ioReign privacy policy
This policy explains how McAlpine Cyber and AI Pty Ltd (ACN 701 577 862, ABN 43 701 577 862) handles personal information for ioReign at ioreign.ai. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
"We", "us" and "our" mean that company.
1. Two kinds of information
- Information about you and your people that we collect to run our business. For example, an owner's email. We decide how it is used, and this policy covers it.
- Your content. Your repositories, tickets and audit records may contain personal information, such as commit author names and emails. We handle that only on your instructions, to run the service for you. Our data processing agreement covers it.
2. What we collect, and why
| What | From | Why |
|---|---|---|
| Beta applications: email address and the number of agents you run | You, through the form on ioreign.ai | To consider your application and reply to it. We do not send applicants marketing email during the beta. |
| Owner details: name, email and phone number | You, or us when we set up your account | To create your account, sign you in, and contact you about it. We use the phone number only to call you back and check it is you, if you lose access or ask us to delete your account early. |
| Passkeys: the public key, credential id, authenticator model id (AAGUID), sign-in counter, whether the passkey is backed up, the ways it can connect to your device (for example USB or Bluetooth), the name you give it, and when it was added and last used. Also sign-in records, including sign-in times. | Your device when you register or use a passkey | To sign you in securely, and to let owners see and remove their passkeys. Your fingerprint, face or PIN stays on your device. We never receive it. |
| Agent identities: names and ids you give your agents, and their tokens' metadata | You and your agents | To let your agents act for you, and to count concurrent agents against your plan |
| Audit records: who or which agent did what, and when | Created as you use ioReign | Security, troubleshooting, and your own audit trail |
| Billing ids: your Stripe customer id, subscription status and billing contact | Stripe | To know whether your account is paid. Your card details are held by Stripe, never by us. |
| Legal acceptances: which version of each document your owner accepted, and when | You | To keep a record of our agreement |
| Emails you send to support@, privacy@ or legal@ioreign.ai, and what you tell us in them | You, by email | To help you, answer your request, or deal with a legal notice |
| Security reports sent to security@ioreign.ai: the reporter's email address, name if given, and the report | You, by email | To investigate and fix the problem, and reply to you |
| Technical data, such as IP addresses and request details | Your browser or agents | To deliver the service, stop abuse (for example rate limiting), and fix problems |
We collect only what we need. You don't have to give us your information, but without it we can't consider your application or run your account. You can contact us without giving your name, but we will need an email address to reply.
3. Cookies and bot checks
- The owner console uses two cookies, both needed to sign you in and keep you signed in. Neither is used for tracking.
- A short-lived sign-in cookie is set while you sign in, or while you accept an invite and register your passkey. It expires after 5 minutes and is removed once you are signed in.
- A session cookie keeps you signed in. Your session ends when you sign out, after 30 minutes without activity, or 12 hours after you signed in, whichever comes first.
- The application form uses Cloudflare Turnstile to tell people from bots. Turnstile processes information about your browser and connection to do this.
- We do not use advertising or cross-site tracking cookies.
4. How we use and share it
We use personal information only for the reasons in section 2, or for a related reason you would reasonably expect, or where the law requires or allows it.
We do not sell personal information.
We share it with these service providers, who handle it for us:
| Provider | What they do for us |
|---|---|
| Cloudflare, Inc. | Hosts ioReign and ioreign.ai, stores your data, protects the site from bots (Turnstile), and forwards email to our addresses (Email Routing) |
| Stripe | Takes payments and runs billing. Stripe holds card details and billing records. |
| Google (Google Workspace) | Hosts the staff mailbox that receives email sent to our addresses (support, privacy, legal and security) |
We may also disclose information where the law requires it, for example to a court or regulator.
AI tools. The ioReign product never sends your content to AI model providers. Your agents run on your own systems with your own model keys. Anything they send to a model provider is between you and that provider. We never put email sent to our addresses, or any other personal information this policy covers, into AI tools.
5. Where it is stored, and overseas disclosure (APP 8)
- We ask Cloudflare to store ioReign data in the Asia-Pacific region where possible. Cloudflare does not guarantee a location in Australia, so we do not promise your data stays in Australia.
