Workshop IT's low-poly beaver logo

WORKSHOP IT PRIVACY POLICY

Last updated: 28th September 2026

Introduction

WORKSHOPIT PTY LTD (“WORKSHOP IT”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information we collect and hold.
 
This Privacy Policy explains how we collect, use, disclose, store and protect personal information when you use our website, the Jessica AI Requirements Elicitation Platform and related services (collectively, the “Services”).
 
Information entered into Jessica by a customer or its authorised users may include personal information about other individuals, such as employees, stakeholders or other participants in a project. Where we process that information on behalf of a customer, we generally process it to provide the Services to that customer and in accordance with the customer’s instructions.
 

Important Data Principles:

  • No Training on Your Data: Data entered into the Services by you or your team is not used by WORKSHOP IT to train or fine-tune AI models.

  • Private to Your Team: Customer data entered into the Services is accessible only to authorised users of the relevant customer account and to WORKSHOP IT personnel or service providers where access is necessary to provide, secure or support the Services.

  • Encryption: Customer data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher.

1. Personal Information We Collect

We collect personal information relating to you (“Personal Information”) as follows:

Personal Information You Provide:

  • Account Information: Name, contact information, credentials, and job title.

  • Customer Content: Information entered, uploaded or otherwise submitted to the Services by a customer or its authorised users, including interview responses, requirements, documents, prompts, feedback and other project information. Customer Content may contain Personal Information relating to the user or other individuals.

  • Communication Information: Contents of any messages, emails, or support requests you send to us.

  • Technical Information: IP address, browser type, operating system, device information, date and time of requests, usage information and information about interactions with the Services.

  • Cookies and similar technologies: We use cookies and similar technologies necessary to operate the website and Services and, where applicable, to understand usage and improve our services.

2. How We Collect Personal Information:

We may collect Personal Information:

  • Directly from you when you create an account, use the Services, contact us or request support;

  • From your organisation or another customer who provides you with access to the Services;

  • From information you or another authorised user enters or uploads into the Services;

  • Automatically through your use of our website and Services, including through logs, cookies and similar technologies; and

  • From service providers that support our business and the delivery of the Services.

3. How We Use Personal Information

We use Personal Information to:

  • Provide, operate, maintain and secure the Services;

  • Create, process and deliver AI-assisted requirements elicitation outputs requested by users;

  • Authenticate users and manage accounts;

  • Provide customer support and respond to enquiries;

  • Communicate with customers about the Services, including service updates and, where permitted, marketing communications;

  • Monitor and analyse use of the Services to maintain and improve their performance, reliability and security;

  • Detect, prevent and investigate fraud, misuse, security incidents and other unlawful activity;

  • Process payments and manage our business relationship with customers; and

  • Comply with applicable legal obligations and protect our legal rights.

4. AI Usage and Customer Content

WORKSHOPIT PTY LTD uses Customer Content to process information via an LLM and return AI-generated outputs to fulfil the Services.

PII Recommendations: As our Services are built for project requirements, there is generally no need to include personally identifiable information (PII). We recommend avoiding the entry of sensitive personal data unless strictly necessary for the requirement.

5. Retention, Deletion and Transfer of Data

Retention and Deletion

We retain Personal Information only for as long as reasonably necessary to provide the Services, fulfil the purposes described in this Privacy Policy, meet our legal and regulatory obligations, resolve disputes and enforce our agreements.

Customer application data is retained while the relevant service is being provided and is deleted or returned in accordance with the applicable customer agreement and our operational deletion processes.

Where Personal Information is no longer required for these purposes, we take reasonable steps to delete or de-identify it, subject to legal, security and backup requirements.

Data Hosting and International Transfers

Customer application data is hosted within the customer’s designated hosting region. Australian customers are hosted in Australia, while US customers are hosted within the United States.

We may use service providers located in Australia, the United States and other countries in connection with providing, securing, monitoring and supporting the Services. Where Personal Information is disclosed to an overseas recipient, WORKSHOP IT takes reasonable steps to ensure that the information is handled in accordance with applicable privacy requirements.

The countries in which our service providers may be located may change as our Services develop. We will update this Privacy Policy when our overseas disclosure practices materially change.

