Trust & privacy
Trust, privacy & data handling
How ShadowIQ handles your data, what we run on, and the privacy posture we apply to pilots and live programs. This page is a summary — we'll share the full privacy pack and data-handling schedule as part of any pilot.
Privacy posture
ShadowIQ is built to align with the Australian Privacy Principles (Privacy Act 1988) and the EU GDPR. We collect what's needed to monitor risk and nothing more.
Low-PII by default
Pilots monitor trips at group level — destination, dates, itinerary, group size, responsible contacts. Named student/athlete records, medical, passport, or guardian details are an explicit opt-in, not a default.
How we use AI
We use AI and automated processing to help structure and analyse trip and event information. Personal data is redacted before AI processing where applicable, and we work from operational context rather than individual records by default.
Data retention
The default target is to delete or de-identify pilot setup data 90 days after a pilot ends, unless the customer converts or a contract requires a different period. Evidence and audit records may be retained longer when agreed.
Service providers
We rely on a small set of established providers, grouped here by category. Some may process data outside Australia; we confirm hosting and database regions as part of a customer privacy pack.
| Category | Purpose |
|---|---|
| Cloud hosting & infrastructure | Application hosting, database, and serverless execution |
| Authentication & identity | Sign-in, sessions, and organisation management |
| AI / automated processing | Automated parsing and analysis of trip and event information (personal data redacted where applicable) |
| Payments | Subscription and payment processing |
| Communications | Email and SMS notification delivery |
A current subprocessor register naming each provider is available to customers and pilot partners on request — email hello@shadowiq.io.
Questions about trust or procurement?
We're happy to walk procurement, IT, and privacy teams through our posture and share the full documentation.
- Operating entity
- ShadowIQ Pty Ltd
- ABN
- 67 689 602 515
- Registered in
- Australia
- Security reporting
- Vulnerability disclosure policy · security.txt
Vulnerability disclosure
Security researchers, customers, and partners can report suspected vulnerabilities through the general contact path on this page. Please include the affected URL or feature, reproduction steps, impact, and any safe proof of concept. Do not include sensitive customer data in an initial report.
After a report reaches us, we expect to acknowledge it within five business days, triage severity, ask for any detail needed to reproduce it, and share remediation status when we can do so without increasing risk. Please do not access data that is not yours, disrupt service, or publicly disclose an unresolved issue before we have had a reasonable chance to investigate and fix it. ShadowIQ does not currently run a paid bug bounty.