Privacy Policy.
1. Who we are
MindLattice Pty Ltd (ABN 30 683 205 325), trading as Certant ("Certant", "we", "us"), is an Australian company headquartered in Melbourne. We build the Certant platform — a knowledge-graph-grounded AI system used by regulated organisations to ground language models on their own documents and data.
This policy covers our marketing site (certant.ai), the Certant product, and any data we process on your behalf.
2. What we collect
2.1 From visitors to certant.ai
- Standard server logs (IP, user agent, referrer, page).
- Anonymous, aggregate analytics — page views, navigation paths. No third-party trackers.
- Anything you submit through our forms — name, email, organisation, message body.
2.2 From product users
- Account profile — name, email, organisation, role, region.
- Authentication metadata — last sign-in, IP, session token.
- Audit log — who did what, when, against which document or agent.
3. How we use it
We use the data above to:
- Run the Certant product — authenticate you, route requests, write the audit log.
- Reply to enquiries you send us.
- Detect and prevent abuse of the platform.
- Improve the product. We do not train foundation models on your data. We do not use customer documents to train shared models, ever.
4. Customer data
The documents and structured records you bring into Certant are your data. We handle it on your behalf and on your instructions. Under the Australian Privacy Principles we are also independently responsible for protecting it while we hold it. You retain all rights, title and interest. We do not sell, share, or use it for any purpose outside operating the platform for you.
You can export or delete your data at any time. Deletion is propagated to all replicas within 30 days.
5. Where your data is processed
Two different things happen to your data, and they happen in different places.
Storage. By default, Certant Cloud customer data is stored in Australia (AWS ap-southeast-2, Sydney). Sovereign customers may elect a specific region — UAE (Dubai), EU (Frankfurt), or a fully customer-controlled environment where nothing leaves your own infrastructure. See architecture for details.
Inference. To read your documents and answer questions about them, the Certant Cloud platform sends the relevant content to two specialist AI providers to be processed:
- Optical character recognition (OCR) — turning scanned pages and images into machine-readable text — runs on GPU infrastructure operated by RunPod, Inc.
- Language-model inference — the step where a model reads the text and generates a response — runs via OpenRouter, Inc., which routes each request to an underlying model provider.
Both RunPod and OpenRouter are United States companies, and neither offers processing capacity in Australia. Both use global inference infrastructure that is not fixed to a single location, so the content they process is handled on servers outside Australia — in the United States and, depending on where capacity is allocated for a given request, potentially other countries. This means that where your documents contain personal information, that information is disclosed to a recipient outside Australia at the inference step.
What "inference" means, and why it matters
Inference is the moment an AI model reads your data and produces a response. Picture handing a letter to someone overseas to read and reply to: the instant they read it, the contents have left your hands. Australian privacy law treats that moment as an overseas disclosure of personal information, and it carries specific obligations that we take seriously.
How we meet our obligations (Australian Privacy Principle 8)
Australian Privacy Principle 8 governs sending personal information to recipients outside Australia. Under APP 8 and section 16C of the Privacy Act 1988 (Cth), before we disclose personal information overseas we must take reasonable steps to ensure the overseas recipient handles it consistently with the Australian Privacy Principles — and we remain accountable to you if they don't.
We rely on that accountability, rather than asking you to sign it away. Specifically:
- Contractual protection. RunPod and OpenRouter are engaged under data-processing terms that limit them to processing your content solely to provide the service, prohibit them from using it for their own purposes, and require appropriate security. We do not ask you to consent to giving up your APP 8 protections.
- No retention, no training. Our inference is configured so that requests are only routed to providers that do not retain your content after processing and do not use it to train models. We do not use customer content to train shared or foundation models — ever.
- Encrypted in transit (TLS). All content is sent to and received from these providers over a TLS-encrypted link. Access is scoped, time-limited, and logged.
The current list of these providers, their roles, and their locations is in Section 6.
If you need data to stay onshore, or inside your own environment
The Certant Cloud platform described above uses the overseas inference providers named here — that is a fixed characteristic of the Cloud tier. If your obligations require that personal information never leaves Australia (or never leaves infrastructure you control), our Sovereign deployment runs the entire pipeline — OCR, inference, and storage — inside a region or environment you control, with no data egress to third-party AI providers. Talk to us about a Sovereign deployment if onshore or in-tenant processing is a requirement for you.
6. Sub-processors
We use a small, tightly scoped set of sub-processors. We give 30 days' notice before adding a new one. The current list:
| Sub-processor | Role | Processing location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage | Australia (Sydney, ap-southeast-2) by default; the elected region for Sovereign customers |
| RunPod, Inc. | OCR (document-to-text) | Outside Australia — global GPU capacity, primarily the United States |
| OpenRouter, Inc. | Language-model inference routing | Outside Australia — United States, and the underlying provider's location varies with the model and route selected |
Each provider publishes its own privacy and data-handling terms:
- RunPod — Privacy Policy · Security & Compliance
- OpenRouter — Privacy Policy · Data Collection · Provider Logging & Data Retention
The full, current list is published on our security page.
7. Automated decisions
Certant is primarily a tool that our customers configure and operate on their own data. Where personal information is used in automated processing on the platform, we design for a human to remain accountable for outcomes that could significantly affect an individual, and where a customer uses Certant as part of their own decision-making about people, that customer is responsible for that decision and for its own transparency obligations.
From 10 December 2026, Australian law introduces specific privacy-policy requirements about substantially automated decisions that significantly affect individuals. We will update this section to meet those requirements, and we work with customers on their obligations where Certant is used in decision-making.
8. Your rights
Under the Australian Privacy Principles and equivalent regimes, you have the right to:
- Access your personal information we hold.
- Correct anything inaccurate.
- Request deletion (subject to retention obligations).
- Withdraw consent for marketing communications.
Email [email protected] to exercise any of these. We respond within 30 days.
9. Contact
Questions? Complaints? Requests under section 8?
Email: [email protected]
Post: Privacy Officer, MindLattice Pty Ltd (trading as Certant), Melbourne, Victoria 3000, Australia
If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.