Interim policy, version privacy-2026-09-26-r2, effective 2026-09-26. This policy is in force now and is under legal review. We will give notice of changes as set out in section 11.
Elbereth Privacy Policy
This policy covers the Elbereth data catalog's own handling of personal information: accounts, keys, evidence records, logs and payments. It does not cover the Datasets that Sellers list, which are governed by each Seller's own policies and Licences, except where section 2 says we host them or load them into a Buyer's workspace.
1. Who we are
[OWNER TO FILL: legal entity name] (ABN [OWNER TO FILL: ABN]) operates the Elbereth data catalog at https://api.elbereth.ai/catalog/ ("we", "us"). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Contact our privacy officer at [OWNER TO FILL: privacy contact email address], [OWNER TO FILL: postal address].
2. What we collect
Our customers are organisations. The personal information we hold is mostly about the people who act for them.
| What | Details | Where it comes from |
|---|---|---|
| Sign-up details | Organisation name, contact email address, country of incorporation, role (buyer, seller or both), the versions of our terms and this policy you accepted, and the time. We do not verify the email address. | You, at sign-up |
| Sign-up network address | A keyed hash of the IP address you signed up from, never the address itself. We use it only to limit how many accounts one address can create. | Your connection |
| Screening information (person and vehicle data only) | Your organisation's legal name and country of incorporation, a signed ownership declaration, our conclusion, when and by whom it was recorded | You, when you ask for screening; our staff |
| API keys | A public key id, a label, when it was created or revoked, and a hash of the secret. We never store the secret and cannot recover it. | Generated by us |
| Acceptances of our legal documents | Which version of the Terms of Service, Seller Listing Agreement, Buyer Acceptance and this policy your Account accepted, with each document's SHA-256, the key that accepted and the time | Generated by the Service when you act |
| Evidence records | Licence acceptances (organisation, the key that accepted, stated purpose, licence version and hash, time); releases of a Seller's download address; downloads (filters, row count, file hash); loads into a workspace (listing, purpose, window, rows, a hash of what was copied or fetched, and a hash of the Seller's download address, never the address); import template versions; Add-on runs (the Add-on, purpose, parameters, rows read, result hash); listing events and edits (old and new values); reports (a hash of the text), takedowns; payments; deletion requests (counts and a hash of the request only) | Generated by the Service when you act |
| Listings | What a Seller publishes, including its organisation name, which is shown publicly (section 4) | Sellers |
| Reports | The reason, the text you write, your Account id and the key used | You, when you report a Listing |
| Saved searches and alerts | Your search parameters, the name you give it, and any webhook address | You |
| Add-on runs | The parameters, time window and area you choose, and the results | You, and the Service |
| Loads and workspace datasets | Which listing you loaded, under which licence version and purpose, the window and area you chose, and the loaded rows themselves (see "The Datasets themselves") | You, the Seller's data, and the Service |
| Payment information | Stripe account ids and whether a connected account can take charges and payouts; Checkout session ids; amounts, currency, our fee and payment status. Card and bank details go to Stripe; we don't receive them. | Stripe, and the Service |
| Logs | The time, the page or API address requested (including any search terms), the result, and ids such as your Account id and key id. Our proxy passes requests on without logging them, so our service logs record the proxy's address, not yours. | Generated by the Service |
| Communications | Screening requests, support requests, complaints and takedown notices | You |
Your browser. Our web pages store your API key in your browser (session storage for the tab, or local storage if you choose "remember"). It is sent only to us, in a request header. We do not use cookies or analytics. The map on our pages loads tiles directly from OpenStreetMap's tile servers (tile.openstreetmap.org), so OpenStreetMap receives your IP address and the map area you view.
We do not collect sensitive information about you (as the Privacy Act defines it) and don't ask for it. Screening can reveal where individuals live (residence in a Country of Concern). We collect that only to meet the law.
The Datasets themselves.
- Link Listings. We don't hold the rows. We check about once a day whether the Seller's download address answers, without downloading the data.
- Hosted Listings. We store the rows for vessel and animal data on the Seller's behalf. If any of those rows are personal information (for example, a small-craft owner or a farmer), we handle them as the Seller's service provider and under this policy's security, retention and deletion practices.
- Loads into a Buyer's workspace. When a Buyer that has accepted a Licence asks us to, we copy a Hosted Listing's rows, or fetch a Link Listing's file from the Seller's download address, into a dataset in that Buyer's own workspace, and store and process it there for that Buyer, as its service provider, on its instruction. The Licence the Buyer accepted is stored with the data and governs its use. For person and vehicle data these rows can be personal information about the people in the data: before storing them we require the Buyer's covered-person screening and consent attestation and remove rows near sensitive places (sensitive-location suppression); we honour deletion requests and delete the rows when the Licence's retention term passes. We do not use a Buyer's loaded data for anyone else, and the Seller cannot see it. Fetching a file sends the Seller's server a request from our servers, without credentials.
3. Why we use it
- To run your Account and authenticate your API keys.
- To limit abuse: how many accounts one address or email can create, and how fast keys and addresses can make requests.
- To screen organisations under U.S. 28 CFR Part 202, and to refuse access where the law requires. We do not check sanctions lists.
- To record licence acceptances, deliveries, Add-on runs and acceptances of our legal documents as evidence for Buyers, Sellers, regulators and courts.