- Our providers operate globally. Personal information may be stored or accessed in other countries, including the United States, and wherever Cloudflare's network delivers the service to you.
- Before we disclose personal information overseas, we take reasonable steps so the recipient handles it consistently with the APPs. This includes contracts with the providers above.
6. How we protect it
We use security measures that suit a security-focused product, including:
- passkey sign-in with user verification, and no passwords;
- short-lived, scoped tokens for agents, which owners can revoke;
- strict separation between customers' data;
- encryption in transit, and encryption at rest by our hosting provider;
- an audit log of actions in your account;
- staff access only when needed, recorded.
More detail, including what we have not done yet, is on our security page.
7. How long we keep it
| What | How long |
|---|---|
| Beta applications | Up to 12 months, then deleted. Sooner if you ask. |
| Account data (owners and their contact details, passkeys, agent identities), content and audit records | While your account exists. After you cancel, deleted not earlier than 30 days later (the export window), unless a legal or dispute hold applies. If your subscription ends or stays unpaid because a payment failed or was reversed, or ends while a payment is overdue, we first keep your account read-only for 60 days, then the same 30-day process applies (see the beta terms, section 8). |
| Our records of deletions and of staff actions | Kept. They hold only ids and counts, never your content. |
| Billing records | Kept at Stripe after your account is deleted, and in our accounts, for as long as tax and company law require (generally 5 to 7 years) |
| Emails to support@, privacy@ or legal@ioreign.ai | As long as needed to help you, answer your request or deal with the notice, and keep a record, then deleted |
| Security reports | As long as needed to fix the problem and keep a record, then deleted |
| Technical data in our hosting provider's request logs | A few days (up to about 7), then deleted |
After we delete data, some copies and records remain for a time:
- Cloudflare's point-in-time recovery for our databases can restore data from up to about 30 days ago. This covers your account's storage (Durable Objects) and our account directory and site databases (D1 Time Travel). Those copies expire after about 30 days.
- Email sent to our addresses (including security reports) can be recovered from our mailbox provider for about 55 days.
- Request logs at Cloudflare are kept for up to about 7 days.
- Our records of deletions and staff actions are kept. They hold only ids and counts, never your content.
- Stripe's records stay at Stripe under its own rules (see billing records above).
8. Marketing
We do not send marketing email to beta applicants. We use your email address only to reply about your application and, if you join, about your account. Those emails are not marketing. If we ever want to send marketing email, we will update this policy first and send it only to people who have agreed to receive it, with a working unsubscribe link in every message.
9. Access and correction
You can ask for a copy of the personal information we hold about you, or ask us to correct it. Email privacy@ioreign.ai. We aim to respond within 30 days.
We check who you are first. For account data, an email alone is never enough: an owner confirms the request in the console, or we use our account-recovery checks (see section 9 of the terms of service). If we refuse, we tell you why and how to complain.
Owners can see and change much of their information in the console.
10. Data breaches
If a data breach is likely to cause serious harm to anyone, we follow the Notifiable Data Breaches scheme. We assess a suspected breach quickly, and within 30 days. If it is an eligible data breach, we notify the people affected and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Business customers are also notified under the DPA.
11. Complaints
If you have a concern, email privacy@ioreign.ai. We will reply within 30 days.
If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, phone 1300 363 992.
If you are in the European Union or the United Kingdom, you may also have rights under the GDPR, such as objecting to processing or asking for erasure. Email us to use them. We check who you are first, as in section 9. Erasure of your account and content follows section 9 of the terms of service. You can also complain to your local data protection authority.
12. Changes
We may update this policy. We post the new version here with a new date and version number. For an important change, we email account owners first.
Contact
Privacy: privacy@ioreign.ai · Support: support@ioreign.ai · Legal: legal@ioreign.ai
McAlpine Cyber and AI Pty Ltd (ACN 701 577 862, ABN 43 701 577 862), Sydney NSW, Australia
Version 0.1.0, in force from 28 October 2026.