Athena Beta

Privacy Notice & APP Collection Statement

How Polstar Holdings Pty Ltd, trading as Aristos AI, collects, holds, uses and discloses personal information in connection with the Athena beta — including the disclosures we make to recipients outside Australia.

Version 0.1 (draft) Effective 5 August 2026 Applies to the Athena evaluation beta

Polstar Holdings Pty Ltd T/A Aristos AI ("Aristos", "we", "us") is bound by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) (Privacy Act). We understand the importance of, and are committed to, protecting personal information — that is, information or an opinion, whether true or not, about an identified individual, or an individual who is reasonably identifiable. This notice explains how we manage personal information in the Athena beta, including our obligations and your rights in respect of our dealings with personal information.

Please take a moment to read it. It is a notice specific to the Athena beta and it sits alongside — and, for the beta, prevails over — the general Aristos privacy policy published on our store website.

Before you read on

Personal information you put into the Athena beta will be disclosed to recipients outside Australia — specifically in the Czech Republic (European Union) and the United States. Section 8 of this notice sets that out in detail as required by APP 8 and APP 5.

For that reason, the beta is not to be used for personal information about other people, or for sensitive information, classified information, or OFFICIAL: Sensitive or PROTECTED material. See Beta Participation Terms, clause 5.

1. How we collect your personal information

We will collect and hold personal information in a fair and lawful manner, and not in an intrusive way. Where it is reasonably practicable to do so, we will collect your personal information directly from you. In connection with the Athena beta we may collect personal information:

when you are invited to, register for, or are provisioned an account in the beta;
when you sign in and use Athena — including the content of your prompts, conversations, uploaded files, voice recordings and generated outputs;
automatically, through server and application logs generated when you use the service;
when you contact us by email or through the product to ask a question, give feedback or report a problem;
from your agency or organisation, where it nominates you as a beta participant;
from Stripe, our payment processor, in connection with any credit top-up you make;
as otherwise required to administer the beta and manage our business.

In limited cases we may collect personal information from third parties, such as your agency or organisation, or our service providers. If we receive personal information about you that we did not solicit and did not need, we will deal with it in accordance with APP 4.

2. Types of personal information we collect

The personal information we collect in the Athena beta can include:

Identity and account information — your name, work email address, role, agency or organisation, account role (for example admin or user), and a hashed password.
Content you submit — the text of your prompts and conversations, files and images you upload, canvas and workspace documents, voice audio you record or dictate, meeting and audio recordings you upload, transcripts of those recordings, and speaker labels.
Content Athena generates for you — model responses, summaries, generated images and synthesised speech.
Usage and technical information — timestamps, IP address, browser and device information, model and provider selected, token counts and usage metering, feature usage, error and diagnostic logs, and security events such as rate-limit hits and prompt-injection detections.
Feedback — the content of feedback, ratings and bug reports you give us.
Billing information — transaction records and receipts relating to credit top-ups. Card numbers are entered directly with Stripe and are not held by Aristos.

Where you do not wish to provide us with your personal information, we may not be able to provide you with access to the beta.

Sensitive information

We do not seek and do not consent to receive sensitive information (as defined in section 6 of the Privacy Act) through the Athena beta. Please do not enter it. If you do, it will be processed and transferred in the same way as any other content you submit, including offshore.

3. Our purposes for handling your personal information

As a general rule, we only process personal information for purposes that would be considered relevant and reasonable in the circumstances. We collect, hold, use and disclose personal information in the Athena beta to:

create and administer your beta account and authenticate you;
provide the beta's functionality — including generating model responses, transcribing and summarising recordings, synthesising speech, and generating images;
store your conversations, files and recordings so you can return to them;
meter and account for usage, and process credit top-ups;
maintain the security and integrity of the service, including detecting and investigating misuse, prompt-injection attempts and suspected security incidents;
diagnose faults, and improve the reliability, usability and safety of Athena;
communicate with you about the beta, respond to your enquiries and act on your feedback;
comply with our legal and regulatory obligations;
otherwise manage and improve our business.

