Privacy Policy

Cactive Pty Ltd (ABN 61 667 172 394) provides the Cactive apps and services: the apps on the web and on phones, our browser, our API, MCP server and command-line tools, and cactive.com.au. “Cactive”, “we” and “us” mean Cactive Pty Ltd. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Personal information is information or an opinion about someone who is identified or reasonably identifiable. This policy is the overview. Alongside it:

• Privacy Collection Notice: the short version, for when you sign up
• Privacy Details by App: what each app collects, who receives it and how long it’s kept

Personal and organisation accounts

For a personal account, we decide how your information is handled, as this policy describes. If you use Cactive through an organisation, such as your employer, the organisation decides what happens to the information in its workspace, and we handle it on its behalf under our Data Processing Addendum. Its administrators can see its members, their sign-ins and its audit log, and can export or delete its data. Ask the organisation first about information in its workspace.

• Account: your name, email address, date of birth, phone numbers you add, and your sign-in methods (passwords are stored only as a one-way hash).
• Profile: the name, username, photo and other details you choose to show.
• Your content: what you store, send and share in the apps, such as mail, files, photos, messages, notes and conversations with Caity, including information about other people.
• Devices and sign-ins: IP address, approximate location worked out from it, browser, device and app version, and the time of each sign-in.
• Location: only while you use a feature that needs it, and never in the background.
• Billing: your plan, billing name, address and tax number, invoices, and your card’s brand, last four digits and expiry. Card numbers go to our payment provider, not to us.
• Communications: support requests, feedback and reports you send us.
• Sensitive information, only with your consent: health information you choose to bring into Health, and biometric information: the face image used to estimate your age, if you choose a face check (see Children and age assurance).

• Mostly from you and your devices, with the permissions you give. Also from your organisation if it manages your account, people who email, message or share with you, and services you connect.
• The apps use cookies to keep you signed in and remember preferences; none are for advertising or analytics (Cookie Policy).
• We hold information in our systems on Amazon Web Services, encrypted (see Security). If we receive personal information we didn’t ask for and couldn’t have collected, we destroy or de-identify it where it’s lawful and reasonable.

Anonymity and pseudonyms

You can read this website and our documentation without telling us who you are, and use a username and display name of your choice in Mirage and on your profile. An account needs your real date of birth, and paying needs a billing name and address.

If you don’t provide it

• Without a name, email address and date of birth, we can’t create your account.
• Without your date of birth, or an age check when we ask for one, Mirage’s social features stay closed.
• Without a permission on your phone, the feature that needs it won’t work.
• Without payment details, you can’t start a paid plan.

When the law requires it

The Online Safety Act 2021 requires us to take reasonable steps to keep people under 16 off Mirage’s social features, which is why we ask for your age. Tax and corporations laws require us to keep financial records, such as invoices.

• to provide the apps and features you use, and share with the people you choose
• to create, sign in to and protect your account, and warn you about new sign-ins
• to apply age rules
• to bill you and keep financial records
• to send service messages and the notifications you set up
• to answer support requests and feedback, and fix problems
• to handle reports and abuse, enforce our terms and keep people safe
• to count traffic, from logs that don’t identify you
• to meet our legal obligations

We use information for another purpose only with your consent or where the law allows, such as a related purpose you’d reasonably expect, or to lessen a serious threat to someone’s life, health or safety. We don’t sell personal information, use it for advertising, or use your content to train AI models. We don’t use government identifiers, such as a tax file number, to identify you.

Marketing

We send marketing only if you’ve agreed to it, each message has a way to unsubscribe, and we act on an unsubscribe within five business days. We don’t use or disclose your information for other companies’ marketing.

• people you choose: those you share with, message, invite or call, and anyone with a link you make
• your organisation, for accounts and workspaces it manages
• service providers who run parts of the service for us, below
• services you connect, such as a chat or music service, which receive what you send them
• others where the law requires or allows it, such as a court order, or to lessen a serious threat to someone’s life, health or safety

Our service providers

Each receives only what it needs for its part of the service, and only when you use a feature that needs it. Providers that receive no personal information, such as public data feeds, aren’t listed.

