scx.ai logo

Privacy Policy

SCX.ai Holdings Limited · Version 2.0 · Effective July 2026

1. Introduction

1.1 Who we are

SCX.ai Holdings Limited (SCX.ai, we, us, our) is an Australian-headquartered sovereign AI infrastructure provider. We operate secure, region-resident AI inference services and a managed platform on which our customers build, run and scale generative AI workloads. Our registered office is at Unit 404, 22–32 Sutherland Street, Cremorne NSW 2090, Australia.

1.2 Purpose of this Policy

This Privacy Policy explains how SCX.ai collects, holds, uses and discloses personal information when you:

  • use our websites (including scx.ai and platform.scx.ai);
  • interact with our test services, including the public chatbot at chat.scx.ai;
  • consume our AI inference APIs or container deployments; or
  • otherwise deal with us as a customer, prospect, supplier, job applicant or visitor.

It also explains how we handle Customer Content — the prompts, files and other data our customers submit to our AI services — which is the heart of our sovereign AI proposition.

1.3 Compliance

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we operate in other jurisdictions (for example, California or the EU/UK), we apply the equivalent local protections (CCPA/CPRA, GDPR/UK GDPR) to all customers, not only to residents.

2. Our Sovereign AI Proposition

We describe our service as sovereign AI as a service. That means three commitments that this Policy puts into practice:

  • Data location. Customer Content is processed in the customer's chosen inference region (currently California, Sydney, with Germany expected Q2 2026). It does not transit to, or get stored in, a third-country hyperscaler by default.
  • Ownership and jurisdiction. Customer Content remains the customer's property. It is processed under Australian law by default, and is not subject to foreign-government access frameworks (for example, the US CLOUD Act) by virtue of where it is hosted.
  • Model control. SCX.ai runs only open-weights models. We do not train any model on Customer Content without the customer's explicit written instruction, and customers can choose a "no prompt use / no prompt caching" mode for sensitive workloads.

3. What This Policy Covers

This Policy covers two distinct kinds of data, with different rules:

  • Personal Information — information about an identifiable individual, handled under the Privacy Act and the APPs (Part A).
  • Customer Content — the prompts, documents, files and outputs that customers (and their end-users) submit to our AI services. Customer Content may include personal information, but is governed primarily by our customer agreement and the data-handling rules in Part B.

Part A — Personal Information

4. Personal Information We Collect

We collect personal information only where we have a lawful basis. Categories include:

  • Identity & contact: name, role, employer, email, phone, postal address.
  • Account & billing: login identifiers, organisation name, payment details, invoices.
  • Technical: IP address, browser type, device identifiers, cookies, usage logs.
  • Communications: support tickets, email correspondence, recorded calls with consent.
  • Recruitment: CVs, references, work eligibility, right-to-work documents.

5. How We Collect Personal Information

We collect personal information:

  • directly from you (forms, sign-ups, support, recruitment);
  • automatically when you use our websites or platforms (cookies, server logs);
  • from third parties you have authorised (identity verification, payment processors, referees);
  • from publicly available sources.

6. How We Use Personal Information

We use personal information to:

  • provide, secure and improve our services;
  • manage accounts, billing and support;
  • respond to enquiries and communicate with customers;
  • send service messages and (with consent or lawful basis) marketing;
  • detect and prevent fraud, abuse and security incidents;
  • comply with law and enforce our terms.

We do not sell personal information.

Part B — Customer Content (the important part)

7. What Customer Content Is

"Customer Content" means any text, prompt, document, image, audio, file, embedding or output that a customer (or its end-user) submits to, or receives from, our AI services. It does not include account metadata, billing data, or the operational telemetry described in Section 10.

8. How Customer Content Is Handled — by Service Type

We run several services. The rules differ.

8.1 Test Services (chat.scx.ai, public demos on scx.ai)

These are shared, public-facing services intended for evaluation and learning. When you use them:

  • prompts and uploaded files are processed by SCX.ai to generate the response;
  • conversations may be logged for safety, abuse-prevention and product improvement for up to 30 days, after which they are deleted;
  • conversations may be reviewed by a small SCX.ai safety team for the purpose of preventing abuse, illegal use and model-safety incidents;
  • do not submit personal, confidential or commercially sensitive information — these services are not appropriate for it;
  • Customer Content submitted to test services is not used to train any model.

8.2 Platform (platform.scx.ai)

The platform is a logged-in, account-bound workspace used to build, evaluate and operate AI applications on top of SCX.ai inference.

  • Customer Content is stored against the customer's account and visible to the customer's authorised users.
  • by default, Customer Content is not used to train, fine-tune or evaluate any model.
  • by default, prompts and outputs are not retained for caching beyond the request/response cycle.
  • customers can opt in to retention (for example, to keep an evaluation history) and can opt out of telemetry on a per-workspace basis;
  • Customer Content remains the customer's property at all times.

