Cadie Pty Ltd (“Cadie”, “we”, “our”, “us”) builds AI-assisted software that helps organisations manage governance, risk and compliance. This policy explains how we collect, use, share and protect personal information when you visit cadie.com.au, sign up for an account, use the Cadie platform, or otherwise deal with us.
Cadie handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
If your organisation is a Cadie customer, this policy sits alongside and doesn’t replace the privacy and data handling terms in your customer agreement, including the Data & Privacy Schedule. Where those terms go into more detail (for example, on data residency, retention or incident notification timeframes), the agreement governs.
How we govern and secure our AI features is described in more detail in the Cadie AI Governance Framework, which is available on request. Customers can also request our AI Security Policy under confidentiality.
Depending on how you interact with us, we may collect:
We don’t ask you to upload sensitive information (like health or criminal history) to Cadie, but recognise it can sometimes appear within Customer Content your organisation manages, for example inside an incident register. Your organisation is responsible for having a lawful basis to include that information, and we protect it to the same standard as all other Customer Content.
We use personal information to: provide and support the platform; authenticate users and manage accounts; keep the platform secure, including monitoring, logging and investigating security incidents; respond to enquiries; send service-related communications; comply with our legal obligations; and, where you’ve agreed to hear from us, send marketing communications (see below).
Customer Content is used only to provide, support and secure the Cadie services for the customer that supplied it, or as required by law.
We don’t sell personal information.
Marketing. You can opt out of marketing emails at any time using the unsubscribe link, or by contacting us (see Contact us, below). Opting out won’t affect service-related messages about your account.
Cadie uses artificial intelligence to help generate insights, summaries and recommendations from the information your organisation uploads. Unless a customer has expressly agreed otherwise in writing:
We use Amazon Bedrock, operated by Amazon Web Services, to run AI inference in AWS’s Australian regions. Bedrock doesn’t use our customers’ inputs or outputs to train its own or any third-party models, and the providers of the models we access through Bedrock (such as Anthropic) do not receive Customer Content.
We keep a record of AI activity (prompts, outputs and the model version used) to investigate faults and security incidents and to support customer audits. These records are protected and retained in the same way as other Customer Content.
Automated decisions. Cadie does not use personal information to make decisions about individuals, and does not make decisions on its own that significantly affect anyone’s rights or interests. Cadie’s AI supports human decision-makers. Its outputs should be reviewed by an authorised person before being relied on for compliance, legal or operational decisions. If your organisation uses Cadie’s outputs in its own decision-making, your organisation is responsible for any disclosures it must make about that use.
We share information with service providers who help us run Cadie, and only so they can provide that service to us. These include:
We may also share information with professional advisers, or with regulators and law enforcement where the law requires it. Anyone we share information with may only use it to provide the relevant service to us, or as required by law.
We don’t sell or rent personal information to third parties.
Customer Content, including AI processing of it, is hosted and processed in Australia, in Amazon Web Services’ Sydney and Melbourne regions. We apply security measures including encryption in transit and at rest, multi-factor authentication, role-based access controls, separation of each customer’s data, audit logging and regular security reviews, including independent testing. No system is perfectly secure, but we continually review and improve our controls.
Some information outside Customer Content is handled by providers located overseas. Website analytics data is processed by Google, including in the United States, and some of our business tools (for example for email, support and payments) may store contact and account details in the United States or other countries. Where we disclose personal information overseas, we take reasonable steps to make sure it’s protected to a standard consistent with the Australian Privacy Principles, including through contractual safeguards.
We keep personal information only for as long as we reasonably need it to provide the platform, meet our legal and contractual obligations, resolve disputes, and maintain proper business records. When we no longer need it, we securely delete or de-identify it.
When Customer Content is deleted, the data derived from it is deleted too, including its searchable index entries (embeddings). AI activity logs are kept for the period set out in the customer agreement and then deleted. Backups may retain copies for a limited period before they expire.
If you’re a Cadie customer, the specific data export and deletion timeframes that apply after your service ends are set out in your customer agreement.
If a data breach occurs, we act quickly to contain it and assess the risk of harm. Where a breach is likely to result in serious harm, we notify the people affected and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where a breach involves Customer Content, we notify the affected customer within the timeframe in their customer agreement.
Our website uses essential cookies to make the site work, and analytics cookies to help us understand how visitors use it. You can control or disable cookies in your browser settings, though some site functionality may be affected.
We use Google Analytics to help us understand how visitors use our site. Google Analytics may set cookies on your device for this purpose. You can find out more about how Google handles this data at policies.google.com/technologies/partner-sites. The Cadie platform itself does not use advertising or analytics cookies.
Subject to some exceptions under the Privacy Act, you can ask us to:
Contact us using the details below and we’ll acknowledge your request within 5 business days and respond within 30 days.
If your request relates to information your employer has uploaded to Cadie, we may need to direct you to your organisation, since we handle that information on their instructions.
If you’re unhappy with how we’ve handled your personal information, contact us first (details below). We’ll acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
We may update this policy from time to time to reflect changes in our practices, technology or the law. The current version will always be available on our website, with the date it was last updated.
For privacy questions, requests or complaints:
Privacy Officer
Cadie Pty Ltd
Email: support@cadie.com.au
Website: www.cadie.com.au