Privacy Policy
Last Updated 21 August 2026
1. About this policy
1.1 Who we are
The Rhombus AI platform is operated by Sovereign Orbis Pty Ltd (ACN 674 180 299) and its wholly owned subsidiary Rhombnode Pty Ltd (ACN 686 223 227), together referred to in this policy as "Rhombus AI", "we", "us" and "our". Sovereign Orbis Pty Ltd owns the intellectual property in the platform; Rhombnode Pty Ltd holds customer contracts and delivers the service.
1.2 What this policy covers
This policy explains how we handle personal information about:
- visitors to our website at www.rhombusai.com; and
- registered users of the Rhombus AI platform, in relation to their accounts.
1.3 What this policy does not cover
This policy does not cover personal information contained within customer datasets and pipelines — the data our customers connect to and process through the platform. We handle that data as a service provider acting on our customers' instructions, and it is described in the Rhombus AI Platform Privacy Notice.
If your personal information was uploaded to the platform by a business that uses our service, that business — not Rhombus AI — decides how it is used. See section 11.3.
1.4 The law we follow
We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, where it applies to our processing, the EU General Data Protection Regulation and the UK GDPR.
1.5 What "personal information" means
Personal information is information about an identified individual, or an individual who is reasonably identifiable. It includes things like your name, email address and, in some circumstances, online identifiers such as an IP address.
2. Our two roles
Our obligations differ depending on whose data it is.
| Information | Our role |
|---|---|
| Account data and website data (this policy) | Controller — we decide why and how it is handled |
| Personal information inside customer datasets and pipelines | Processor — we act only on our customer's instructions |
3. What we collect
3.1 Account data
Account data is personal information we collect from registered platform users in order to provide and administer their accounts:
- name;
- work email address;
- hashed authentication credentials;
- organisation and role membership;
- billing contact details;
- support communications; and
- usage and audit records linked to a user account, such as sign-in events and administrative actions.
3.2 Website data
Website data is personal information collected from visitors to our public website:
- IP address;
- device and browser metadata;
- cookies and similar identifiers; and
- information you submit through contact, demo request or subscription forms — typically your name, work email address, company and any message you send us.
3.3 Sensitive information
We do not collect sensitive information — such as health information, or information about your racial or ethnic origin, political opinions, religious beliefs or sexual orientation — from website visitors or platform users, and you should not send it to us through our forms or support channels.
Our customers may process sensitive information through the platform. Where they do, we handle it strictly on their instructions as described in the Platform Privacy Notice.
3.4 Children
The platform and website are business services and are not directed to children. We do not knowingly collect personal information from anyone under 16.
4. How we collect it
We collect personal information:
- directly from you, when you create an account, contact us, request a demo, subscribe to updates or use the platform;
- automatically, when you visit our website, through cookies and analytics tools; and
- occasionally from third parties, such as business contact data providers, our resellers or partners, or publicly available professional sources. Where we do, we handle that information in accordance with this policy.
5. How we use it
We use account data and website data to:
- provide, maintain, secure and support the platform;
- create and administer accounts and authenticate users;
- respond to enquiries, support requests and complaints;
- manage billing and the customer relationship;
- send service communications about availability, security and changes to the service;
- send marketing communications about our products, where you have opted in or where we are otherwise permitted to do so — you can unsubscribe at any time;
- analyse how our website and platform are used, in aggregate, to improve them; and
- meet our legal, regulatory and audit obligations.
We do not use personal information contained in customer datasets or pipelines to develop or improve our products. Product improvement is based on account and website data and on aggregated operational metrics, as described in the Platform Privacy Notice.
We do not sell personal information.
5.1 Lawful bases (where the GDPR applies)
We rely on: performance of a contract with you; our legitimate interests in operating, securing and improving our service and in business-to-business marketing; compliance with legal obligations; and, where required, your consent. Where we rely on consent you may withdraw it at any time, without affecting processing carried out beforehand.
6. Cookies and analytics
Our website uses cookies that are necessary for the site to work and to remember your preferences. We do not use cookies for advertising, and we do not use them to track you across other websites.
You can block or delete cookies through your browser settings, though doing so may affect how parts of the site work.
7. Who we share it with
We disclose personal information to:
- service providers who help us run our business and our platform, under written agreements requiring them to protect it and use it only for the purposes we specify. Our service providers include Amazon Web Services (cloud infrastructure, and managed model inference through Amazon Bedrock, in Australia), Auth0 (authentication and identity, in the United States), Fivetran (data movement supporting pipeline processing), Microsoft (business email and document management through Entra ID and Office 365), Fireflies.ai (meeting transcription), Notion (internal collaboration), GitHub (source code management) and Vanta (compliance monitoring). A current list is maintained in our Trust Center at https://app.aus.vanta.com/rhombusai.com/trust/3j2zjdc3647t5kjqybjxq;
- professional advisers, including our lawyers, accountants, auditors and insurers, under confidentiality obligations;
- regulators, courts or law enforcement, where we are required to do so by law or in response to a valid legal request; and
- an acquirer, in connection with a merger, acquisition or sale of assets, where the recipient is bound to protect the information on terms no less protective than this policy. We will notify affected customers of any such transfer involving their data.
We do not disclose personal information to any other third party without your consent.
