Privacy Policy

1. Introduction

This Privacy Policy explains how Ask Solz Pty Ltd, trading as Actuant (we, us, our) collects, holds, uses and discloses personal information. We handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs), and we treat this Policy as binding on us whether or not the Privacy Act would otherwise require it of a business of our size. Where we handle the personal information of individuals in other jurisdictions, additional laws may apply.

This Policy applies to our website, applications, APIs and related services (the Service). Actuant audits deployed web apps for launch readiness and keeps watching them afterwards: you give us the URL of an app you have built, the Service audits it in a real browser, can propose fixes through GitHub pull requests, can re-audit it automatically after each deployment, can check whether AI assistants can read it, submits it to launch directories on your behalf, and can be operated by AI coding agents you authorise. By using the Service, you consent to the collection, use and disclosure of your personal information as described here. If you do not agree, please do not use the Service.

2. The personal information we collect

Personal information is information or an opinion about an identified, or reasonably identifiable, individual. The kinds of personal information we collect include:

• Account information — name, email address, password (stored hashed by our authentication provider), organisation/workspace details and profile information;
• Billing information — plan, billing contact, and transaction records. Card details are collected and processed directly by our payment provider; we do not store full card numbers;
• Customer Data — the app URLs you submit, the pages of your app the Service loads and the content they render, the results of each audit and the history of monitoring runs, repository contents we access when you connect GitHub, the names of your Vercel projects and the deployment events they send us, the product details you provide for directory submissions (names, descriptions, screenshots, links), and the messages you send to the in-app agent, any of which may contain personal information about you or third parties that you choose to process;
• Connection tokens and keys — OAuth access tokens for the third-party services you connect (such as GitHub and Vercel), which we request with the least privilege needed and store in encrypted form; the API keys and agent authorisations you create (stored as one-way hashes); and the secret deploy-hook URLs you generate;
• Fraud-prevention signals — when you claim a Friend Pass, a one-way hash of your email address, of your device characteristics and of your IP address, and the opaque card fingerprint that our payment provider derives from the payment method on file (never the card number), used only to detect the same person or card claiming more than their share;
• Usage, device and log data — IP address, device and browser information, pages and features used, events, timestamps, referring URLs and diagnostic data, collected automatically;
• Cookies and similar technologies — see section 7; and
• Communications — records of your correspondence with us, including support requests and survey responses.

We do not seek to collect sensitive information (such as health or biometric information). Please do not submit sensitive information through the Service unless strictly necessary; if you do, you consent to us handling it to provide the Service.

3. How we collect personal information

We collect personal information:

• directly from you — when you register, submit an app URL for scanning, configure a launch, communicate with us, or otherwise use the Service;
• automatically — through cookies, analytics and server logs as you use the Service, and through the scans, directory submissions and analytics integrations you set up; and
• from third parties — such as our authentication provider, payment provider, GitHub (when you authorise repository access), Vercel (when you connect it, including deployment events for the projects you link), and the AI coding agents you authorise to act on your Account.

Where it is reasonable and practicable, we collect personal information directly from you. If we collect information about you from a third party, we take reasonable steps to ensure you are made aware of this Policy.

4. Why we collect, hold, use and disclose your information

We handle personal information for purposes including to:

• provide, operate, maintain and secure the Service and your Account;
• run the audits, continuous monitoring re-audits, AI-assisted fixes, AI-visibility checks and directory submissions you set up, and operate the in-app agent and the agent integrations you authorise;
• process payments, manage subscriptions and prevent fraud;
• provide customer support and respond to your enquiries;
• understand and improve the Service, including through analytics and product research;
• send you service, security and administrative messages (which you cannot opt out of while you hold an Account);
• send you marketing communications where permitted (see section 8);
• detect, investigate and prevent misuse, security incidents and breaches of our terms; and
• comply with our legal obligations and enforce our legal rights.

We will only use or disclose your personal information for a purpose for which it was collected, a related purpose you would reasonably expect, a purpose you have consented to, or as otherwise permitted or required by law.

