Privacy Policy

Southern Sky AI is a maritime AI practice, governance-led, operated from New South Wales, Australia. This policy explains what we collect when you use southernsky.ai, why we hold it, who we share it with, and what you can ask us to do about it. It covers the website, the AI Baseline, the Chart Room Dispatch, Governance Essentials, and the credential verification pages.

If you would rather just ask, write to kristina@southernsky.ai. A person reads it.

Who we are

Southern Sky AI is a registered business name of Kristina Maree Agustin, ABN 73 107 743 069, operating from New South Wales, Australia. Post: PO Box 4036, Wagstaffe NSW 2257. Contact: kristina@southernsky.ai.

For readers in the European Union and the United Kingdom, Southern Sky AI is the controller of the personal data described here. We handle personal information to the standard of the Australian Privacy Principles.

What we collect, and when

Browsing the site. Your browser sends technical information on every visit: IP address, browser and device type, the pages you open, and the time and duration of the visit. We use Google Analytics to see which pages are read and which are ignored. See Cookies and analytics below.

The AI Baseline. The baseline asks twenty questions about your organisation: your sector, where you operate, whose rules reach you, which AI tools are in use, and how decisions are made. Your answers are saved as you go so you can leave and come back, and at that stage they are stored without your name or email against a random session identifier held in your browser.

If you ask us to send your report, we then collect your email address, your first name if you choose to give it, and your device's timezone. The timezone is used for one thing: deciding whether the Sunday Dispatch reaches you in your morning or your evening. We keep your answers, the position the report reached, and whether you asked to talk it through.

The Chart Room Dispatch. If you give us your email address to receive your baseline report, we add you to the Chart Room Dispatch, which goes out on Sundays. We say so on the page where we ask. Every issue carries a one-click unsubscribe, and unsubscribing does not take away anything else you have asked us for. You can also subscribe directly at southernsky.ai/dispatch without doing the baseline.

Governance Essentials and other purchases. Payment is taken by Stripe. We never see or hold your card number. We keep the record of the purchase: your email address, the Stripe identifiers, the amount, the currency, and the date. If you complete the guided interview, we keep your answers so the documents can be produced.

Enquiries, guides, briefings, and calls. When you request the engagement guide, register for a briefing, download a checklist, or book a call, we keep what you put in the form and the fact that you asked.

Training credentials. If you complete training with us and we issue a certificate, your name, your organisation, the course, and the date are published on a public verification page at southernsky.ai/verify. That is the purpose of a verifiable credential: anyone given the link can confirm it is real. Tell us before the course if you would prefer your certificate not to be publicly verifiable and we will issue it privately instead.

Why we hold it, and on what basis

For readers in the EU and the UK, our lawful bases are:

• Performing what you asked for. Sending the report, running the interview, delivering the training, taking the payment.
• Legitimate interests. Understanding which pages of our own site are read, keeping records of our engagements, and protecting the site from abuse.
• Consent. Where we rely on your consent, including marketing sent on that basis, you can withdraw it at any time and we will act on it.
• Legal obligation. Tax and financial records we are required to keep.

We do not sell your personal information. We do not sell or rent our mailing list. We do not use your baseline answers to train an AI model.

Who else touches it

We use a small number of service providers, and they process your information only to do the job we have given them:

• Lovable Cloud, built on Supabase, hosts the site and its database.
• GoHighLevel is our contact and email system. It stores your contact record and sends the report, the Dispatch, and our replies.
• Stripe takes payments.
• Google Analytics reports on site usage.

Some of these providers store and process information outside Australia, including in the United States and the European Union. Where information about EU or UK readers is transferred out, we rely on the transfer terms in our agreements with those providers.

We will disclose your information if the law requires it, and to establish or defend a legal claim.

Cookies and analytics

Cookies are small files a site stores in your browser. We use two kinds.

Necessary. These make the site work: remembering your place in the baseline so you can leave and resume, and keeping you signed in to the client portal. The site does not function properly without them.

Analytics. We use Google Analytics across the site to see how many people read a page and which route brought them to it. It sets cookies in your browser to do that. We do not use it for advertising, we run no retargeting pixels, and we do not combine it with other information to identify you personally.

We do not ask you before analytics cookies are set. If you would rather not be counted, you can refuse or delete cookies in your browser settings, browse in private mode, or install Google's own opt-out extension from tools.google.com/dlpage/gaoptout. Nothing on the site stops working if you do.

How long we keep it

• Incomplete, anonymous baseline runs: 12 months, then deleted.
• Completed baselines and the contact details attached to them: 24 months from your last contact with us, unless you become a client.
• Client engagement records: 7 years after the engagement ends.
• Purchase and financial records: 7 years, as Australian tax law requires.
• Dispatch subscription: until you unsubscribe, then we keep a record of the unsubscribe so we do not email you again by mistake.
• Training credentials: for as long as the credential is offered as verifiable, unless you ask us to withdraw it.
• Google Analytics: 14 months.

What you can ask us to do

Whoever you are and wherever you are, you can ask us to:

• tell you what we hold about you,
• give you a copy of it,
• correct it if it is wrong,
• delete it,
• stop sending you the Dispatch or anything else,
• stop relying on legitimate interests where you object,
• withdraw a consent you gave earlier.

Write to kristina@southernsky.ai. We will answer within 30 days, and usually much sooner. We will not charge you and we will not ask why.

If you are not satisfied with how we have handled it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. Readers in the EU may complain to their national data protection authority, and readers in the UK to the Information Commissioner's Office at ico.org.uk.

Security

Information is held in access-controlled systems, and report files are served through links that expire. No transmission over the internet is completely secure, and we will not claim otherwise. If a breach occurs that is likely to cause you serious harm, we will notify you and the regulator as the law requires.

Children

The site is for people working in maritime and marine businesses. It is not directed at anyone under 18 and we do not knowingly collect information from children. If you believe we have, write to us and we will delete it.

Changes

We update this policy when what we do changes. The date at the top tells you when it last changed. If a change materially affects how we use information we already hold about you, we will tell the people affected rather than relying on you to notice.