8. Where your information is held
Our production infrastructure is hosted in the AWS ap-southeast-2 (Sydney) Region, in Australia.
Personal information may be stored in, accessed from or transferred to Australia and the United States. In particular, account data — including your name, work email address and hashed authentication credentials — is held in the United States by our authentication provider, Auth0. Personal information contained in customer datasets processed through the platform remains in Australia.
Our personnel are located in Australia and access our systems from Australia only.
Where we transfer personal information out of the European Economic Area or the United Kingdom, we rely on standard contractual clauses approved by the European Commission, and the UK International Data Transfer Addendum where applicable, together with technical measures including encryption in transit and at rest. You may request a copy of the relevant safeguards by contacting us.
Where the Australian Privacy Principles apply, we take reasonable steps to ensure overseas recipients handle personal information consistently with APP 8.
9. How we protect it
We maintain an information security program covering our website, platform and internal systems. Our controls include encryption of data in transit and at rest, role-based access control with multi-factor authentication, periodic access reviews, security logging and monitoring, personnel confidentiality obligations and security training, vendor security assessment, and documented backup and disaster recovery arrangements.
Our security controls are independently examined by a third-party auditor. Rhombus AI is currently undergoing a SOC 2 Type 1 examination. Customers and prospective customers can request the current status of that examination, and the report once issued, through our Trust Center at https://app.aus.vanta.com/rhombusai.com/trust/3j2zjdc3647t5kjqybjxq or by contacting us.
No system can be made completely secure. If a security incident affects your personal information, we will respond as described in section 10.
10. Data breaches
We maintain a documented incident response plan. Where a data breach involving personal information we control is likely to result in serious harm, we assess it under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth) and, where required, notify affected individuals and the Office of the Australian Information Commissioner. Where the GDPR applies, we notify the relevant supervisory authority within 72 hours of becoming aware of a personal data breach where required, and affected individuals where the breach is likely to result in a high risk to their rights and freedoms.
Where a breach affects personal information we handle on a customer's behalf, we notify that customer without undue delay so they can meet their own obligations.
To report a suspected security issue, contact us at rhombusinsights@rhombusai.com.
11. Your rights
11.1 What you can ask for
You may ask us to:
- give you access to the personal information we hold about you;
- correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading;
- delete it;
- restrict or object to how we use it;
- provide it in a portable format, or transfer it to another provider; or
- stop sending you marketing communications.
Some of these rights apply only in particular circumstances or only where the GDPR applies.
11.2 How to make a request
Registered users can view and update much of their profile information directly in the platform's account settings.
For anything else, email us at rhombusinsights@rhombusai.com. We will acknowledge your request within 5 business days and respond within 30 calendar days. We may need to verify your identity before we act, and the 30-day period runs from the point we have enough information to do so.
There is no charge for making a request.
11.3 If your information is in a customer's data
If a business that uses our platform has uploaded your personal information, that business is responsible for it and you should contact them directly. We cannot access, correct or delete their data on your instruction.
If you contact us anyway, we will log your request and pass it to the relevant business without undue delay, and tell you that we have done so where we are able to identify them.
11.4 If we say no
We may decline a request, in whole or in part, where an exception under the Privacy Act 1988 (Cth), the GDPR or another applicable law applies.
If we do, we will tell you in writing:
- that we have declined, and how much of your request that affects;
- the reason, unless it would be unreasonable to give one;
- how to complain to us, including escalation to our CEO; and
- your right to complain to the Office of the Australian Information Commissioner or, where the GDPR applies, to your local supervisory authority, and your right to seek a judicial remedy.
We record every request and its outcome, including any refusal and the reason for it.
12. How long we keep it
We keep account data for as long as the account is active and for 90 days afterwards, then delete or de-identify it, unless we are required to keep it longer by law or need it to establish or defend a legal claim.
We keep website data for 14 months, and enquiry and marketing records for 24 months after your last interaction with us. Billing and financial records are kept for 7 years, as required by the Corporations Act 2001 (Cth).
Retention of personal information inside customer datasets is governed by the customer's agreement and is described in the Platform Privacy Notice.
13. Complaints
If you are unhappy with how we have handled your personal information, email rhombusinsights@rhombusai.com. We will acknowledge your complaint within 5 business days and respond within 30 days. Complaints may be escalated internally to our CEO.
If you are not satisfied with our response, you can complain to:
- the Office of the Australian Information Commissioner — www.oaic.gov.au, 1300 363 992; or
- where the GDPR applies, your local data protection supervisory authority.
14. Other websites
Our website links to sites we do not control. This policy does not apply to them, and we are not responsible for their privacy practices. Please read their privacy policies before providing them with personal information.
15. Changes to this policy
We may update this policy from time to time. If we make a change that materially affects how we handle your personal information, we will give at least 30 days' notice by posting the updated policy and, where we hold your contact details and the change is significant, by contacting you directly. Other changes take effect when published.
We review this policy at least annually.
16. Contact us
Privacy enquiries: rhombusinsights@rhombusai.com
Post: Sovereign Orbis Pty Ltd, Michael Crouch Innovation Centre (G22), Hilmer Building (E10), Gate 2, UNSW, High Street, Kensington NSW 2033, Australia