5. Disclosure to service providers

We disclose personal information to trusted third-party service providers (sub-processors) who help us operate the Service, under arrangements that require them to protect the information. These currently include, among others:

• Authentication — Clerk (user accounts, sign-in, verification emails);
• Hosting and infrastructure — Vercel (application hosting), Neon (Postgres database hosting), Trigger.dev (runs audits, monitoring checks and other background jobs), and Cloudflare (DNS, network edge, and routing of email sent to our addresses);
• Remote browsers — Steel (the cloud-hosted Chromium sessions in which deep audits load and inspect your app; see section 9);
• Page rendering — Jina (renders the URLs you submit when a lightweight scan needs the page as a browser would show it);
• Payments — Stripe (billing for your subscription and credit top-ups);
• Product analytics and session replay — PostHog (usage analytics and, with consent, session recordings; see section 7);
• Advertising measurement — X Corp. (the X Ads pixel, with consent; see section 7);
• Error monitoring — Sentry (errors, performance traces, and privacy-masked diagnostic recordings enabled only with analytics consent; see section 7);
• Email and marketing automation — Resend (transactional and marketing email) and Customer.io (marketing journeys for the waitlist and for account lifecycle messages);
• Documentation search — Chroma Cloud (stores an index of our own documentation and embeds the questions you ask the in-app agent so it can find the relevant page);
• Code hosting — GitHub (when you authorise repository access via OAuth so the Service can open pull requests on your repositories); and
• AI model providers — the model providers that power AI features (routed via OpenRouter), which process audit results, repository content and agent conversations submitted to them to generate summaries, fix briefs, proposed code changes and agent replies. We do not use your content to train models of our own, and we send prompts and outputs only to the model provider, never to our analytics tools.

We may also disclose personal information to: the launch directories you direct us to submit your app to (limited to the product details you provide for the submission); our professional advisers; a potential or actual purchaser in connection with a sale or restructure of our business; and law enforcement, regulators or others where required or authorised by law.

6. Disclosure to overseas recipients

Some of our service providers store or process personal information outside Australia. In particular, several providers listed above are located in, or store data in, the United States and may process data in other countries depending on the provider and the integrations you use. By using the Service you acknowledge and consent to your personal information being disclosed to, and stored or processed by, recipients located overseas.

We take reasonable steps to ensure overseas recipients handle your personal information consistently with the APPs, including through contractual protections. However, you acknowledge that, where you consent to overseas disclosure, APP 8.1 may not apply and we may not be accountable under the Privacy Act for how an overseas recipient handles your information, and you may not be able to seek redress under the Privacy Act.

7. Cookies, analytics and tracking

We use cookies and similar technologies. Strictly necessary cookies are required to run the Service (for example, to keep you signed in and to keep the Service secure) and are always on. We also use analytics cookies (via PostHog) to understand how the Service is used and how to improve it. With analytics consent, PostHog also records a replay of your session — a reconstruction of what was on screen and where you clicked — so we can see how people actually use the Service; anything you type into a form is masked in that recording. Sentry may separately record a privacy-masked replay of a sample of sessions, and sessions where an error occurs, to help us reproduce faults; that replay masks all text and form inputs, blocks images and other media, and does not capture network request or response bodies.

We also use advertisingcookies, currently the X (Twitter) Ads pixel, to measure whether an advertisement brought you to the Service and whether you then joined the waitlist, so we can tell which advertising works. It reports the pages you visit here to X, which may combine that with your X account under X’s own privacy policy. We do not use it to build a profile of you or to show you advertising elsewhere.

Neither analytics nor advertising cookies are set until you make a choice in the cookie banner. In the banner’s preferences view both are pre-selected; you may deselect either before saving, choose “Reject all”, or change your mind later through Cookie settings in the site footer, your browser settings, or by contacting us at privacy@actuant.dev. If you opt out, we will stop setting and reading those cookies for your device.

8. Direct marketing

We may send you marketing communications about Actuant where you have consented or where the law otherwise permits. Every commercial electronic message we send will identify us and include a functional unsubscribe facility, consistent with the Spam Act 2003 (Cth). You can opt out at any time by using the unsubscribe link or by contacting us, and we will action your request promptly (and in any event within the period required by law). Opting out of marketing will not stop service or transactional messages.

9. AI and automated processing

The checks themselves, and your score, are produced by fixed rules and do not involve an AI model. Separately, Actuant uses AI to summarise what the checks found, to write fix briefs and proposed code changes, and to power the in-app agent. When you submit an app URL, connect a GitHub repository or talk to the agent, the relevant content (which may include personal information) is processed by AI models to generate that output (AI Output). Proposed code changes are delivered as GitHub pull requests for you to review — the Service does not push changes to your repositories without a pull request. AI Output may be inaccurate; you are responsible for reviewing it before acting on it (see our Terms of Service).

