Privacy Policy

Last updated 14 September 2026 · Governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles

Attestor is operated by Jason Decaux trading as Indrevo (ABN 21 979 134 918), New South Wales, Australia ("we", "us"). This policy explains how we handle personal information across attestor.online and the Attestor application.

1. What we collect

• Account information — name, work email, firm or agency, professional verification details you provide.
• Exhibit files — media you upload for examination, together with the metadata those files contain.
• Custody and usage records — cryptographic hashes, timestamps and action logs generated during examinations, and standard technical logs (IP address, browser type) needed to run and secure the service.
• Billing information — handled by Stripe. We never receive or store full card numbers.

2. How we use it

To provide examinations and reports, verify professional standing, maintain chain-of-custody integrity, process payments, provide support, and meet legal obligations. We do not sell personal information, and we do not use your exhibit files to train models.

3. Exhibit files are different

We treat uploaded media as potentially sensitive legal material. Exhibits are encrypted at rest (AES-256-GCM), access is restricted to your account, and analysis is automated. Staff access occurs only for support you request or where the law requires it.

4. Disclosure

We disclose personal information only to service providers necessary to operate Attestor (hosting, payments via Stripe, email), where you direct us to, or where required by law. Some providers process data outside Australia; where they do, we take reasonable steps consistent with APP 8.

5. Retention and deletion

You may delete individual exhibits, or your entire account, from within the application at any time. Deletion is permanent. We retain the minimal custody-log entries (hashes and timestamps, not media) needed to preserve the integrity of previously issued reports, and billing records we are legally required to keep.

6. Security

Encryption in transit (TLS) and at rest, hashed credentials, least-privilege access, and audit logging. No system is perfectly secure; in the event of an eligible data breach we will comply with the Notifiable Data Breaches scheme.

7. Access, correction and complaints

You may request access to or correction of your personal information, or raise a complaint, at admin@attestor.online. If unresolved, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

8. Your rights by region

Attestor serves professional users worldwide. Wherever you are, you can access, export, correct and permanently delete your data from inside the application. In addition:

• EU / EEA (GDPR) and UK (UK GDPR & DPA 2018). Our legal bases are performance of contract (providing examinations), legitimate interests (securing the service, maintaining custody integrity) and consent where sought. You have rights of access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20 — use "Download my data" in the app) and objection (21), and may lodge a complaint with your supervisory authority or the UK ICO. Where personal data is transferred outside the EEA/UK, we rely on adequacy decisions or Standard Contractual Clauses with our processors. We notify the relevant authority of eligible breaches within 72 hours.
• United States (incl. CCPA/CPRA — California, and comparable state laws in CO, CT, VA, UT and others). You have the right to know, access, correct and delete personal information. We do not sell or share personal information as defined by the CCPA/CPRA and have not done so in the preceding 12 months; no "Do Not Sell or Share" opt-out is required because no sale or sharing occurs. We do not use personal information for cross-context behavioural advertising.
• Canada (PIPEDA). We collect and use personal information with meaningful consent and only for the purposes stated in this policy. You may access and correct your information, and complain to the Office of the Privacy Commissioner of Canada. Our commercial electronic messages comply with CASL (consent, identification, unsubscribe).
• New Zealand (Privacy Act 2020). We apply the Information Privacy Principles equivalently to the Australian APPs above; you may complain to the Office of the Privacy Commissioner (NZ).

9. Eligibility and children

Attestor is a professional tool for adults. It is offered only to users aged 18 or over acting in a professional capacity, and registration requires confirming this. We do not knowingly collect personal information from children, and the service is not directed at them.

10. Data retention

Account data is retained while your account is active. Exhibits are retained until you delete them or your account. On deletion we retain only hash-and-timestamp custody stubs (which contain no media and no personal content) to keep previously issued reports verifiable, plus billing records required by tax law.