Privacy Policy: Acenda

Your privacy matters to us, and in this industry, trust is everything. This Privacy Policy explains what personal information we collect when you use the Acenda mobile application and platform (the “App”) and the acenda.online website (the “Website”), why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have over it.

Acenda is operated by HSEC Industries Pty Ltd (“we”, “us”, “our”). The platform is owned by Lockhart Industries Pty Ltd, which licenses it to us and publishes the App on the App Store and Google Play; we decide how your personal information is handled and we are responsible for it. We are based in Western Australia and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

If you don’t agree with this Policy, don’t use the App.

1. The Promises Up Front

Before the detail, here are the commitments that shape everything else in this Policy:

We never keep copies of your identity documents. Identity checks are handled by Stripe, and we hold the outcome, not your ID.
Your platform data is stored in Australia (Sydney). A small number of named services process specific data overseas, and Section 10 lists every one of them.
We do not track your location. The App never reads your phone’s GPS. Your site and your optional home region are details you choose yourself.
Your site sees aggregate figures, and a figure with fewer than five people behind it is withheld. The exceptions, such as your own emergency response team seeing who is on call, are set out in Section 4.
Opening crisis support is counted, but never tied to you. No name, no account, nothing on your record.
An anonymous post is sealed. Nobody using the App or the staff console can see who wrote it.
There is no advertising in the App and no third party analytics or tracking. We do not sell your personal information. Full stop.

2. What We Collect

2.1 Your account

Your name and email address, and a password (stored only in a one way scrambled form we cannot read back)
Your confirmation that you are 18 or over, your acceptance of the Terms and this Policy, and the Acenda Oath, each recorded with the date you gave it
The consents and settings you choose, and the date you gave or withdrew each one

2.2 Your profile

Your display name, role, site, crew, state and time zone
A profile photo, if you add one
Your phone number and an emergency contact, if you add them
A home region chosen from a list of WA regions, only if you turn it on. It is used to send you notices meant for that region, and you can turn it off at any time

2.3 Qualifications, tickets and credentials

The qualifications, units of competency and tickets you add, with their issuer, dates and status
Photos of tickets and certificates you upload as evidence, and qualification documents (such as a statement of attainment) added to your record by you, or by us from a training provider’s records for a course you completed
Our review decision on each one, who made it and when
For a verified credential, a digitally signed copy that an employer can check without asking us

2.4 Identity check

An identity check is optional. When you choose to do one:

You photograph a government issued photo ID and take a selfie inside Stripe Identity, our verification provider
Stripe checks the documents and tells us the result
We record the outcome, the date, and Stripe’s reference for the check
We do not receive or keep copies of your identity documents or your selfie. They are processed by Stripe under Stripe’s own privacy policy

2.5 What you do in the App

Your answers to daily questions, drills and quizzes, your streak, your readiness scores, and the topics you study
Competition entries, scores and placings, event RSVPs, and items you save

2.6 Content you post and send

Wall posts, comments, photos, reactions and reports you make
Direct messages you send to other members
The members you block. A block is private: the other person is not told, and no staff screen shows it
Photos are stripped of their location and camera details on your phone before they are uploaded

2.7 AI answers, Ask the Library, the coach and voice

AI answers are off until you allow them. The first time you use Ask the Library, the debrief writer or the competition drafter, the App asks you once, and you can change your answer at any time in Settings, Privacy and data, AI answers. Your choice is kept on your phone. Until you allow it, nothing is sent to the AI provider and the coach on Home shows a fixed line instead
Questions you ask Ask the Library, and the answers given, are stored with your account. They are reused for 24 hours so the same question is not asked twice, and they help us improve the library
If you speak a question, your phone turns your voice into text, on the phone itself where it can, and otherwise through your phone’s own speech service from Apple or Google. Only the text reaches us. We never receive or keep the recording
Once you allow AI answers, the coach on your Home screen uses a summary of your own training record: discipline names, scores, your review queue and questions you recently missed. It does not use your name, email, contact details or site

2.8 Emergency response team features

If you are a member of a site’s emergency response team (ERT) in the App, we record when you are on call, your responses to callouts, and the callouts and site emergency broadcasts sent to you, including whether they were delivered to your phone.