- To run the saved searches, alerts, loads and Add-ons you ask for.
- To process payments and payouts through Stripe, and to meet tax obligations.
- To handle deletion requests, reports, complaints and takedowns.
- To secure the Service and respond to incidents.
- To meet our legal obligations and to enforce our terms.
We don't sell your personal information. We don't use it for advertising.
4. Who can see it, and who we share it with
- Everyone, publicly. A published Listing's page shows the Seller's organisation name, with the rest of the Listing. Search engines index these pages, and the name also appears in our sitemap, DCAT catalog and Schema.org data. If your organisation name is your own name (for example, a sole trader), it is public.
- The other party to a Licence. A Seller sees who accepted its Licence (the Buyer's Account id, the key id, the Purpose, the time) and, for a Hosted Listing, each download, load and Add-on run, with its filters and parameters; for a Link Listing, each load we fetched for a Buyer. A Seller does not see a Buyer's loaded data or its analyses. A Buyer sees the Seller's organisation name and its own acceptances.
- The Seller of a Listing you report. It sees the reason, your text and your Account id.
- Your webhook. If you give a webhook address, we send alerts to it.
- Stripe, for payments, identity verification of connected accounts, fraud and sanctions checks. Stripe is based in the U.S. and other countries.
- Weather providers. To fetch weather, the weather Add-ons send our weather provider (Open-Meteo's commercial service, or SILO from the Queensland Government) the weather-grid cells and dates to look up, never the exact positions in the data and never who is asking.
- OpenStreetMap, which serves the map tiles your browser loads (section 2).
- Hosting and infrastructure providers: [OWNER TO FILL: hosting provider name and the country where the servers are].
- Regulators, law enforcement and courts, when the law requires, or where we need to establish or defend legal claims.
- Professional advisers under confidentiality obligations.
Overseas disclosure. Some recipients are outside Australia, including Stripe (U.S.), OpenStreetMap (U.K.), Open-Meteo (Switzerland), and Buyers and Sellers in any country. Before disclosing overseas, we take reasonable steps under APP 8.
5. Security
We protect personal information with:
- access controls that scope every request to one organisation;
- API keys stored only as hashes, and sign-up addresses stored only as keyed hashes;
- encrypted transport (TLS) on every public address;
- a public entry point that lets through only the catalog, sign-up, account and workspace routes;
- fetching a Seller's file only over encrypted transport, only from public network addresses, and never with credentials;
- a host firewall;
- tamper-evident evidence records.
No system is perfectly secure. If we have an eligible data breach, we will notify you and the OAIC as the Notifiable Data Breaches scheme requires.
6. How long we keep it
| Record | Kept for |
|---|---|
| Sign-up details and the sign-up address hash | While the Account exists. We have not yet set a period after closure. [OWNER TO FILL: retention period after an Account is closed] |
| Screening records | They cannot be edited or deleted; we keep them while the Account exists and after. |
| Evidence records and acceptances of our legal documents | We do not delete them at present; they are append-only and cannot be edited. We will set a period after legal review; see section 7. |
| Hosted Dataset rows | Until the retention term in the Seller's Licence, or a limit we set, has passed; with neither, until the Seller or we remove them |
| Loaded workspace datasets | Until the retention term in the Licence the Buyer accepted, or a limit we set, has passed; with neither, until the Buyer or we remove them |
| Add-on results | We do not delete them at present. |
| Reports, saved searches and alerts | While the Account exists. A deleted saved search is marked deleted, not erased, because alerts refer to it. |
| Logs | Until the service's log is replaced, usually at the next software release. [OWNER TO FILL: log retention period if logs are shipped or archived] |
| Payment and tax records | 5 years (Australian tax record-keeping), or as Stripe requires |
7. Access, correction and deletion
You can ask to see or correct the personal information we hold about you. We will respond within 30 days.
Evidence records work differently. They are append-only, and changing one would break the proof they provide.
- Correction. We correct by adding a new record, not by editing the old one.
- Deletion. If you ask us to delete your personal information from an evidence record, we will tell you whether we must keep it (for example, for legal claims or regulators). Where we can, we will remove the link between the record and you.
Data subjects of listed Datasets. If you think a Dataset listed on Elbereth contains your data:
- write to [OWNER TO FILL: complaints and takedown email address];
- for Link Listings, we will pass your request to the Seller who holds the data;
- for Hosted Listings and data loaded into a Buyer's workspace, we will delete matching rows and keep you out of later deliveries and loads.
8. Automated decisions
We don't make decisions about you that are based solely on automated processing and that significantly affect you. Screening results are recorded by our staff. Add-ons produce estimates for the Buyer who runs them; any decision based on them is the Buyer's.
9. Complaints
Complain to our privacy officer first. We will respond within 30 days.
If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: https://www.oaic.gov.au, phone 1300 363 992.
10. Where this policy is
This policy is published at /catalog/legal/privacy, with its version, effective date and SHA-256 hash.
11. Changes
We will publish changes at the address above, show a notice on the catalog and account pages, and email Account holders about material changes at least 30 days before they apply. The Service does not send email automatically; we send these notices ourselves.
The SHA-256 is of this document's source file as published; every acceptance records it. Other documents: Terms of Service · Seller Listing Agreement · Buyer Acceptance.