This policy explains how Cognitive Industries collects, uses, stores, and discloses your personal information. It applies to all our products and services, including ChazzAI, Lucky 100 Board, WebSwarm, Adtomaton, and MatchPoints.
Note: This policy is written to comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Privacy and Other Legislation Amendment Act 2024, the EU General Data Protection Regulation (GDPR), and the California Consumer Privacy Act (CCPA). If you have questions, email us at privacy@cognitive-industries.org.
Cognitive Industries ("we", "us", "our") is an Australian technology company operating at cognitive-industries.org. We build AI-powered products and research tools.
For the purposes of the Australian Privacy Act 1988 (Cth), Cognitive Industries is the entity responsible for your personal information. For the purposes of the GDPR, we act as a data controller for personal information collected from users in the European Economic Area (EEA).
Contact: privacy@cognitive-industries.org
Sensitive Information: Some of our products (particularly ChazzAI) may incidentally involve sensitive information as defined under the Privacy Act (e.g., content relating to health, sexuality, or beliefs). We do not deliberately solicit sensitive information and we apply higher protections to any such data we hold, consistent with APP 3 and Article 9 GDPR.
We do not sell your personal information to third parties.
If you are located in the EEA, Switzerland, or the UK, we rely on the following legal bases under Article 6 GDPR:
Where we process special category data (Article 9), we rely on your explicit consent or, where applicable, substantial public interest grounds.
We share personal information only where necessary:
Stated because the absence is the point, and because "we may share with our partners" is how most policies avoid saying it:
We may disclose your information to law enforcement, regulators, or other parties where we are required to do so by law, court order, or where we reasonably believe disclosure is necessary to protect the safety of any person or to prevent fraud or illegal activity.
If Cognitive Industries is acquired, merged, or sells substantially all its assets, your information may be transferred to the acquiring entity. We will notify you via email or a prominent notice on our website before such a transfer occurs, and you will have the opportunity to object.
We do not sell, rent, or trade your personal information.
Cognitive Industries is based in Australia. When we transfer personal information outside Australia, we comply with APP 8 of the Australian Privacy Principles and take reasonable steps to make sure the overseas recipient handles the information in a manner consistent with the APPs.
For transfers of personal information of EEA residents outside the EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards. Australia does not currently hold an EU adequacy decision.
Our primary third-party processors (Cloudflare, Stripe) operate under their own SCCs and data processing agreements. Copies are available on request.
EU Representative: Cognitive Industries does not yet have a formally appointed EU representative under Article 27 GDPR. If you are an EEA resident and wish to raise a data protection matter, please contact us directly at privacy@cognitive-industries.org. We are taking steps to appoint an EU representative and will update this policy when that appointment is made.
The per-record-type retention schedule (contact messages, recruitment applications, bounty submissions, analytics events, edge and security logs and account records) is published in full on the data access and deletion page, alongside the process for having any of it removed. It is enforced in code by a scheduled job, not by anyone remembering to run a query.
We retain personal information for as long as is necessary to provide our services, meet legal obligations, resolve disputes, and enforce our agreements. Specific retention periods:
You may request deletion of your account and associated personal information at any time (see Section 9). Some data may be retained beyond deletion where required by law.
How to exercise any of them: email privacy@cognitive-industries.org from the address the data relates to. We acknowledge within five business days and complete the request within thirty days, at no cost. The full process, the verification we ask for, and the complaint path if you are not satisfied are on the data access and deletion page.
To exercise any of these rights, email us at privacy@cognitive-industries.org. We will respond within 30 days (or 45 days for GDPR requests where an extension is reasonably required, with notice). We may need to verify your identity before processing requests.
Our services are not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at privacy@cognitive-industries.org and we will delete it promptly.
ChazzAI: The general platform requires users to be at least 13 years of age. Access to adult or explicit content within ChazzAI requires users to be 18 years or older. We implement age assurance measures consistent with the Australian Online Safety Act 2021 (Cth) and the Online Safety (Mandatory Age Assurance for Social Media Services) Act 2024. From 9 March 2026, we are subject to applicable Online Safety Codes relating to age assurance for restricted content.
Users under the applicable minimum age must not create accounts or use our services. If we discover an underage account, we will terminate it and delete associated data.
The full, itemised list of everything this website stores in your browser (every key, what it is for and how long it lasts) is on the cookie policy. In summary:
The script is public and readable. It records the page you viewed, the hostname of the site you arrived from, any campaign parameters in the URL, a coarse device class (mobile, tablet, desktop), your browser language, page performance timings, and whether an interaction such as a form submit or an outbound click occurred. Your address is hashed with a salt that rotates daily, so it can be counted as distinct within one day and cannot be correlated across days or recovered from a copy of our database.
It deliberately does not record: the values you type into any form, the full URL you arrived from, your precise location, or any device fingerprint. We do not read canvas, audio, font lists or WebGL parameters.
The analytics honour Do Not Track and Global Privacy
Control: if your browser sends either signal, nothing is collected and no
identifier is written. You can also opt out for a single browser by setting
ci_consent to deny in localStorage, or by clearing site data.
The site ships a loader capable of running Meta, Google Analytics, Google Ads, TikTok, LinkedIn, Reddit and X tags. It is dormant and no identifier is configured, so none of them loads and no request is made to any of those domains. If that ever changes we will update this policy and the cookie policy first, load the tags only after consent, and record the change on the public changelog.
You may also manage cookies through your browser settings. Blocking certain cookies may affect functionality. Where required by law, we obtain consent before placing any non-essential cookie.
We may use automated processes in our services, including:
In accordance with the Privacy and Other Legislation Amendment Act 2024 (Cth), where we make a decision that significantly affects you using solely automated means, we will disclose this to you and, where legally required from December 2026 onwards, provide you with information about the logic involved and the right to seek human review of that decision.
Under GDPR Article 22, EEA residents have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects, except where necessary for a contract, authorised by law, or based on explicit consent. To request human review of an automated decision, contact us at privacy@cognitive-industries.org.
We implement reasonable technical and organisational security measures to protect your personal information, including:
No security measure is perfect. In the event of a data breach that is likely to result in serious harm to you, we will notify you and the relevant regulator (the OAIC and, where applicable, EU supervisory authorities within 72 hours) as required by law.
The Privacy and Other Legislation Amendment Act 2024 (Cth) introduced a statutory tort for serious invasions of privacy, which commenced on 10 June 2025. This provides individuals in Australia with a right to bring a civil action for serious invasions of privacy. The tort covers two things: intrusion upon seclusion, such as surveilling a private act or intercepting private communications, and misuse of personal information, meaning collecting, using or disclosing it in a way that breaches a reasonable expectation of privacy. To succeed, a claimant has to show the invasion was serious and that their privacy interest outweighs any countervailing public interest. Remedies include damages, injunctions and apology orders. If you believe we have seriously invaded your privacy, you may:
We may update this Privacy Policy from time to time. We will notify you of material changes by:
Your continued use of our services after a policy update constitutes acceptance of the updated policy. Where required by law, we will seek your express consent for material changes.
For any privacy-related questions, requests, or concerns:
If you are not satisfied with our response to a privacy complaint, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
EEA residents may lodge a complaint with their local data protection supervisory authority. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.
Disclaimer: This Privacy Policy has been prepared in good faith to comply with applicable Australian and international privacy laws. It does not constitute legal advice. Cognitive Industries recommends that users with specific legal concerns seek independent legal advice.