2.9 Site membership history

We keep a dated record of which sites you have belonged to, and when you were on call for a site. It is kept so that a past day can be checked accurately, for example after an incident or an audit. It records membership and on call status only. It does not record where you physically were.

2.10 Wellbeing and duty of care

If a crew mate tells us they are worried about you, if a post is reported as a wellbeing concern, or if a post contains words that suggest someone may be struggling, a member of the Acenda support team may reach out to you privately. We keep a record of that case: why it was opened, when, any check in made, and any note recorded about it. These records are seen only by the Acenda staff who look after them, never by your site or employer, and are never used against you. Section 6 explains more.

2.11 Crisis support

When the crisis support screen is opened, we add one to a count for that day and site. The count holds no name, no account and no device. Section 5 explains more.

2.12 Your phone and technical information

A push notification address for your phone, the type of phone (iPhone or Android), when the App last checked in, and whether you have allowed critical alerts
Server logs that record requests to our systems, including IP addresses and times, used for security and fault finding
If you turn on the App lock, your fingerprint or face check happens on your phone. We never receive it
If you have agreed on your phone to share diagnostics with app developers, Apple or Google may pass us crash reports. These are controlled in your phone’s settings

2.13 The Website

If you join the waitlist we keep your email address, and your name, site or organisation and the role you picked if you give them. We are told by email when someone joins
The Check a credential page sends what you type straight to the matching credential or resume page. It stores nothing itself
Our website host keeps standard server logs, including IP addresses
The Website sets no cookies and carries no analytics, advertising or tracking code

2.14 What we don’t collect

We do not collect your GPS or device location, your date of birth, your contacts, or any advertising identifier. There is no usage analytics package in the App.

2.15 Sensitive and health related information

Some content on Acenda involves health, medical and incident related information, and the wellbeing records in Section 2.10 can be sensitive. We treat this with extra care and in line with the Privacy Act’s requirements for sensitive information.

Do not post identifiable patient, casualty, or incident information on Acenda. Ever.

If you post content describing a real incident, de-identify it properly. Remove names, dates, locations, and any detail that could identify a patient, casualty, colleague, or third party. If you’re not sure whether something is identifiable, don’t post it.

3. Why We Collect It and How We Use It

We use your personal information to:

Create and manage your account and your credential record
Deliver the App’s features: the Daily Standard, the library and Ask the Library, the wall, Groups, events, direct messages, competitions, live sessions, readiness, and ERT callouts
Check your identity, if you choose to, and review the qualifications and tickets you submit
Warn you before a ticket expires, and send the notifications you have switched on
Deliver callout alarms and site emergency broadcasts to the people they are meant for
Run competitions, award prizes, and confirm winner eligibility
Look after members who may be struggling (Section 6)
Keep the community safe: moderate content, investigate reports and breaches of our Terms
Improve the App and the library
Comply with our legal, regulatory, and reporting obligations

We do not use your information for advertising, and we do not use it to train artificial intelligence models.

4. Who Sees What Inside Acenda

4.1 Your site and your employer

Acenda is free for members. A site that uses Acenda gets aggregate, crew level figures: readiness, participation and training coverage across the team, and a monthly report for its own site. Where fewer than five people are behind a figure, the figure is withheld, so a small crew cannot be singled out. A site manager is told how many tickets are expiring at their site, never whose.

Your site never sees your quiz scores, your posts, your messages, your Ask the Library questions or anything about crisis support or wellbeing. If you leave a site, your account and your credential record stay with you.

