Privacy Policy | Web Dance

1. INTRODUCTION, SCOPE & YOUR AGREEMENT

Web Dance Pty. Ltd (ABN 50 666 082 079) ("we," "us," "our," or "the Company") operates a proprietary standards body and SaaS platform. Our Services are designed for a wide range of users, including businesses, organisations, professionals, and individuals. This Privacy Policy ("Policy") describes how we collect, use, disclose, store, and protect Personal Information when you interact with our Services. This policy applies to all our digital properties and services, including but not limited to: webdance.com.au, app.webdance.com.au, aisof.org, all associated subdomains, our SaaS platform, APIs, and the Referral Program (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and consent to the practices described in this Policy. This Policy is an integral and binding part of our Terms of Service and Acceptable Use Policy. If you do not agree with any part of this Policy, you must immediately cease using our Services. Capitalized terms not defined herein have the meanings ascribed to them in our Terms of Service.

2. INFORMATION WE COLLECT

We collect information that identifies, relates to, describes, or could reasonably be linked with you or your business ("Personal Information").

2.1 Information You Provide Directly

Account & Profile Data: Your full name, email address, and, where applicable, company name, job title, and other professional or contact information. If you use optional public profile features, we also store a public username ("handle"), profile photo, short bio, job title, and social profile links you choose to add.
Service Data & Input: All content, data, prompts, questionnaires, documentation, AI model/system specifications, self-assessment responses, certification applications, and any other information you input, upload, or submit through the Services ("Service Data"). This includes all data submitted for the purpose of generating reports (including the confidential Risk Report) or obtaining an AISOF-7000 AI Model Certificate ("AI Model Certificate") or a Course Completion Certificate. You retain ownership of your proprietary inputs but grant us the licenses detailed in our Terms of Service.
Financial Data: Billing address and payment method details. We do not store full payment card numbers. Payment transactions are processed directly by our PCI-DSS compliant third-party payment processors (e.g., Stripe).
Referral Payout Details: If you take part in the Referral Program and choose to be paid, we store the payout details you enter — which may include account holder name, bank name, BSB and account number, PayID, or SWIFT/BIC and IBAN for international transfers — in our own database so we can pay you. These details are visible only to authorised Web Dance staff who administer payouts, every access is logged, and they are never used for any purpose other than paying your commissions.
Communication Data: Contents of your inquiries, support requests, and any correspondence with us.
Referral Program Data: Information related to your participation in the Referral Program, including your unique referral link, commission earnings, and the email addresses of individuals you refer (where you warrant you have obtained their lawful consent to provide it).
Referral Partner Application Data: If you apply to be paid as a Referral Partner, we collect your legal name, date of birth, residential address, contact number, occupation, and a tax number for your jurisdiction (such as an Australian TFN or ABN), plus the public profiles you tell us about if you promote as a creator or influencer. Your tax number is stored encrypted. Our staff see only its last three digits; the full number can be revealed only through a deliberate, separately logged action, and only where it is needed to process a payment or meet a legal obligation. We ask for none of this until you have actually earned a payable commission balance.

2.2 Information Collected Automatically

Device & Technical Data: Your IP address, browser type and version, operating system, device type, unique device identifiers, and other diagnostic data.
Referral Fraud-Prevention Data: We retain the IP address recorded when your account was created, and the IP address used when a referral link was redeemed, for the specific purpose of investigating suspected referral abuse (such as one person creating accounts to refer themselves). These are visible only to our administrators and Level 3 support staff, are not used for advertising or profiling, and are not used to make any automated decision that finally determines whether you are paid — a person reviews the case.
Payment Instrument Fingerprints: Where a subscription is paid by card, our payment processor gives us a fingerprint — a one-way identifier for the card, not the card number, and useless for making a charge. We compare fingerprints between a Referrer and the people they refer to detect self-referral. We cannot reconstruct card details from it.
Usage Data: Information about your interaction with the Services, including pages visited, features used, time spent, clickstream data, search queries, error logs, and performance data ("Usage Data").
Location Data: An approximate geolocation (country/state/city) derived from your IP address.
Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to collect information about your interactions with our Services. For detailed information about our use of cookies, please refer to Section 4.10 below.