We will not use or disclose personal information for any other purpose unless the Privacy Act permits it, or you have consented to that use or disclosure.

We do not use the content you submit to the beta to train or fine-tune foundation models, and we do not sell it. Whether our third-party model providers do so is governed by their own terms and data-processing terms; where a subprocessor handles personal information for us, our engagement documents obligations of privacy and data security no less strict than those we commit to ourselves. See the Data Flows & Subprocessor Register for what each recipient gets.

4. Direct marketing

We will not use your beta account details to send you direct marketing unless you have consented or it is otherwise permitted by APP 7. You can opt out of any marketing communication at any time by writing to support@aristosai.com, and we will action it.

5. Anonymity and pseudonymity

Because the beta is offered to a named, invited cohort and access must be controlled, we generally cannot provide it to you anonymously or pseudonymously. You may contact us about this notice anonymously, although that may limit our ability to respond fully.

6. Who we disclose personal information to

We may disclose personal information collected in the Athena beta to:

our personnel — the small number of Aristos people who need access to operate and support the beta (see Data Handling Commitments);
our service providers and subprocessors — including the operators of the virtual private server, the Prague GPU infrastructure used for model inference, voice and image generation, Frontier Access for frontier models, and Stripe for payments. Each is listed, with its jurisdiction and the data it receives, in the Data Flows & Subprocessor Register;
your agency or organisation, where it has nominated you as a participant and where disclosure is reasonably necessary for the beta or required in connection with a security incident;
professional advisers, such as our lawyers and accountants, where necessary;
regulators, courts and law enforcement, where required or authorised by law, including the Office of the Australian Information Commissioner (OAIC) in connection with an eligible data breach.

7. Protection of personal information

We hold personal information electronically on servers and services operated by us and by our third-party providers, and in some cases as records on third-party servers or in cloud storage facilities operated by those providers.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include restricting access to personal information to only those people who need it to do their job, requiring authenticated access to the application, and logging security-relevant events.

Be realistic about the beta's security posture

Athena is a pre-release sandbox. We are not in a position to make detailed security assurances about it, and we will not pretend otherwise:

Aristos holds no IRAP assessment, ISO/IEC 27001 certification, SOC 2 attestation or equivalent, and claims no alignment with those frameworks.
Controls that are in place and verifiable in the running system: Argon2id password hashing; WebAuthn passkeys; individually revocable server-side sessions; account lockout after 5 failed attempts; TLS in transit (browser to application) and WireGuard encryption (application to GPU); full-disk encryption at rest on both servers; HSTS, CSP with per-request nonces, CSRF tokens and an SSRF guard; prompt-injection defences with blocked-attempt logging; a client-side PI redaction engine on third-party model requests; daily backups on the VPS; and an append-only audit log of administrative actions. Controls that are not in place: intrusion detection, centralised log aggregation, automated alerting, and any formal personnel-vetting or access-review cadence beyond the two co-founders.
The virtual private server holding the application and database is a Contabo VPS in Sydney, Australia. Contabo GmbH is a German company; the physical server and all data on it remain in Sydney.

No method of transmission or storage over the internet is completely secure. You should not submit information to the beta that you could not tolerate being exposed.

8. Cross-border disclosure — Australian Privacy Principle 8

APP 8 — this is the section to read carefully

Personal information you enter into the Athena beta is disclosed overseas

In operating the Athena beta, Aristos discloses personal information to recipients located outside Australia. The countries in which those overseas recipients are located are:

The Czech Republic (Czechia), European Union — where the GPU infrastructure used for model inference, speech-to-text transcription, text-to-speech synthesis, meeting-recording transcription and summarisation, and image generation is physically located (Prague). It is reached over a private Tailscale network.
The United States of America — where Frontier Access, the service we use to reach frontier and fallback models, and Stripe, our payment processor, operate and route requests.
Other jurisdictions — Frontier Access routes requests to third-party model providers, which may be located in countries other than the United States. The specific set of countries depends on which model you select and on Frontier Access's routing at the time. Providers reachable through Frontier Access include OpenAI, Anthropic, Google and similar; the specific set enabled for any beta cohort is configured per deployment and disclosed to participants before use.
The location of the virtual private server holding the Athena application and its SQLite database — which holds your account, conversations, uploads and recordings — is a Contabo VPS in Sydney, Australia. Contabo GmbH is a German company; the physical server and all data on it remain in Sydney.