4.2 The exceptions, by name

Your ERT. If you are on a site’s emergency response team, your on call status and your responses to callouts are shown by name to that team and to the people at the site who run callouts. That is what makes a callout work.
Your crew. Your streak is shown to your crew only if you turn on crew visibility in your consents.
Competitions. Your display name, score and placing appear on competition boards, which can be shown on a screen at an event.
Other members. Your profile, posts and comments are visible to members in the spaces where you post, except members who have blocked you. Direct messages are visible to the people in the conversation.
Your resume link. If you create one, anyone you give it to can see the verified credentials on it. You can switch it off at any time.

4.3 Acenda staff

Our staff see what they need for their role, and key staff actions are recorded in an audit log. That includes reviewing submitted qualifications and tickets, moderating reports, looking after wellbeing cases, and running the library (which includes reading Ask the Library questions to improve it). The site membership history in Section 2.9 is open only to the most senior Acenda administrators, and every time it is read, that is logged too.

5. Crisis Support

Acenda includes one tap access to crisis support services such as MATES in Mining, Lifeline, and 000.

Opening crisis support is never tied to you.

The only thing recorded is a count of how many times the screen was opened, by day and by site. It holds no name, no account and no device. It does not affect your streak, your readiness, or anything else. Acenda staff use the count to understand whether support is being reached, and nobody can use it to see that you opened it.

6. Wellbeing and Duty of Care

A post or comment from someone who may be struggling goes to a support person, not to a moderator’s punishment queue. A support person may send you a private message with crisis contacts, or record a check in made another way, such as a phone call. If a post is taken down for your sake, you are not told it broke the rules, because it didn’t.

The case record is kept so we can look after you properly and show that we did. It is never shown to your site or employer and never affects your streak, readiness or standing. Wellbeing case notes are not included in Download my data. You can ask us for them at any time (Section 13).

7. Anonymous Posts

When you post anonymously, for example a near miss, your name is not shown with the post, and the link between you and the post is sealed. No member, site, moderator or Acenda administrator can look it up through the App or the console. We would only unseal it if a court or tribunal orders us to. If a support person needs to reach the author of an anonymous post, the App delivers the message without revealing who they are.

8. Emergency Alerts and Notifications

Callout alarms and site emergency broadcasts are sent as push notifications, and can be sent as critical alerts that sound through silent mode if you allow it. Notifications travel through Apple’s and Google’s push services. Some notification text may appear on your lock screen. A private check in from a support person says only that there is a message. Acenda alerts are always alongside, never instead of, your site’s emergency procedures and 000.

We do not sell your personal information. Full stop.

We share personal information only:

Inside Acenda, as set out in Section 4
With the service providers in Section 10, each of which handles only what it needs to deliver its service
With event organisers and training partners, where you register for their course, event or prize through Acenda (limited to what they need to deliver it)
With regulators, law enforcement, or courts where we are legally required to, or where we reasonably believe disclosure is necessary to prevent serious harm
With a successor entity, in the event of a business sale, merger, or restructure, subject to this Policy

10. Where Your Information Is Stored and Processed

Acenda’s database, file storage and server functions run in Australia, in Sydney, on Supabase, our hosting provider. That is a deliberate choice.

Some services we use process specific information outside Australia, mainly in the United States:

Stripe (identity checks): your ID photos and selfie, if you choose to verify
Anthropic (United States, artificial intelligence answers), only once you allow AI answers: the question you type into Ask the Library, together with library passages; for the coach, a summary of your training record (discipline names, scores, review queue and recently missed questions); and text typed into the debrief writer and the competition drafter. Your name, email and contact details are not sent, unless it is for a competition where the event organiser needs your name for record keeping and fairness. In that case, the organiser may use an AI assistant from Anthropic to review the competition’s results and the study and training records that go with them, and your name is included in those records whether or not you have allowed AI answers. Your email and contact details are still not sent. Debrief notes have names, phone numbers and similar identifiers removed before they are sent, and are not stored. Staff tools that draft questions also send the text staff type
Resend (email delivery): your email address and the content of account emails, such as sign up confirmation, password reset and invitations, and waitlist sign up notices
Cloudflare (video): live training sessions and their recordings
Expo, Apple and Google (push notifications): Expo relays notifications to Apple’s and Google’s push services, and all three carry your phone’s push address and the notification text
Vercel (website hosting): serves the Website and the public credential and resume pages, and keeps standard server logs
Apple and Google: your phone’s speech service, if you speak a question and your phone cannot do it on the phone itself

Where a provider handles your information outside Australia, we take reasonable steps to ensure it is protected consistently with the Australian Privacy Principles.

