Privacy Policy & Automated Decision-Making Statement
This policy describes how LA MODA VENTURES PTY LTD (ABN: 41 633 197 216) trading as AI-IN-A-BOX and The AIBulletin collects, uses, discloses, and manages personal information.
Statutory Alignment
APPs 1–13
Privacy Act 1988 (Cth)
International
EU GDPR
& US State Privacy Baselines
Effective Date
10 December 2026
Version 1.0
Section 1
Categories of Personal Information We Collect
LA MODA VENTURES PTY LTD collects and holds the following categories of personal information to provide the AI-IN-A-BOX platform and The AIBulletin:
Standard Identifiers & Operational Data
- Full name and business email address
- Organisation name and user role within the organisation
- AIBulletin newsletter subscriber email addresses
- IP addresses and platform telemetry (session identifiers, page interactions)
- Audit log records of actions performed within the platform
- AI assessment records, risk register entries, and compliance documentation authored by the user
Sensitive Information — Explicit Exclusion
AI-IN-A-BOX does not collect, process, or hold sensitive information (as defined in the Privacy Act 1988) including health information, racial or ethnic origin data, biometric data, religious beliefs, criminal record information, or genetic information, for its own operational purposes.
Billing & Payment Data
Credit card numbers, CVV codes, banking credentials, and cardholder data are processed exclusively by Block, Inc. / Square AU Pty Ltd under their PCI DSS infrastructure. AI-IN-A-BOX does not collect, store, or process payment card data.
Section 2
APP 1.7–1.9 Automated Decision-Making (ADM) Transparency Schedule
In compliance with APPs 1.7–1.9 of the Privacy Act 1988 (as amended by the Privacy and Other Legislation Amendment Act 2024, commencing 10 December 2026), we disclose the following automated systems that make decisions that are substantially and directly related to individuals:
| System ID | Description | ADM Type | Personal Information Used | Human Oversight |
|---|---|---|---|---|
| SYS-SEC-01 | Security & Abuse Filter — Rate-limits or blocks IP addresses and sessions exhibiting attack patterns | Solely Automated (APP 1.8(b)) | IP address, session telemetry, request rate signals | Automated; security team review available on escalation |
| SYS-AIAF-26 | NSW AIAF Scoring Engine — Calculates P-counts, risk bands, and oversight tiers for AI Assessment Framework submissions | Substantially & Directly Related (APP 1.8(c)) | Named officer emails and roles as submitted to the platform by the subscribing agency | Mandatory human review by accountable officer before finalisation |
| SYS-APRA-230 | Vendor CPS 230 Engine — Evaluates supplier metrics to inform third-party criticality ratings | Substantially & Directly Related (APP 1.8(c)) | Vendor contact names, roles, and supplied assessment data | Mandatory human review by risk officer before ratings are recorded |
| SYS-LLM-04 | Glass-Box Policy Copilot & Sovereign Concierge AI Assistant — LLM-powered assistant that synthesises draft compliance documentation and provides interactive compliance advisory from user-provided context | Substantially & Directly Related (APP 1.8(c)) | User-provided organisational context, conversational interaction queries (processed in transient memory with zero model re-training), role, and assessment inputs submitted by the user | Mandatory human review; all outputs are drafts requiring approval |
Commercial-in-Confidence Carve-Out
Internal model weights, scoring algorithm parameters, source code, proprietary logic, and trade secrets underpinning these systems are excluded from this disclosure as commercial-in-confidence information under APP 1.9. Sufficient functional descriptions are provided above to satisfy the transparency requirements of APP 1.7–1.8 without disclosing proprietary intellectual property.
Section 3
Data Hosting, Cross-Border Disclosures & Security (APP 1.4(f), APP 8 & GDPR)
Platform data is hosted primarily in the following enterprise infrastructure:
Relational Database
Neon Serverless PostgreSQL
AWS US-East (us-east-1) · AES-256 encrypted
Object & File Storage
DigitalOcean Spaces
Sydney, Australia (syd1) · Local data residency
Application & CDN
Vercel Global Edge Network
Edge compute with Sydney (SYD1) routing
Email Infrastructure
Brevo SMTP Relay
Automated governance alerts & purge notices
Payment Processing
Block, Inc. / Square AU Pty Ltd
PCI-DSS Level 1 Certified Subscription Gateway
Where personal information is transferred or processed internationally (including to Neon Serverless PostgreSQL in AWS us-east-1 or Vercel edge routing nodes), such transfers are safeguarded by Standard Contractual Clauses (SCCs), robust Data Processing Addenda (DPAs), and end-to-end encryption using TLS 1.3 in transit and AES-256 at rest, in strict accordance with Australian Privacy Principle 8.1 (APP 8.1) and GDPR Chapter V. We mandate that all overseas recipients provide privacy protections equivalent to the Australian Privacy Principles.
Section 4
National AI Centre (NAIC) — 6 Essential Practices
AI-IN-A-BOX publicly commits to the following summary of adherence to the NAIC 6 Essential Practices for Responsible AI:
Accountability
LA MODA VENTURES PTY LTD maintains named accountability officers for AI system governance and publishes this ADM statement.
Assess Impacts
Each AI system listed in this statement is subject to an impact assessment prior to deployment, with documented human oversight requirements.
Risk Management
Risk registers are maintained per system. The AIAF scoring engine (SYS-AIAF-26) embeds risk band outputs directly into the platform for user review.
Transparency
This ADM disclosure, the Terms of Service, and all scoring methodology documentation are publicly accessible to users and regulators.
Test & Monitor
All AI systems undergo pre-deployment validation. Platform behaviour is monitored via audit logs, and anomaly alerts are reviewed by the security team.
Human Control
All substantially-related ADM outputs require mandatory human review before action. No binding decisions affecting individuals are made without human approval.
Section 5
Individual Rights — Access, Correction & Deletion
Under APPs 12 and 13 of the Privacy Act 1988 and equivalent GDPR rights, you may request:
- Access to all personal information we hold about you (available via self-service data export at
/api/user/data-export) - Correction of inaccurate or out-of-date personal information
- Deletion or destruction of your personal information (subject to the 30-day archival grace period under APP 11.2)
- A statement of the purposes for which we use your personal information
We will respond to privacy requests within 30 days of receipt.
© 2026 LA MODA VENTURES PTY LTD (ABN: 41 633 197 216) t/a AI-IN-A-BOX. All rights reserved.