8.1 What is disclosed overseas

The personal information that may be disclosed to those overseas recipients includes:

the content of your prompts and conversations, including any personal information contained in them and any conversation history sent as context;
the content of files and images you attach to a request;
your voice audio, and text you ask Athena to read aloud;
meeting and audio recordings you upload, in full, together with their transcripts, speaker labels and generated summaries;
image generation prompts and any reference images;
billing and transaction information disclosed to Stripe.

Recordings always go offshore

Meeting and audio recordings you upload to Athena are always transcribed and summarised on the Prague GPU in the Czech Republic, regardless of which chat model or provider you have selected. There is no configuration in the beta that keeps a recording, its transcript or its summary within Australia. If a recording contains the voice or personal information of any individual, that information will be disclosed overseas. Do not upload recordings of individuals who have not been informed of, and are not able to accept, that disclosure.

8.2 Why we disclose overseas

LLM inference, transcription, speech synthesis and image generation require GPU compute that we do not currently have available in Australia. The GPU sandbox in Prague is a temporary arrangement adopted because suitable Australian GPU infrastructure is not yet available to us. Migrating this compute to Australia is on our roadmap; it has not happened, and we make no present-tense claim that it has. See current state versus target state.

8.3 Aristos remains accountable

Under APP 8.1 and section 16C of the Privacy Act, where we disclose personal information to an overseas recipient, we remain accountable for that information. In broad terms:

we must take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to the information; and
if an overseas recipient handles the information in a way that would breach the APPs had the APPs applied to it, that act or practice is taken to be a breach by Aristos and we are accountable for it under Australian law, notwithstanding that the recipient is outside Australia.

You do not lose your Australian privacy rights because your information is processed overseas. You can complain to us, and then to the OAIC, about the handling of your personal information by an overseas recipient, using the path in section 12 below.

You should nevertheless understand the practical limits: once information is in another jurisdiction, that jurisdiction's laws may permit access to it — including lawful access by foreign authorities — and you may not be able to seek redress in that country. Aristos cannot guarantee that an overseas recipient will comply with the APPs, and we do not represent that the Czech Republic, the United States or any other relevant country has privacy laws substantially similar to the APPs for the purposes of the APP 8.2(a) exception. The measures we take in respect of each overseas recipient are:

Aristos GPU server (Czechia) — owned/operated by Aristos on rented bare metal; reached only over an encrypted Tailscale (WireGuard) mesh; inference-only by design, with prompts processed in memory and nothing written to disk by the application; full-disk encryption at rest; the sandbox is purged at the end of the evaluation.
Frontier Access / third-party providers (US and onward) — governed by each provider's standard terms and data-processing terms; prompts to these providers pass the client-side PI redaction gate before egress, and use is opt-in per request rather than the default.
Stripe (US/global) — governed by Stripe's terms; card numbers are handled by Stripe and never stored by Athena.
Tailscale (US coordination plane) — sees connection metadata only; node traffic is end-to-end encrypted.
Where any subprocessor handles personal information for us, our engagement documents obligations of privacy and data security no less strict than those we commit to ourselves.

8.4 Your consent to overseas disclosure

Consent

By registering for and using the Athena beta, you consent to Aristos disclosing your personal information to overseas recipients in the Czech Republic (European Union), the United States, and the other jurisdictions described in section 8, for the purposes described in section 3 of this notice.

This notice, and the express statements in it, are given to you before that disclosure occurs so that your consent is informed. You are told, specifically, that Aristos will not be required by APP 8.1 to take steps to ensure the overseas recipient does not breach the APPs to the extent that you give that consent under APP 8.2(b) — although, as set out in section 8.3, we remain accountable to you and to the OAIC for how we have handled your information and we do not seek to displace section 16C by this notice.