11. How Long We Keep It

We keep personal information for as long as your account is open and as long as is reasonably necessary to operate the App, comply with our legal obligations, resolve disputes, and enforce our Terms. Some specifics:

A Download my data file is removed from our storage when its link expires, seven days after it is made
Ticket photos that no credential refers to any more, such as a withdrawn submission, are removed after a day
Your phone’s push address is retired when you sign out, and deleted, with any queued notifications, when your account is erased
Cached Ask the Library answers stop being reused after 24 hours
The site membership history and the audit log of staff actions are permanent records and are kept
Waitlist details are kept until you ask us to remove them, or until we no longer need them for launch news

When personal information is no longer needed, we delete it or de-identify it.

12. Deleting Your Account

You can delete your account in the App: Settings, Delete account. There is a 30 day cool off, during which nothing is erased and you can cancel. You can also ask by email at support@acenda.online. When the cool off ends, the erasure ends your sign in for good, replaces your sign in email, removes your name, phone number, emergency contact and site memberships, and revokes your verified credentials. Some records are kept, and you can ask us to delete those too. Our Delete your account page explains exactly what is erased, what is kept and why.

13. Your Rights

Under the Privacy Act and Australian Privacy Principles, you have the right to:

Access the personal information we hold about you. Settings, Download my data gives you a copy of your record and the photos you uploaded. For anything not in that file, such as wellbeing case notes, ask us
Ask us to correct information that is inaccurate, out of date, incomplete, irrelevant, or misleading. Most of your profile you can change yourself
Ask us to delete your personal information, subject to our legal and operational requirements (Section 12)
Withdraw a consent you have given us. Settings, Consent and permissions lists each one, and Settings, Privacy and data, AI answers turns AI answers off
Make a complaint if you think we have mishandled your information

To exercise any of these rights, contact us at support@acenda.online.

If you’re not satisfied with how we respond, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.

14. How We Protect It

We take reasonable steps to protect your personal information from misuse, loss, unauthorised access, modification, and disclosure, including:

Encryption in transit and at rest
Row level security, so each request can reach only the records its user is allowed to see
Staff access limited by role, with console actions logged
An optional fingerprint or face lock on the App
Staff and contractor confidentiality obligations

No system is 100% secure. If we ever become aware of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

15. Cookies and Storage on Your Phone

The App stores your sign in session and your preferences on your phone so you stay signed in. It uses no advertising identifiers and no third party tracking. The Website sets no cookies.

16. Third Party Links

The App and the Website contain links to third party websites and services, such as training resources, event pages, regulator websites and crisis lines. We don’t control those third parties and we’re not responsible for their privacy practices. This includes Stripe, whose handling of your verification documents is governed by Stripe’s privacy policy.

17. Age

Acenda is for people aged 18 and over, and you confirm that you are when you create your account. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact us and we will delete it.

18. Emails and Notifications

We send emails needed to run your account, such as sign up confirmation, password reset and invitations. If you joined the waitlist, we may email you about the launch. We do not run a marketing mailing list. In the App you choose which notifications you receive in Settings.

19. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we’ll let you know through the App or by email. The effective date at the top of this Policy tells you when it last changed. Continued use of the App after changes means you accept the updated Policy.

20. Contact Us

Questions, requests, or complaints about privacy?

Email: support@acenda.online

Operator: HSEC Industries Pty Ltd

Platform owner and store publisher: Lockhart Industries Pty Ltd

App Name: Acenda

Jurisdiction: Western Australia, Australia