2.3 Information from Third Parties

We may receive information about you from:

Business partners, resellers, or alliance partners
Authentication providers, if you choose to sign in with Google, GitHub, or LinkedIn (we receive your name, email address, and profile picture)
Fraud prevention and security service providers
Publicly available sources and databases

We handle such information in accordance with this Policy.

3. HOW WE USE YOUR INFORMATION

We use your Personal Information for the following Business and Commercial Purposes:

3.1 To Provide, Operate, and Maintain the Services

To create, manage, and secure your Account
To authenticate you and provide access to the Services
To process transactions, subscriptions, Stripe payments, and company wallet top-ups
To operate, administer, and enforce the Referral Program, including calculating, validating, disputing, and disbursing commissions
To generate AISOF reports, Certificates (e.g., AI Model Certificate), and other Outputs
To provide customer support and respond to your requests

3.2 To Improve, Develop, and Secure

To analyse trends, usage, and activities to understand how our Services are used
To conduct research and development to train, improve, and refine our proprietary AI models, algorithms, assessment methodologies, and the AISOF™ standard itself. This R&D is performed using only de-identified, aggregated, or anonymized data that cannot reasonably be used to identify you or your business
To develop new features, products, and services
To monitor, protect, investigate, and secure our Services, IT infrastructure, and users from fraud, abuse, spam, malware, security incidents, and violations of our Terms of Service or Acceptable Use Policy

3.3 To Communicate With You

To send you service-related, transactional, and administrative communications (e.g., account verification, payment confirmations, security alerts, changes to terms)
To respond to your inquiries and provide support
With your prior, separate, and explicit opt-in consent, we may send you promotional communications. You may opt-out at any time

3.4 For Legal and Regulatory Compliance

To comply with applicable laws, regulations, court orders, and enforceable governmental requests
To enforce our Terms of Service, Acceptable Use Policy, Payment and Refund Policy, Copyright & Intellectual Property Notice, and other agreements, including investigating potential violations
To protect and defend the rights, property, or safety of the Company, our users, or the public
To establish, exercise, or defend legal claims

4. HOW WE SHARE AND DISCLOSE INFORMATION

We do not sell your Personal Information. We share it only in the following limited circumstances:

4.1 With Service Providers and Processors

We engage trusted third-party vendors to perform functions on our behalf ("Processors"), such as:

Identity & Authentication: Auth0 (Okta, Inc.) — account sign-in, password and social login, and two-factor authentication.
Payment Processing: Stripe, Inc. — subscriptions, one-off purchases, and wallet top-ups.
Identity Verification: Stripe Identity (Stripe, Inc.) — used only to verify the identity of Referral Program participants who apply to be paid. Your identity document and selfie are uploaded directly to Stripe; Web Dance never receives or stores those images. We receive only the outcome and the structured details Stripe returns (legal name, date of birth, document type and issuing country). Stripe processes this as an independent controller under its own privacy policy and retention rules.
Cloud Hosting & File Storage: Google Cloud Platform.
Transactional Email: Google (Gmail SMTP) — used to send service emails such as certificates, invitations, and verification links. We do not operate a marketing email platform.
AI Processing: OpenAI, L.L.C. — used only for the AI Model Certificate assessment. See section 4.2 below.
Bot & Abuse Protection: Cloudflare, Inc. (Turnstile) — receives your IP address and a challenge token to verify you are not an automated system.
Error Monitoring: Sentry — receives technical error diagnostics, which may incidentally include your account identifier.

These Processors are contractually bound to handle your data securely and confidentially, only for the purposes we specify, and in compliance with applicable data protection laws.

4.2 Third-Party AI Processing

When you request an AI Model Certificate, the details you enter about the AI system being assessed — such as the model name, its stated purpose, model type, organisation type, and your described data sources, data collection method and privacy-compliance approach — are transmitted to OpenAI to generate the risk assessment and summary text. Do not enter personal information, confidential customer data, credentials, or trade secrets into these fields.

Our other document generators (AI Usage Policy, AI Incident Response Plans) and our course and certificate systems do not send your content to any third-party AI provider — those documents are assembled on our own servers from the answers you supply.