• Amazon Web Services (Australia and the United States; its delivery network worldwide): hosting, storage and databases, email, texts, calls, AI (Amazon Bedrock), captions and speech, face age checks (Amazon Rekognition), and voice and video
• Stripe (United States): payments, including your card details
• Expo, Apple and Google (United States): notifications to your phone, and Apple Maps and Google Maps in our phone apps
• Apple, Google, Microsoft and Mozilla (United States): notifications in your browser, through your browser’s own service
• Microsoft (United States): sign-in and Teams, for organisations that connect them
• Mapbox (United States): what you search for in maps, the map’s position, and the location of photos, to name places
• Discord (United States): messages in Mirage channels connected to a Discord server
• KLIPY or GIPHY (United States and Georgia): GIF searches, with an identifier that isn’t your account’s
• Last.fm (United Kingdom): your Last.fm username, if you connect it
• Exa or Brave (United States): what Caity searches the web for
• Open-Meteo (Switzerland, with servers in Europe and North America): locations rounded to about a kilometre, and place searches, for the weather
• Open Food Facts (France): barcodes you scan in Food

Our main region is Amazon Web Services’ Sydney region, in Australia, where the apps run and your information is stored. Our move there isn’t finished, so some information is also stored or handled overseas:

• in the United States, by Amazon Web Services: a copy of our databases, our backups, our encryption keys, email, request logs, and the services that don’t run in Sydney, such as voice and video calls, Caity by phone, face age checks and some AI models (the Privacy Details by App name each region)
• by the service providers above, in the United States, the United Kingdom, Switzerland, France and Georgia, and wherever their servers are
• around the world, where our delivery network serves the apps from the location nearest you

We remain accountable under the Privacy Act for how our service providers handle the personal information we give them.

We protect information with encryption in transit and at rest, keys held in a managed key service, multi-factor authentication for our own access, separation between organisations, and audit logs. Some things, such as Mirage direct messages and the Authenticator’s passwords, are end-to-end encrypted, so we can’t read them. Everything else is encrypted where it’s stored, but our systems can decrypt it to provide the service.

The Security and Vulnerability Disclosure page explains more and how to report a vulnerability.

We keep information only as long as we need it for the purposes above or the law requires. Most of what you store stays until you or your organisation delete it; some records, such as sign-in history and logs, go after set periods, listed in the details.

• When an organisation’s subscription ends, its data is kept for 90 days so it can be exported or the subscription restarted, then deleted.
• Deleted information stays in backups until they expire: daily backups after 35 days, monthly ones after a year.
• Financial records, such as invoices, are kept for as long as the law requires.

Deleting your account

You can delete much of what you store yourself, in each app. We’re rolling out Delete Account in your account settings: once you ask, your account is frozen and signed out everywhere, you have 14 days to change your mind (30 if your sign-in details changed in the week before), and then your information is deleted, except what the law requires us to keep. Until Delete Account appears in your account, email support@cactive.com.au from your account’s email address and we’ll check it’s you, delete your information and confirm when it’s done. If an organisation manages your account, ask its administrators; what you created in its workspace stays with it.

You can see and update most of your information in the apps, and export much of it. To ask for a copy of the personal information we hold about you, or to correct it, email legal@cactive.com.au. We’ll check it’s you and respond within 30 days, at no charge. If we refuse, we’ll tell you why in writing and how to complain. If we don’t make a correction you ask for, you can ask us to keep a statement with the information saying you believe it’s wrong.

How we use AI

• Caity and the AI features in the apps run on models hosted by Amazon Web Services in Amazon Bedrock, using what you ask and what the apps you allow hold. Neither we nor AWS use your content to train models, and the companies that make the models don’t receive it.
• Caity acts in the apps on your instructions. Depending on the setting you choose, it can make changes without asking each time, but it always asks before sharing, sending messages or invites to other people, paying, or anything that can’t be undone.
• Mirage’s Feed orders posts by who you follow, what you’ve engaged with in the last 60 days and how popular a post is, and each post shows why it’s there.

