Privacy policy
This release-candidate policy explains how LOGiT Australia Pty Ltd handles personal information through CouncilAid. It remains non-effective until it completes independent review, approval and publication through the CouncilAid governance workflow.
This working draft supports product and professional review. It must not be represented as CouncilAid's final legal position or relied on as legal advice.
Who is responsible
LOGiT Australia Pty Ltd (ABN 53 615 466 807) operates CouncilAid. References to “CouncilAid”, “we”, “us” and “our” mean LOGiT Australia Pty Ltd. Privacy enquiries, access or correction requests and complaints may be sent to kieran.shirey@logitaust.com.
Information we collect and hold
We may handle Member names, business contact details, verified identity references, Council invitations, roles and access history; support correspondence; usage, security, audit and commercial-administration records; and personal information contained in Council-provided asset, works, financial or evidence files. Councils and Members should not upload unnecessary personal or sensitive information.
How we collect information
We collect information from Members and Council administrators, uploaded files, approved public sources, authenticated identity services, platform activity, support interactions and approved purchasing workflows. Where practicable, we collect personal information directly from the individual or from an authorised Council acting in connection with the service.
Why we handle information
We use information to authenticate Members, isolate Council tenants, provide asset, financial, optimisation, maintenance and works workflows, secure uploaded evidence, provide support, maintain accountable audit history, meter platform activity and administer agreed commercial arrangements. We do not use Council information for unrelated purposes without an appropriate authority and notice.
Storage, access and security
Structured records are stored in Cloudflare Sites-hosted D1 and files in Cloudflare Sites-hosted R2 quarantine or released-object storage. The precise production D1 and R2 locations are not represented as Australian-only. Access is limited by tenant membership, role, restricted contractor assignment and separately authorised platform-administrator controls. We use malware scanning, audit records, rate limits, operational monitoring and governed recovery controls appropriate to the service.
Service providers and overseas handling
We use approved providers for hosting and identity, OpenAI for authorised AI-planning requests, Cloudmersive for stateless malware scanning and Resend for service email. Information may be processed outside Australia, including in the United States and other countries in which an approved provider or subprocessor operates. We assess provider safeguards and contracts and take reasonable steps required by applicable Australian privacy law before overseas disclosure.
AI-assisted planning
When an authorised Member invokes an AI-planning workflow, relevant Council planning context and the Member’s request may be sent to OpenAI to produce a response. CouncilAid requests the Responses API with storage disabled, but does not currently represent that processing is confined to Australia or covered by an organisation-level Zero Data Retention arrangement. AI outputs remain decision support and require Council review.
Retention and disposal
Unreleased quarantined files expire after 30 days. Transient usage, diagnostic, notification-delivery and security events are retained for 24 months. Company financial records are retained for at least seven years after the relevant transaction is complete. Council records and released evidence follow the Council-approved schedule and applicable State or Territory retention authority. After the 30-day tenant-exit period, we delete or de-identify non-record information no longer required, subject to investigations, disputes, legal holds and other lawful obligations.
Access and correction
An individual may ask whether we hold their personal information and request access or correction by contacting kieran.shirey@logitaust.com. We may need to verify identity and authority before responding. If an exception permits us to refuse a request, we will explain the refusal and available complaint options where required. Council-held public records may also be subject to the Council’s own access and correction processes.
Privacy complaints
Send a complaint to kieran.shirey@logitaust.com with enough detail for us to assess it. We will acknowledge the complaint, investigate it fairly and aim to provide an outcome within 30 days, or explain why more time is required. If the complaint is not resolved, the individual may contact the Office of the Australian Information Commissioner or another regulator with jurisdiction.
Data breaches and policy changes
We contain and assess suspected data breaches under our incident process and notify affected individuals and regulators where required. We review this policy when our information handling materially changes and at least annually after publication. The published page will show the effective version and review status.
Official reference material
These sources informed the draft structure. They do not replace advice on CouncilAid's circumstances.