Privacy Policy

Last updated / effective: 1 November 2026

1. Who we are and scope

1.1 Excavata Pty Ltd (ACN 695 898 241) (“Excavata”) provides the Excavata App (“App”) and associated online services.

1.2 This Privacy Policy explains how Excavata handles Personal Information in connection with the App, accounts, community, support and related services (“Services”).

1.3 Excavata is committed to handling and protecting Personal Information of Users in a responsible manner in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”) and the Australian Privacy Principles (“APPs”) specified in Schedule 1 of the Privacy Act to the extent they apply to Excavata in relation to the provision of Services.

1.4 Definitions

Personal Information has the same meaning given to it in the Privacy Act and in summary means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not, and recorded in a material form or not.

Sensitive Information (a type of Personal Information) has the same meaning given to it in the Privacy Act and in summary means information or an opinion about an individual’s race or ethnic origins, political opinions and associations, religious beliefs or affiliations, philosophical beliefs, trade or professional associations and memberships, union membership, sexual orientation or practices, criminal record, health or genetic information or biometric information.

2. Our local-first architecture

2.1 Excavata is local-first. Archaeological project databases, photographs, drawings, documents and related project files are primarily stored on the User's device.

2.2 Excavata does not automatically upload the structured archaeological project database to its account/licensing backend.

2.3 Project-related information can nevertheless leave the device when a User chooses or uses functions such as cloud backup, AI/OCR, export, LAN transfer, maps, or bug reporting, and when weather information is retrieved for a site. Those pathways are described below.

3. Personal Information we may handle

3.1 Depending on the Services you use, we may handle: email address; optional name; account and organisation identifiers; subscription/licence information; device identifier and device name used for team-seat management; community profile and post content; bug-report text, optional contact email and optional screenshots; and limited diagnostic information submitted with a bug report.

3.2 We do not require an account for ordinary offline use. Anonymous offline use does not create an account record on Excavata's backend.

3.3 We do not handle payment-card details in the App. Payment information for web purchases is processed through the relevant payment provider.

4. How and why Personal Information is collected

4.1 We collect Personal Information only to provide you with the Services.

4.2 Generally, Excavata will not collect Sensitive Information. We will only collect Personal Information where you have consented to us doing so and it is reasonably necessary for the use of the App or other Services made available to you or where required or permitted by law.

4.3 Account information is collected when you create or use an account, for authentication, licence/ subscription validation, team functions and related account administration.

4.4 Community information is collected when you choose to create a profile or post community content.

4.5 Bug-report information is collected when you choose to submit a report. Free-text descriptions may contain information you choose to type, and screenshots may contain information visible on your screen.

4.6 Limited device information may be used for team-seat management and diagnostics. Bug-report diagnostics can include app version, platform, operating-system version, hardware model, schema version, locale, a safe screen identifier and limited type information. They are designed not to include coordinates, filesystem paths, credentials, exception messages or stack traces.

4.7 Excavata may not be able to provide the Users with the Services if you do not provide the required Personal Information.

4.8 By providing Excavata with your Personal Information, you consent to the terms of this Policy and the types of disclosures covered under this Policy.

4.9 If we receive Personal Information of Users that is not required for Excavata in relation to the App or other Services and we determine that we could not have lawfully collected that information under the APP had we asked for it, Excavata will destroy or de-identify the information if it is lawful and reasonable to do so.

5. Location and mapping

5.1 The App can record precise location information when you use archaeological spatial or GPS functions. That project location data is stored locally unless transmitted through a feature you use.

5.2 When weather information is requested for a site, the App sends coarsened coordinates (approximately 0.1 degree, roughly 11 km resolution) to the weather provider.

5.3 When map functions are opened, map or tile providers receive requests corresponding to the geographic area being viewed and necessarily receive ordinary network information such as the device's IP address.

5.4 If you choose to open a recorded location in Apple Maps, the precise selected coordinates are sent to that service.

5.5 User-configured WMS/WFS services may receive the geographic bounding box and authentication information configured by the User.

6. Cloud backups

6.1 Cloud backup is optional and user-initiated. Supported providers include Google Drive, iCloud, Dropbox, OneDrive and WebDAV.

