Privacy Policy

1Information We Collect

Account information

When you register for a ChillaHub account, we collect:

• Name and email address
• Account credentials (username and encrypted password)
• Payment information (for paid plans and credit purchases)
• Transaction history

Content you provide

We collect the content you input into our services, including:

• Text conversations and prompts
• Files, images, and documents you upload
• Generated content from AI interactions

Technical information

We automatically collect:

• IP address and general location information
• Browser type and device information
• Usage patterns and service interaction data
• Log data including access times and features used

Cookies and similar technologies

We use a small, specific set of cookies and browser storage. We do not use advertising cookies and we do not track you across other websites.

• Session cookie: keeps you signed in while you use the application
• Browser storage: remembers your theme and language preference on your own device
• Analytics: our self-hosted analytics counts page views and interactions. It honours "Do Not Track", excludes search strings and URL fragments, and does not follow you to other sites

2How We Use Your Information

We use your information to:

• Provide and maintain our services
• Process your requests and generate the output you ask for
• Manage your account and subscriptions
• Process payments and maintain billing records
• Improve the product using aggregate usage statistics — not your content
• Communicate with you about service updates
• Ensure security and prevent fraud
• Comply with legal obligations

3Third-Party AI Services

ChillaHub runs on AI models supplied by third-party providers. When you generate something:

• Your prompt and any reference files are sent to the provider of the model you selected, so it can produce the result
• We engage those providers under business or enterprise terms that prohibit them from using customer content to train their models, and we choose providers on that basis
• Providers may retain content briefly for abuse monitoring under their own terms, after which it is deleted
• Each provider publishes its own privacy policy covering the processing it performs

If a provider cannot be engaged on these terms, we do not route your content to it.

4Information Sharing and Disclosure

We may share your information in the following circumstances.

Service providers

We share information with a small number of vendors who operate parts of the service on our behalf:

• Amazon Web Services — hosting, storage, and content delivery
• Stripe — payment processing. Card details go to Stripe directly; we never receive or store your full card number
• AI model providers — generating the output you request, on the terms described above
• Our self-hosted analytics — usage statistics, running on our own infrastructure

These vendors may use your information only to provide their service to us, not for their own purposes.

Legal requirements

We may disclose information when required to:

• Comply with legal obligations
• Protect our rights and property
• Prevent fraud or security threats
• Respond to lawful government requests

Business transfers

In case of merger, acquisition, or sale of assets, your information may be transferred to the new entity.

5Data Security

We implement industry-standard security measures including:

• Encryption — data encrypted in transit and at rest
• Security assessments — regular security reviews and testing
• Access controls — strict authentication and authorization
• Secure payments — protected payment processing

6Data Retention

We retain your information:

• Account information — until you delete your account
• Content and conversations — as specified in your account settings
• Payment information — as required for billing and legal purposes
• Log data — typically 90 days, for security, fraud prevention, and abuse investigation only

You can delete your conversations and uploaded files through your account dashboard.

7Your Rights and Choices

You have the right to:

• Access your personal information
• Correct inaccurate information
• Delete your account and associated data
• Export your data
• Opt out of promotional communications
• Control conversation history retention

To exercise these rights, contact us at info@chillahub.ai or through your account settings.

8International Data Transfers

Your information may be processed and stored in various countries where our service providers operate. We ensure appropriate safeguards are in place for international transfers.

9Children's Privacy

ChillaHub accounts are for adults. You must be at least 18 to hold an account, and we do not knowingly collect personal information from children. Anyone under 18 may use the Services only through an account held and supervised by a parent, guardian, or employer. If you believe a child has given us personal information, contact us and we will delete it.

10Australian Privacy Act

We are an Australian company and handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

• You may ask for access to the personal information we hold about you, and ask us to correct it if it is wrong
• If you are unhappy with how we have handled your personal information, email us and we will respond within 30 days
• If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
• If a data breach occurs that is likely to cause you serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme

11European and UK Privacy Rights (GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, the GDPR and UK GDPR apply to our handling of your personal data. Flinders Consulting Pty Ltd is the data controller.

Our legal bases for processing

• Performance of a contract — to provide the Services you signed up for and to bill you
• Legitimate interests — to keep the Services secure, prevent abuse and fraud, and understand aggregate usage
• Consent — for marketing email, which you can withdraw at any time
• Legal obligation — to meet tax, accounting, and law enforcement requirements

Your rights

You may request access, correction, erasure, restriction of processing, or a portable copy of your data, and you may object to processing based on legitimate interests. Email us to exercise any of these — we do not charge for it.

International transfers

We are based in Australia and our providers operate in Australia, the United States, and elsewhere, so your data will be transferred outside the EEA and UK. Where it is, we rely on Standard Contractual Clauses or another approved transfer mechanism with the vendors concerned.

Complaints

You have the right to lodge a complaint with the supervisory authority in the country where you live or work.

12California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the right to:

• Know what personal information we collect, why we collect it, and who we disclose it to
• Request a copy of that information, or ask us to correct it
• Request deletion of your personal information
• Limit the use of sensitive personal information
• Not be discriminated against — your price and service stay the same if you exercise these rights

13Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by posting the updated policy on this page and changing the effective date shown at the top.

14Contact

If you have questions about this Privacy Policy, or want to make a data subject access request or a privacy complaint, email info@chillahub.ai.