Remote browser sessions. A deep audit loads your app in a real browser hosted by Steel in the United States. The pages of your app and what they render pass through that session for the length of the audit, after which the session is destroyed. If the audit meets a login or CAPTCHA wall, you may choose to take over the session and sign in yourself; anything you type is entered into that remote browser. We do not record or store credentials you enter during a takeover, and the session, including any cookies your app sets, is destroyed when the audit ends.

Agents you authorise.If you connect an AI coding agent through our MCP server or an API key, that agent can read your reports and act on your Account. What the agent’s own provider does with the content we return to it is governed by that provider’s privacy policy, not this one.

Where we use a computer program to make, or to do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect your rights or interests, and personal information is used in that program, we will describe that use here in accordance with the Privacy Act. We do not currently use automated decision-making of that kind to make significant decisions about individuals without human involvement; if this changes, we will update this Policy.

10. Security of your information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include encryption of stored connection tokens, least-privilege scopes for the services you connect, encryption in transit, access controls, and use of reputable infrastructure providers. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Retention and deletion

We retain personal information for as long as it is needed to provide the Service, for the purposes described in this Policy, and to meet our legal, accounting and record-keeping obligations. When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it. In particular: remote browser sessions are destroyed when an audit ends and in any case within minutes; audit reports and monitoring history are kept while your Account is open so you can compare runs over time; a report you publish stays public until you unpublish it or close your Account; and fraud-prevention hashes are kept for as long as the Friend Pass programme runs. You may request deletion of your Account and associated data as described below, subject to information we are required or entitled to retain.

12. Access and correction

You may request access to, or correction of, the personal information we hold about you by contacting our Privacy Officer using the details below. We will respond within a reasonable period. We may need to verify your identity, and in limited circumstances permitted by the APPs we may decline a request, in which case we will give you reasons. We do not generally charge for access requests, but may charge a reasonable, non-excessive fee for retrieval and supply in some cases.

13. Children

The Service is not intended for, and may not be used by, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take appropriate steps to delete it.

14. Third-party links and services

The Service may link to, or interact with, third-party websites and services that we do not control, including GitHub, Vercel, Stripe, the launch directories your app is submitted to, and the AI coding agents you connect. This Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to read their privacy policies.

15. Notifiable data breaches

If we become aware of a data breach involving personal information that is likely to result in serious harm, we will assess and respond to it in accordance with the Notifiable Data Breaches scheme under the Privacy Act, including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required.

16. Changes to this Policy

We may update this Policy from time to time. We will post the updated version with a new “Last updated” date and, where changes are material, take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

17. How to contact us or make a complaint

If you have a question, an access or correction request, or a complaint about how we handle your personal information, please contact our Privacy Officer at privacy@actuant.dev. We will acknowledge and investigate your complaint and aim to respond within a reasonable time.

If you are not satisfied with our response, you may complain to the OAIC at www.oaic.gov.au.

Ask Solz Pty Ltd, trading as Actuant — Privacy Officer, privacy@actuant.dev.

18. Your rights in the EEA and UK (GDPR)

Ask Solz Pty Ltd is established in Australia, but if you are in the European Economic Area or the United Kingdom and use the Service, we honour the rights the GDPR and UK GDPR give you regardless of whether we are strictly required to.

Legal bases. We process your personal data on the bases of: performance of our contract with you (to provide the Service and run the audits you request); your consent (for non-essential analytics cookies, and for marketing email); and our legitimate interests in securing, maintaining and improving the Service, where those interests are not overridden by your rights.

Your rights. You may ask us to: give you access to the personal data we hold about you; correct it; erase it; restrict or object to how we process it; and provide it to you, or another controller, in a portable format. Where we rely on consent, you may withdraw it at any time — for analytics cookies, use Cookie settings in the site footer; for marketing, use the unsubscribe link in any email. Withdrawing consent does not affect processing already carried out.

International transfers. Using the Service transfers your data outside the EEA and UK — to us in Australia, and to our processors in the United States and elsewhere. Australia does not currently hold an EU adequacy decision, so where a transfer mechanism is required we rely on appropriate safeguards, including the standard contractual clauses that our processors offer in their data processing terms.

To exercise any of these rights, contact our Privacy Officer at privacy@actuant.dev. You also have the right to lodge a complaint with your local supervisory authority — in the UK, the Information Commissioner’s Office at ico.org.uk.