8.3 API Consumption (api.scx.ai) and Container Deployments

This is the highest-assurance path. When you call our inference API or run our container in your own environment:

  • Customer Content is processed in the customer's chosen inference region;
  • Customer Content is processed only for the purpose of generating the response;
  • we offer a "No Prompt Use / No Prompt Caching" mode — in this mode, prompts and outputs are processed in memory, not logged, not cached, and not used for any model-improvement purpose;
  • we do not train any model on Customer Content without the customer's written instruction;
  • container deployments run entirely inside the customer's environment; SCX.ai has no access to Customer Content in that mode.

9. Customer Content — Core Commitments

Regardless of service:

  • Customer Content is never sold;
  • Customer Content is never used to train a third-party model;
  • Customer Content is never shared between customers;
  • Customer Content is processed in the customer's chosen region; cross-region movement occurs only on the customer's instruction;
  • Customer Content is encrypted in transit (TLS 1.3) and at rest (AES-256);
  • API Consumption and Container Deployments: SCX.ai personnel have no access to Customer Content. Prompts and outputs are processed in memory and returned to the customer; SCX.ai does not log, store or otherwise retain them. The customer is the sole custodian of this Customer Content.
  • Platform (platform.scx.ai): SCX.ai personnel have no access to Customer Content by default. Access is granted only when the customer explicitly raises a support request that requires it, and is least-privilege, audited, time-bound, and logged. For account-management purposes, SCX.ai personnel can see account metadata (org name, workspace IDs, plan, billing status) — never Customer Content itself.
  • Test Services (chat.scx.ai, public demos): A small SCX.ai safety team may access conversations for up to 30 days, for the purpose of preventing abuse, illegal use, and model-safety incidents. This access is least-privilege, audited, and logged.
  • on termination, Customer Content is returned to the customer and securely deleted from production systems within 30 days, with backups purged within a further 60 days.

10. Operational Telemetry (not Customer Content)

To run a reliable service, SCX.ai records limited operational telemetry that is not Customer Content:

  • request metadata (timestamp, model ID, region, latency, token counts, status code);
  • account/workspace identifiers;
  • rate-limit, abuse and security signals.

We use this telemetry for billing, capacity planning, security and reliability. We do not use it to reconstruct Customer Content.

Part C — Rights, Security, Contact

11. Your Rights

You have the right to:

  • Access the personal information we hold about you;
  • Correction of personal information that is inaccurate, incomplete or out of date;
  • Deletion of personal information, subject to legal retention obligations;
  • Opt out of marketing communications at any time;
  • Complain to us, and to the OAIC (or your local regulator) if you are not satisfied with our response.

Customers also have the contractual right to export, delete and restrict processing of their Customer Content at any time via the platform or by written request.

12. Cookies and Analytics

Our websites use cookies for functionality, preferences and analytics. We use privacy-respecting analytics. You can manage cookies through your browser settings. We do not use advertising cookies on scx.ai.

13. International Disclosures

Customer Content is not transferred outside the customer's chosen inference region except on the customer's instruction. For personal information held by SCX.ai Holdings Limited (Australia), we may use service providers in Australia, the United States and the European Economic Area, and we take reasonable steps to ensure they meet APP-equivalent standards.

14. Security

We protect personal information and Customer Content through:

  • ISO 27001-aligned controls (certification phase two in progress, expected Q3 2026);
  • SOC 2 Type II (expected Q3 2026);
  • encryption in transit and at rest;
  • role-based access, MFA and audit logging;
  • penetration testing and continuous vulnerability management;
  • IRAP assessment for Australian-government customers;
  • staff training and background checks.

We have data-breach response procedures aligned with the Notifiable Data Breaches scheme.

15. Retention

  • Customer Content: per Section 8 (service-specific) and the customer agreement.
  • Account & billing records: 7 years (Australian law).
  • Operational telemetry: up to 24 months, aggregated thereafter.
  • Recruitment records: 12 months from the close of the application, unless the candidate is hired.

16. Children

Our services are not directed to children under 16, and we do not knowingly collect personal information from children.

17. Changes to this Policy

We may update this Policy. The current version is always available at scx.ai/privacy. Material changes will be notified to account holders by email and, where required by law, by in-product notice.

18. Contact Us

18.1 Privacy Officer

For privacy enquiries, complaints, or to exercise your rights:

Email: [email protected]

Address: Unit 404, 22–32 Sutherland Street, Cremorne NSW 2090, Australia

Phone: +61 2 8006 0111

18.2 Supervisory Authorities

If you are not satisfied with our response, you may complain to:

  • Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au · 1300 363 992
  • or your local data protection authority (for example, the UK ICO or an EU supervisory authority).

Approved by the Board of Directors.

Privacy Policy - SCX.ai