Privacy Policy

Dryv Technology Pty Ltd ("Dryv Technology", "we", "us", or "our") operates Riskify, an AI-assisted psychosocial risk compliance platform available at riskify.app (the "Service"). This Privacy Policy explains what personal information we collect, how we use and protect it, who we share it with, and the choices and rights available to you.

We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth), as a matter of good practice, even in respect of activity that may fall outside the Act's strict application to our business. If you are an individual in another jurisdiction with its own privacy law, nothing in this policy limits rights you may separately hold under that law.

Riskify is currently offered as a limited pilot program to approved organisations. This policy applies equally during the pilot and to any future general-availability version of the Service.

1. Who this policy covers

This policy applies to three broad groups of people:

• Customer organisations and their users— the businesses ("tenants") that sign up to use Riskify, and the people within them (executives, officers, HR managers, WHS/safety managers, team leaders, employees, and other workers) who are invited to use it.
• Visitors to riskify.app — people who browse our marketing site, join our waitlist, or use our website chat assistant, whether or not they go on to become a customer.
• Workers who are the subject of records created by a customer — for example, a worker named in an incident report, or a worker invited to complete an anonymous survey, even if that worker never creates a Riskify account themselves.

For data a customer organisation enters about its own workers (such as incident reports, risk register entries, or survey invitations), the customer organisation is responsible for giving its workers appropriate notice of how their information will be used, consistent with the customer's own obligations under applicable privacy and workplace law. We process that information on the customer's instructions, as described in this policy and in our Terms of Service.

2. Information we collect

Account and identity information

When you or your organisation sign up, we collect your name, work email address, and authentication details. Sign-in and account security are handled by our authentication provider, Clerk; we do not store your password ourselves.

Organisation information

Organisation name, industry, size, operating jurisdictions, sites, departments, teams, and the roles assigned to each user within the organisation.

Risk register, controls, and compliance records

Psychosocial risk entries, hazard types, risk ratings, control measures, action plans, consultation records, worker briefing logs and acknowledgements, and board/officer reports — however that content was created (manual entry, document upload and extraction, or the AI-guided walkthrough).

Incident and concern reports

Details submitted through incident or concern reporting, including description, hazard type, severity, people involved (where volunteered), and resolution notes. Some incident reports can be marked as anonymous or given restricted visibility by the reporter or an administrator; we honour those settings in how the record is stored and who can access it within the organisation.

Anonymous survey responses

Where a customer runs an anonymous survey through Riskify, individual response content is never linked to the identity of the person who submitted it — not even for us, and not even for an administrator within the customer organisation. See section 6 below for more detail on how this is enforced.

Evidence and documents

Files uploaded as supporting evidence (for example, policy documents, training records, or an existing risk register uploaded for extraction into Riskify).

AI conversation content

Messages exchanged with Riskify's AI Copilot or guided intake flows (for example, when describing an incident, building a risk register entry conversationally, or chatting with the website assistant). This may include sensitive descriptions of workplace events. See section 5 below for how this is processed.

Communications and support

Emails, support requests, and any other correspondence you send us.

Waitlist and marketing enquiries

Name and email address submitted through our waitlist form or marketing chat widget.

Technical and usage information

Standard web and application log data (IP address, browser/device information, pages viewed, timestamps, and error diagnostics) collected automatically as part of operating the Service securely and reliably.

Cookies

We use only strictly necessary cookies: session cookies set by our authentication provider (Clerk) to keep you signed in, and a cookie set by Cloudflare Turnstile to distinguish genuine visitors from bots on public forms. We do not currently use advertising or third-party analytics cookies.

