Trust is an architecture,
not a promise.

HighFlyer maps Conductor’s handling of personal information to the Privacy Act’s principles: defined and necessary collection purposes; transparent notices; security safeguards; access and correction processes; accuracy checks; retention limits; controlled use and disclosure; and safeguards for overseas processing. E2EE chat, isolated runtimes, least-relevant-context inference, scoped credentials, approval gates, and content-conscious logging are technical controls supporting those obligations.

This does not automatically make every customer workflow compliant. Customers remain responsible for having authority to provide information, choosing lawful use cases, configuring appropriate permissions, and giving any notices their own collection or use requires.

Information Privacy Principle 3A has applied since 1 May 2026. Where it applies, an organisation collecting personal information from another source must take reasonable steps to tell the individual about the collection, its purpose, intended recipients, the collecting and holding agencies, any legal authority, and access and correction rights—unless an exception applies. Conductor’s Privacy Policy provides service-level notice, while customers must assess and satisfy notification duties arising from their own records and workflows.

Conductor uses global cloud, messaging, inference, and connected-service providers. Where an overseas disclosure by HighFlyer is subject to Information Privacy Principle 12, HighFlyer assesses the lawful basis and uses appropriate safeguards, such as comparable privacy protections or contractual commitments. The exact location can vary by AWS region, selected model route, and customer-selected services.

HighFlyer investigates and contains suspected incidents, assesses the risk of serious harm, preserves relevant evidence, and communicates with affected customers. If a breach is notifiable under the Privacy Act, HighFlyer will notify the Office of the Privacy Commissioner and affected individuals as soon as practicable, subject to the Act’s permitted exceptions or delays. The Commissioner’s stated expectation is notification within 72 hours of becoming aware that a breach is notifiable, even if investigation is continuing.

HighFlyer personnel do not receive chat decryption keys or a shared inbox of customer conversations. E2EE protects content between the authorised user’s device and that customer’s isolated Conductor runtime. The runtime must decrypt a request to perform it, and may send only relevant context to an approved inference provider or connected system when the requested task requires it.

No. HighFlyer only selects and configures inference routes and downstream providers that do not retain prompt content and do not use Customer Content to train or improve models. Relevant context is processed through OpenRouter and the selected provider only to complete the requested task. Limited operational metadata may still be processed for routing, security, billing, and abuse prevention, but not the prompt content itself.

Individuals may request access to or correction of personal information held by HighFlyer, subject to the Privacy Act. Customers can also request disconnection, export, or deletion under their agreement and the Conductor Privacy Policy. Where a customer controls the source record, HighFlyer may coordinate the request with that customer so it can be answered by the organisation responsible for the information.