Automated decisions

Some decisions that could significantly affect you are made, or substantially helped, by computer programs that use personal information. The personal information they use is:

• your date of birth
• the face image from a face check, which is biometric information (sensitive information), only if you choose one
• your email address and your sign-in attempts
• your subscription and whether its payments have been collected
• your card and payment details, which our payment provider screens
• incoming email: its content, sender and the network addresses it came through
• what you post in a Mirage server, checked against the rules its moderators set

Decisions made solely by a program, and how to have each looked at again:

• Whether you can create an account: you need to be 13 or over, from your date of birth. If your date of birth was entered wrongly, contact support.
• Whether Mirage’s social features are open to you (16 and over) and whether you can see adult-only content (18 and over), from your date of birth or a face check. A face check that says you’re under 16 stands for a year. Our support team can correct your date of birth or review a check.
• Pausing sign-in for 15 minutes after 10 wrong passwords, or 5 wrong codes, in that time. It lifts by itself, or you can recover your account.
• Ending access to a paid plan when its payment can’t be collected after retries. Access returns when the payment is made; contact support if it was a mistake.
• Whether incoming email goes to your inbox or to Spam, or isn’t delivered because it carries a virus. You can move mail out of Spam; contact support about mail you expected.
• Blocking a Mirage message, or timing someone out for up to a week, under AutoMod rules a server’s moderators set. Ask the server’s moderators, or report it to us.
• Our payment provider screening card payments for fraud, which can decline one. Try another card, or contact support.

Decisions a program substantially helps a person make: AutoMod can alert a server’s moderators to a message, and they decide what to do. Our own staff don’t use programs to make decisions about you beyond those above. If an organisation uses our AI features to help it decide about people, it’s responsible for telling them.

You can always ask for a person to review a decision, or to explain how one was made: email legal@cactive.com.au with what happened. A member of our team will look at it and respond within 30 days.

• You need to be at least 13 to create an account.
• Mirage’s social features aren’t open to anyone we know to be under 16, under Australia’s social media minimum age. Mirage’s chat, direct messages and voice stay open. Some content, such as age-restricted channels and some Health categories, is for adults only.
• We go by your date of birth and, where we need more certainty, may ask for a face check: a short live video selfie from which Amazon Rekognition estimates your age, in the United States. The face image is biometric information, which we collect only with your consent: the check tells you what happens to the images and starts only when you choose to start it. We keep the outcome, how and when it was checked; never the image or video. Three checks a day are allowed.
• If you’re a parent or guardian and think your child has given us information they shouldn’t have, contact us.

If we have a data breach likely to cause serious harm, we’ll contain and assess it and notify you and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. If you think someone has got into your account, change your password, sign out your other sessions and tell us.

Where the EU or UK General Data Protection Regulation applies, we handle your information to provide the service you’ve asked for, with your consent (health information, face checks and features you turn on), for our legitimate interests in keeping the service secure and free of abuse, and to meet legal obligations.

You can ask us for a copy of your information, to correct or delete it, to restrict or object to how we handle it, or for a copy to move to another service, and you can withdraw consent at any time. You can also ask for a person to review a decision made solely by a program. Information sent outside the EU or UK is protected by our contracts with our providers. You can complain to your local data protection authority.

Wherever you live in the United States, you can ask us what personal information we hold about you and for a copy of it in a portable form, and ask us to correct or delete it. Email legal@cactive.com.au; we’ll check it’s you and won’t treat you differently for asking. Someone you authorise can ask for you.

• We don’t sell personal information, and we don’t share it for cross-context behavioural advertising.
• We use sensitive personal information, such as health information, face images for age checks, precise location and sign-in details, only to provide the services you ask for, keep them secure and meet the law, as the law permits.
• The kinds of information we collect, where it comes from and who receives it are set out above.

Do Not Track and Global Privacy Control

We don’t track you across other companies’ sites or apps, and we don’t let advertising or analytics companies track you through ours, so a Do Not Track or Global Privacy Control signal has nothing to turn off: we treat every visitor as having opted out of sale and sharing. Some providers load content straight into your browser, such as maps from Mapbox, GIFs from KLIPY or GIPHY, and Stripe’s card form, which sets its own cookies to prevent fraud; they receive your IP address and browser details when they do.

If you’re concerned about how we’ve handled your personal information, email legal@cactive.com.au with what happened and what you’d like us to do. Our privacy officer will look into it and respond within 30 days.

If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We publish each change here with the date it takes effect, and keep earlier versions at cactive.com.au/privacy/archive. We update this policy before we launch a feature that collects a new kind of personal information, and tell you in the apps or by email before a change that significantly affects information we already hold.

• Privacy questions, requests and complaints: our privacy officer, legal@cactive.com.au
• Your account and support: support@cactive.com.au