3. How we use information

• To provide, maintain, and secure the Service, including authenticating users and enforcing role-based access controls.
• To generate AI-assisted drafts, suggestions, and summaries (risk drafts, incident triage notes, report summaries) — always subject to human review before anything becomes a final record.
• To send operational notifications (for example, that an uploaded document has finished processing, a control measure is overdue, or you have been invited to a survey or consultation).
• To respond to support requests and other correspondence.
• To maintain the audit log and other records required for the integrity and defensibility of compliance records.
• To detect, investigate, and prevent security incidents, fraud, and misuse of the Service.
• To improve the Service, using de-identified or aggregated information wherever practical.
• To follow up with waitlist and marketing enquiries about Riskify.
• To comply with our legal obligations.

We do not sell personal information, and we do not use customer compliance data (risk, incident, survey, or evidence content) to train our own machine learning models.

4. AI processing

Certain features send relevant content to a third-party AI provider (Anthropic) to generate a response — for example, drafting a risk entry from a conversation, summarising an incident for a reviewer, or extracting structured data from an uploaded document. Only the content needed to perform that specific task is sent. Our agreement with our AI provider governs its use of that content; our AI provider does not use data submitted through its commercial API to train its models.

AI output is always a draft or recommendation. Consistent with Riskify's design, a human reviewer must approve any AI-drafted risk, incident, or report before it becomes part of the official record — nothing an AI feature produces is treated as final without that review.

5. Our commitment on anonymous surveys

Where a survey is configured as anonymous, Riskify is built so that response content is stored without any link to the respondent's identity. We separately track who has completed a survey (so reminders can be sent and participation measured) but that completion record is kept apart from the response content itself and cannot be used to re-identify a particular answer. This separation is a deliberate design rule of the platform, not a configuration option that can be turned off by a customer administrator.

6. Sensitive and restricted incident data

Incident and concern reports can touch on sensitive matters — including allegations involving a manager or executive, or circumstances the reporter marks as restricted. Riskify supports restricted visibility settings that limit which roles within an organisation can view a given record, and we do not override those settings except where necessary to operate or secure the Service, or where required by law.

7. Who we share information with

We share information only as needed to provide the Service, and never sell it. We use the following categories of service providers (subprocessors):

We may also disclose information where required by law, to protect the rights, safety, or property of Dryv Technology, our customers, or others, or in connection with a merger, acquisition, or sale of business assets (subject to the acquiring party continuing to honour this policy).

8. Overseas disclosure

Our primary database is hosted in Australia. Some service providers listed above operate in, or transfer data to, the United States as part of delivering their service to us. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including by relying on providers with established enterprise-grade data protection commitments.

9. Data security

We apply technical and organisational safeguards appropriate to the sensitivity of the information involved, including encryption of data in transit and at rest, role-based access control enforced at the server, restricted-visibility support for sensitive incident records, and audit logging of meaningful changes to compliance records. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Data retention

We retain personal information for as long as needed to provide the Service to the relevant customer organisation, plus any additional period required to support the defensibility of compliance records, to meet legal or regulatory retention obligations, or to resolve disputes. When a customer's account is closed, we will delete or de-identify personal information within a reasonable period, except where we are required or permitted by law to retain it for longer.

11. Your rights

Subject to applicable law, you may ask us to:

• access the personal information we hold about you;
• correct inaccurate or out-of-date personal information;
• delete personal information we no longer need to retain; and
• explain how a particular piece of your personal information has been used or disclosed.

If you are a worker at a customer organisation (rather than a direct account holder), the fastest path for most requests is usually through your organisation's administrator, since they control most records about you. You can also contact us directly at the email below and we will coordinate with the relevant customer where needed.

If you believe we have not handled your personal information in accordance with this policy or the Australian Privacy Principles, you can lodge a complaint with us at the contact below, or with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Children

Riskify is a workplace compliance tool intended for use by organisations and their adult workers. We do not knowingly collect personal information from children, and the Service is not directed at them.

13. Changes to this policy

We may update this policy from time to time as the Service evolves. We will update the "Last updated" date above, and where a change is material, we will take reasonable steps to notify customer administrators directly.

14. Contact us

Questions, requests, or complaints about this policy or our handling of personal information can be directed to steve@riskify.app.