4.3 Public Certificate Verification

A core function of our Services is the issuance of verifiable certificates. The following are publicly verifiable: the AISOF-7000 AI Model Certificate (IDs beginning "AISOF-7000-", or "WD-AI-" for certificates issued before the programme was renamed), the Course Completion Certificate (IDs beginning "WD-EMP-"), and AI Incident Response Plans (IDs beginning "WD-ORGIRP-" or "WD-PRODIRP-"), for which we disclose only the organisation name, the named plan owner, the issue date and whether the plan is current. Your Internal AI Usage Policy (IDs beginning "WD-AIPOL-") is never publicly verifiable: it is your own internal governance document and is not exposed through the verification tool to anyone, including a person holding its reference number. When you are issued one of these, certain information associated with it becomes publicly accessible to anyone who enters the certificate's unique ID into our verification tool. The information includes:

The certificate holder's name (individual or company name as provided during certification)
The certificate's unique identification number, its status (e.g., Valid, Revoked), and the issuance and expiry dates
For an AI Model Certificate: the AI model's name and type, the assessed risk level, a public summary of the assessment, and your company website (where you supplied one)
For a Course Completion Certificate: the course title, your exam score, and the company name recorded on the certificate (where applicable)
Where a certificate has been revoked, the fact of revocation and the stated reason

What is NOT Publicly Shared: Your personal contact details (email, phone), billing information, payout/bank details, the detailed self-assessment answers, or the confidential Risk Report.

Not publicly verifiable: AI Usage Policies and AI Incident Response Plans generated on the Platform are internal governance documents for use inside your own organisation. They are not published to the verification tool and cannot be looked up by a third party.

By submitting an application for a certificate, you expressly acknowledge and consent to this public disclosure of the information listed above for the purpose of certificate verification.

4.4 Within the Referral Program

If you are a Referrer, we share strictly limited, pseudonymized information about Referred Users within your Referral Dashboard for transparency and commission tracking only. This information includes:

A Pseudonymized Identifier (e.g., "u***@domain.com")
Subscription Status (e.g., "Active Pro," "Cancelled")
Commission Status (e.g., "Pending Clearance," "Paid on [Date]," "Revoked")

We do not share the Referred User's full email address, name, payment details, company information, Service Data, or any other account activity. This limited sharing is a fundamental operational component of the Referral Program.

Fraud checks within the Program. To detect self-referral we compare limited signals between a Referrer and the accounts they refer: the card fingerprint used to pay, whether the email addresses resolve to the same mailbox, and the IP addresses recorded at sign-up. Where something is flagged, the outcome shown to the Referrer is only that a payout is on hold pending review — a Referrer is never shown another person's IP address, card details, or account information. The signals themselves are visible only to our administrators and Level 3 support staff, and a person makes the final decision.

4.5 Company-Sponsored Training & Employer Visibility

If your employer (or another organisation) invites you to complete a Web Dance training course through our company training programme, certain information about your participation is shared with that organisation's designated company administrators on the platform. This sharing is necessary to operate prepaid team training, track compliance, and issue organisation-branded certificates.

Information visible to your inviting company's administrators may include:

Whether you have created a Web Dance account and accepted the invitation
Your name and work email address associated with the invitation
Course enrolment status and which modules you have completed
Exam attempts, scores, pass/fail results, and certification status
Certificate identifiers for courses completed under that invitation

Company administrators register with a verified work email domain. Additional email domains used for invitations require manual approval by Web Dance after verification. By accepting a company invitation or creating an account to accept one, you acknowledge this employer visibility as described in our Terms of Service.

This employer visibility applies only to training sponsored through that company's invitations. Courses you enrol in and pay for personally are not shared with your employer unless you separately choose to share your certificates.

4.6 Optional Public Profiles (Logged-In Users Only)

You may optionally make a limited profile visible to other logged-in Web Dance users by turning on Public profile in your Profile settings. This feature is off by default. It does not make your profile available on the open web, to anonymous visitors, or to search engines. Only people with an authenticated Web Dance account who open your public profile link (for example, /u/yourname) can view it.

Important: "Public profile" here means visible to other Web Dance account holders, not visible to everyone on the internet, and not the same as company training visibility described in Section 4.4 above (which applies only when your employer invites you to sponsored training).