Your consent is voluntary. If you do not consent to your personal information being disclosed to the Czech Republic, the United States and other jurisdictions, you should not use the Athena beta. Tell us at support@aristosai.com and we will deactivate your account and delete your content in accordance with Beta Data Handling Commitments. There is no penalty for declining, and declining will not affect any other dealing between you or your agency and Aristos.

You may withdraw your consent at any time by writing to support@aristosai.com. Withdrawing consent means we can no longer provide the beta to you, because every model, voice and image feature depends on the overseas processing described above. Withdrawal does not affect disclosures already made, but we will action deletion on request.

9. Government identifiers

We do not adopt, use or disclose government-related identifiers (such as tax file numbers, Medicare numbers or driver licence numbers) as our own identifiers, and we ask that you do not enter them into the Athena beta.

10. Quality of personal information

We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date, complete and relevant. Please note that content generated by Athena is not a reliable source of factual information about any person and may be inaccurate or fabricated — see the AI Use Disclosure. Generated content should not be treated as a record of fact about an individual.

11. Access to and correction of personal information

You may request access to the personal information we hold about you, and request correction of it. Requests should be made in writing to our Privacy Officer at support@aristosai.com.

We will ask you to verify your identity before we release information.
We will respond within a reasonable period and, where practicable, within 30 days of a verified request.
If we refuse access or correction, we will tell you in writing why, and how you can complain, as required by APPs 12 and 13.
We do not currently charge for access requests. If a charge were ever to apply it would not be excessive and we would tell you before proceeding.
Much of your content is directly visible and deletable inside Athena itself. For deletion, see Beta Data Handling Commitments.

12. Complaints

If you have a complaint about how we have handled your personal information — including handling by an overseas recipient — please follow these steps.

Contact our Privacy Officer. Write to support@aristosai.com with the words "Privacy complaint" in the subject line, setting out what happened and what outcome you are seeking. We will acknowledge your complaint and investigate it. We aim to respond substantively within 30 days.
Escalate to the OAIC. If you are not satisfied with our response, or we do not respond within a reasonable period, you may complain to the Office of the Australian Information Commissioner:
- Website: www.oaic.gov.au
- Telephone: 1300 363 992
- Email: enquiries@oaic.gov.au
- Post: GPO Box 5218, Sydney NSW 2001

If you are a government official participating in the beta, you may also wish to raise the matter with your agency's privacy officer. Nothing here limits any other right or remedy you have.

13. Data breaches

Aristos is subject to the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we become aware of a data breach that is likely to result in serious harm to any individual whose personal information is involved, and we cannot prevent that harm through remedial action, we will notify the affected individuals and the OAIC as required. Our process, escalation steps and contacts are set out in Incident Response & Breach Notification.

14. Retention and destruction

We retain personal information only for as long as we need it for the purposes described in this notice, or as required by law. In practice for the beta: conversation content is retained until you delete it or your account is purged; account records until the account is closed plus any period the law requires; security and audit logs for 12 months; and financial records for 5 years as corporate record-keeping law requires. When we no longer need personal information, and we are not required by law to retain it, we will destroy it or de-identify it. Our specific commitments — including purging the Prague GPU sandbox at the end of the evaluation — are in Beta Data Handling Commitments.

15. Changes to this notice

We may update this notice from time to time. The updated version will be posted at this URL and will take effect from the date of posting. Where a change materially affects how we handle your personal information — in particular any change to the overseas recipients or jurisdictions in section 8 — we will notify beta participants by email before it takes effect wherever practicable.

Contact us

If you have questions about this notice or how we handle personal information:

Entity: Polstar Holdings Pty Ltd T/A Aristos AI
Privacy Officer: support@aristosai.com
Telephone: (08) 9964 1919
Registered address: 26 Anzac Terrace, Geraldton WA 6530, Australia
ABN / ACN: ABN 58 614 834 150 (ACN 614 834 150)