyed on termination or on the customer removing the relevant connection.

11. International transfers

The platform’s production infrastructure is hosted in the AWS ap-southeast-2 (Sydney) Region. Model inference is performed in the same Region. Customer data processed through the platform, including data submitted for AI-assisted functions, is stored and processed in Australia.

Account data is an exception. Authentication and identity services are provided by Auth0, whose tenant is located in the United States. Account data — including name, work email address and hashed authentication credentials — is therefore stored and processed in the United States. This does not apply to customer data processed through pipelines, which remains in Australia.

Our personnel access production systems for support and operational purposes from Australia only.

Where personal information is transferred out of the European Economic Area or the United Kingdom, we rely on standard contractual clauses adopted by the European Commission (and the UK International Data Transfer Addendum where applicable), together with supplementary technical measures including encryption in transit and at rest. Copies of the relevant transfer mechanism are available to customers on request.

Where the Australian Privacy Principles apply, we take reasonable steps to ensure overseas recipients handle personal information in accordance with APP 8.

12. Individual rights and requests

12.1 Platform users (we are the controller)

Registered users may:

access and correct much of their profile information directly through the application’s account settings; and
make any other request — access, correction, deletion, restriction, objection, portability, or withdrawal of consent — by writing to rhombusinsights@rhombusai.com.

We acknowledge requests promptly and respond within 30 days, or within any shorter period required by applicable law. We may ask you to verify your identity before acting on a request.

12.2 If we decline a request

We may decline a request in whole or in part where an exception under the Privacy Act 1988 (Cth), the GDPR or other applicable law applies — for example where granting it would unreasonably affect another person’s privacy, prejudice an investigation, or breach a legal obligation.

Where we decline, we will tell you in writing:

that the request has been refused, and to what extent;
the reasons for the refusal, unless it would be unreasonable to give them;
how you may complain about the refusal; and
your right to escalate to the Office of the Australian Information Commissioner or, where the GDPR applies, to your local supervisory authority, and (under the GDPR) your right to a judicial remedy.

All requests and their outcomes, including refusals and the reasons given, are recorded in our privacy request register.

12.3 Individuals whose data is in a customer’s pipelines (we are the processor)

If your personal information was provided to the platform by one of our customers, that customer is the controller and you should direct your request to them. We are not permitted to access, disclose, correct or delete their data on your instruction.

If you contact us directly, we will log the request and forward it to the relevant customer without undue delay, and tell you that we have done so where we are able to identify the customer. We assist customers in responding to such requests as required by the DPA.

13. Complaints

Complaints about our handling of personal information may be sent to rhombusinsights@rhombusai.com. We will acknowledge your complaint within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response, you may complain to:

the Office of the Australian Information Commissioner — www.oaic.gov.au, 1300 363 992; or
where the GDPR applies, your local data protection supervisory authority.

14. Children

The platform is a business service and is not directed to children. We do not knowingly collect personal information from individuals under 16 in our capacity as controller. Where a customer processes children’s personal information through the platform, the customer is responsible for the lawful basis and any parental consent required.

15. Changes to this notice

We may update this notice from time to time. Where a change materially affects our processing of customer data, we will give affected customers at least 30 days’ notice before it takes effect, in accordance with the DPA. Other changes take effect when published, and the “last reviewed” date above will be updated.

This notice is reviewed at least annually.