If you turn on Public profile, other logged-in Web Dance users may see:

Your display name and chosen username
Your profile photo (if uploaded)
Your bio and job title (if provided)
Social profile links you add (if provided)
Your Web Dance account member-since date (month and year)

What is NOT shown on your public profile: Your email address, phone number, billing details, legal name fields shown only in your private account view, company training records, certification application data, or other Service Data outside the optional profile fields above.

You control this feature from your Profile settings. By enabling Public profile, you instruct us to disclose the listed profile fields to other authenticated Web Dance users who access your public profile link. You may turn it off at any time; when off, your profile is private and not available through that link. Your account registration already constitutes acceptance of our Terms of Service and this Policy; enabling Public profile is an additional, explicit choice to make the listed fields visible to other logged-in users as described here.

4.7 For Legal Reasons

We may disclose your Personal Information if we believe in good faith it is reasonably necessary to:

Comply with a legal obligation, regulation, or valid legal process
Protect and defend the rights, property, or safety of the Company, our users, or the public
Prevent or investigate possible wrongdoing, fraud, or security breaches
Enforce our Terms of Service, Acceptable Use Policy, or protect our intellectual property rights (including the AISOF Intellectual Property)
As evidence in litigation or regulatory proceedings

4.8 Corporate Transactions

In connection with a merger, acquisition, sale of company assets, financing, or corporate reorganization, your Personal Information may be transferred as a business asset. We will notify you of any such change and any choices you may have regarding your information.

4.9 Aggregated or Anonymized Data

We may share or publish data that has been aggregated or anonymized in a manner that it can no longer reasonably be used to identify an individual or specific business. This may include statistical insights, industry trends, or marketing materials.

4.10 Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to track activity on our Services and retain certain information. Cookies are files with a small amount of data that may include an anonymous unique identifier. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Services.

Types of Cookies We Use:

Essential Cookies: Required for the operation of our Services, including authentication and security functions
Functional Storage: Browser local storage used to preserve your progress in multi-step forms and course players so you can resume where you left off
Functionality Cookies: Used to recognize you when you return and remember your preferences

We do not use advertising or marketing cookies, and we do not run third-party advertising or cross-site tracking pixels on the Services.

You can manage your cookie preferences through your browser settings. For detailed information about specific cookies we use, please contact us.

5. INTERNATIONAL DATA TRANSFERS

Our operations and many of our Processors are located globally. By using our Services, you acknowledge that your Personal Information may be transferred to and processed in countries with data protection laws that differ from those in your country of residence.

Where such transfers occur from regions with strict data export laws (including the European Economic Area, United Kingdom, and Switzerland), we implement appropriate safeguards in accordance with applicable legal requirements, including but not limited to Standard Contractual Clauses approved by the European Commission. You may request details of these safeguards by contacting us.

6. DATA SECURITY, INTEGRITY, AND RETENTION

6.1 Security Measures

We implement and maintain industry-standard technical and organisational security measures designed to protect your Personal Information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption, strict access controls, regular security audits, and secure development practices. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security. YOU ACKNOWLEDGE AND AGREE THAT YOU PROVIDE YOUR PERSONAL INFORMATION AT YOUR OWN RISK.

6.2 Data Integrity

You are responsible for ensuring the accuracy of the data you provide. We will take reasonable steps to ensure the Personal Information we process is accurate and up-to-date.

6.3 Retention Periods

We retain your Personal Information only for as long as is reasonably necessary to fulfil the purposes outlined in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

Account Data: Retained while your Account is active and for seven (7) years after account closure or inactivity
Service & Certification Data (e.g., AI Model Certificate submissions): Retained for seven (7) years after the relevant Certificate expires or your Account closes, for audit, historical record-keeping, and liability limitation purposes
Financial & Transactional Data: Retained for seven (7) years to comply with tax, auditing, and accounting laws
Referral Program Data: Retained for the duration of your participation and seven (7) years thereafter for financial record-keeping and dispute resolution
Referral Partner Application Data (identity details, address, tax number): Retained while you are an approved partner and for seven (7) years after your last payment, because it forms part of the records we are required to keep for payments made to you. Your identity document and selfie are not held by us at all — they remain with Stripe under Stripe's own retention policy
Referral Fraud-Prevention Data (sign-up and referral IP addresses, card fingerprints): Retained for as long as the associated referral records, and deleted with them
Communication Data: Retained for three (3) years from the date of the communication

After the applicable retention period, we will securely delete or irreversibly anonymize your data.