6. Disclosure of Data

We may disclose Personal Information:

  • To service providers that help us operate, secure and support the Services, including cloud hosting, AI processing, analytics, communications and payment providers;

  • To professional advisers where reasonably necessary;

  • Where required or authorised by law, regulation, court order or a valid request from a public authority; or

  • In connection with a proposed or completed merger, acquisition, restructuring, financing or sale of all or part of our business or assets.

We do not sell or share Personal Information for monetary or other valuable consideration for purposes of cross-context behavioural advertising.

7. Security of Data

We take reasonable steps to protect Personal Information against misuse, interference, loss and unauthorised access, modification or disclosure.

Our security measures include encryption of data at rest using AES-256, encryption in transit using TLS 1.2 or higher, access controls, authentication controls, security monitoring and secure cloud infrastructure.

No method of transmission or electronic storage can be guaranteed to be completely secure.

8. Security Incidents

We maintain procedures for detecting, investigating and responding to security incidents. Where a confirmed security incident affects Personal Information, we will notify affected customers or individuals as required by applicable law and our contractual obligations.

9. Global Data Protection Rights

Depending on your location, you may have the following rights:

GDPR (EU/EEA Residents): You have the right to access, update, or delete your information, the right of rectification, the right to object to processing, and the right to data portability. To exercise these rights, please email us.

California Privacy Rights

If you are a California resident and the California Consumer Privacy Act, as amended (“CCPA”), applies to our processing of your Personal Information, you may have rights including:

  • The right to know what categories of Personal Information we collect, the sources from which it is collected, the purposes for which it is used and the categories of third parties to whom it is disclosed;

  • The right to request deletion of Personal Information, subject to applicable exceptions;

  • The right to request correction of inaccurate Personal Information;

  • The right to opt out of the sale or sharing of Personal Information, where applicable; and

  • The right to limit certain uses and disclosures of Sensitive Personal Information, where applicable.

WORKSHOP IT does not sell Personal Information.

We do not share Personal Information for cross-context behavioural advertising. We have not sold or shared Personal Information for cross-context behavioural advertising. We may disclose Personal Information to service providers and contractors for business purposes as described in this Privacy Policy.

To exercise applicable privacy rights, contact us at hello@workshopit.com.au. We may need to verify your identity before processing a request.

Where we process Personal Information solely as a service provider or contractor on behalf of a customer, the relevant customer may be responsible for responding to requests concerning that information. We will provide reasonable assistance to the customer where required.

10. AI and Third-Party Service Providers

Jessica uses artificial intelligence technologies to process information submitted to the Services and generate outputs requested by users.

Customer Content submitted for AI processing may contain Personal Information. Where third-party AI providers are used to provide the Services, relevant Customer Content may be processed by those providers on our behalf.

WORKSHOP IT does not use Customer Content to train or fine-tune AI models.

We select AI service providers based on their security, privacy and data-handling practices and require appropriate contractual and technical protections for information processed on our behalf.

11. Other Service Providers

Analytics and Cookies:

We use cookies and similar technologies to operate the website and Services, maintain security, remember preferences and understand how our website and Services are used.

We use Google Analytics to collect information about website usage and interactions. Analytics information may include IP address, device and browser information, pages viewed, referring website and interaction information.

Where required by law, we seek appropriate consent before using non-essential analytics or similar technologies.

Payments: We use third-party payment providers to process payments. We do not store full payment card details on our systems. Payment information is provided directly to the relevant payment provider and is handled in accordance with its privacy policy.

Infrastructure: We use CI/CD tools to manage our software development securely.

12. Children’s Privacy

Our Services are not intended for use by individuals under the age of 18. We do not knowingly collect information from children. If we become aware of such data collection, we take immediate steps to remove it.

13. Access, Correction and Privacy Complaints

You may contact us at hello@workshopit.com.au to request access to Personal Information we hold about you or to ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We will handle requests in accordance with applicable privacy laws.

If you have a concern about how we have handled your Personal Information, please contact us first at hello@workshopit.com.au. We will investigate and respond to your complaint within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

14. Changes to This Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date at the top.

15. Contact Us

If you have any questions regarding this Privacy Policy or your data, please contact us at:

WORKSHOPIT PTY LTD

Email: hello@workshopit.com.au

Website: https://workshopit.com.au