7. YOUR RIGHTS AND CHOICES

Depending on your location and applicable data protection laws (such as the Australian Privacy Principles, GDPR, or CCPA/CPRA), you may have certain rights regarding your Personal Information. To exercise any of these rights, please contact us. We will respond in accordance with applicable law and will first take steps to verify your identity.

General Rights (Applicable in Most Jurisdictions):

Access & Portability: You can request access to and a copy of your Personal Information
Correction: You can request correction of any inaccurate or incomplete Personal Information
Deletion: You can request deletion under certain circumstances. Note: This may require the closure of your Account and termination of the Services, and may not be possible where we have a legal obligation or compelling legitimate interest to retain it (e.g., to maintain certification records, prevent fraud, or enforce our agreements)
Objection & Restriction: You can object to our processing or request a restriction on processing under certain conditions
Withdraw Consent: Where processing is based on your consent, you may withdraw it at any time. This includes turning off Public profile in your Profile settings
Opt-Out of Marketing: Use the "unsubscribe" link in any promotional email

GDPR-Specific Rights (European Economic Area):

If you are located in the European Economic Area (EEA), you have additional rights under the General Data Protection Regulation (GDPR):

Right to Data Portability: Receive your Personal Information in a structured, commonly used, and machine-readable format
Right to Object to Processing: Object to processing of your Personal Information based on legitimate interests
Right to Lodge a Complaint: Lodge a complaint with a supervisory authority in your member state

CCPA/CPRA Rights (California):

If you are a California resident, you have the right to:

Know what Personal Information is collected, used, shared, or sold
Delete Personal Information held by businesses
Opt-out of the sale of Personal Information
Non-discrimination in service for exercising your CCPA/CPRA rights
Correct inaccurate Personal Information
Limit use and disclosure of sensitive Personal Information

Opting Out of Cookies and Tracking:

Most web browsers are set to accept cookies by default. You can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Services.

8. NATURE OF SERVICE & LIMITATION OF LIABILITY

OUR SERVICES ARE UTILISED BY A VARIETY OF USERS, INCLUDING BUSINESSES, PROFESSIONALS, AND INDIVIDUALS, FOR PURPOSES INCLUDING COMMERCIAL, TRADE, EDUCATIONAL, AND PERSONAL USE. The data we collect is in the context of providing these Services.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, OUR TOTAL AGGREGATE LIABILITY ARISING FROM OR RELATED TO THE COLLECTION, USE, DISCLOSURE, OR SECURITY OF PERSONAL INFORMATION UNDER THIS POLICY, OR ARISING FROM ANY DATA BREACH, SHALL BE LIMITED TO THE REMEDIES AND COMPENSATION EXPRESSLY PROVIDED FOR UNDER APPLICABLE PRIVACY LAWS (SUCH AS THE PRIVACY ACT 1988 (CTH) IN AUSTRALIA).

IN NO EVENT SHALL WE BE LIABLE FOR ANY INDIRECT, CONSEQUENTIAL, INCIDENTAL, SPECIAL, PUNITIVE, OR EXEMPLARY DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, OR BUSINESS OPPORTUNITY, RELATED TO PRIVACY OR DATA SECURITY, REGARDLESS OF THE THEORY OF LIABILITY (CONTRACT, TORT, OR OTHERWISE) AND EVEN IF WE HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

9. CHANGES TO THIS PRIVACY POLICY

We may update this Policy from time to time. The updated version will be posted on this page with a revised "Last Updated" date. If changes are material, we will provide a more prominent notice, including but not limited to an in-service notification or an email. Your continued use of the Services after the effective date of the revised Policy constitutes your acceptance of the changes, except where further consent is required by law.

10. CONTACT US

For questions, concerns, complaints, or to exercise your data rights, please contact our designated Privacy Officer at:

Web Dance Pty. Ltd

Attn: Privacy Officer

ABN: 50 666 082 079

Address: Sydney, New South Wales, Australia

PRIVACY POLICY OF WEB DANCE PTY. LTD