6.2 A backup can contain the project database, media, documents, 3D scans, non-secret preferences and a backup manifest.

6.3 Backups are transferred directly from the App to the provider/account selected by the User. Excavata does not operate the cloud storage holding those backups.

6.4 Authentication credentials for supported providers are stored using platform secure credential storage where implemented and are excluded from Excavata backup packages.

6.5 Retention and deletion of backups are also subject to the settings and policies of the User's chosen provider.

7. AI and OCR services

7.1 AI and OCR features are optional and require feature-specific disclosure or consent.

7.2 Current AI functions can send selected archaeological records, notes, interpretations, site/location text, reports, or entire selected laboratory PDFs/images directly to Anthropic. Form-scanning (OCR) works differently by platform. On iPhone, iPad and Mac, text recognition runs entirely on the device using Apple’s built-in recognition, and no image leaves the device. On Android and Windows, form scanning can send selected scanned-form images directly to Google Cloud Vision, but only if the User has entered their own Google Cloud Vision API key and consented to this use; it is never used automatically. QR-code reading runs on the device on all platforms.

7.3 These requests are made directly to the external provider rather than being proxied through Excavata's backend. Excavata does not persist the AI prompt content on its own backend.

7.4 Any Personal Information of a User that may be collected by an external provider pursuant to this item 7 will not fall within the purview of this Policy and shall be handled in accordance with the privacy policy of the respective external provider.

8. Bug reports, diagnostics and screenshots

8.1 Bug reporting is user-initiated. A report may include title, description, reproduction steps, severity/category and limited system/diagnostic information.

8.2 Providing a contact email is optional. Attaching a screenshot is also optional and requires an explicit opt-in; screenshots may contain personal, project or sensitive information visible on screen.

8.3 Bug reports are currently delivered to a contracted webhook service used by Excavata. A User may separately choose to post material to the community service.

8.4 A failed report may remain temporarily in a local pending queue until it is sent or cleared. Once a report has been delivered to the external webhook service, the App does not currently provide a user-facing deletion control for that delivered report.

9. Community

9.1 Any community features used in the App are optional. Community profiles and posts are stored using Excavata's backend infrastructure and may be visible to other authorised subscribers according to the feature's visibility settings.

9.2 Users should not post personal, confidential, project-sensitive or culturally restricted material unless authorised and willing to share it with the indicated audience.

10. Payments and licensing

10.1 The App receives limited subscription/licence information needed to determine entitlement, such as plan/tier, status, seat information and relevant dates.

10.2 Payment-card information is not collected or stored by the App. Web-based payments are processed through Stripe where purchasing is offered.

10.3 Payment providers may retain transaction or billing information independently, including after an Excavata account is deleted, according to their legal obligations and policies.

11. Third parties and overseas processing

11.1 Depending on the features used, information may be processed by third party services including Supabase (accounts/licensing/community), Pipedream (bug reporting), Anthropic (optional AI), Google Cloud Vision (optional OCR), Open-Meteo (weather), mapping/tile providers, Stripe (web payments), and a cloud-storage or WebDAV provider selected by the User.

11.2 External requests also disclose ordinary network information such as an IP address to the service receiving the request.

11.3 Except to the extent set out in items 11.1 and 11.2 above, Excavata does not directly engage with any overseas entities or persons (“overseas recipients”) where a User’s Personal Information will be transferred, stored or disclosed overseas.

11.4 If we are required to transfer, store or disclose your Personal Information to an overseas recipient, we will obtain your consent before we do so.

12. Security

12.1 Excavata takes reasonable steps to protect the User’s Personal Information collected and stored by Excavata from misuse, interference, loss and unauthorised access, modification and disclosure. These steps include the use of technical measures appropriate to particular functions, including platform secure credential storage for supported credentials, HTTPS/TLS for supported internet services, access controls for backend functions, filtering of sensitive preference values from backups, release-log scrubbing and diagnostic redaction.

12.2 Local project data relies on the security protections of the device and operating system; the local SQLite database is not separately encrypted by Excavata.

12.3 Local-network peer-to-peer transfer is LAN-bound and token-authenticated but is not currently encrypted with TLS. Accordingly, this Policy does not claim that every data transmission is encrypted.

12.4 No security measure can eliminate all risk. Users are required to protect their devices, credentials and backups.

13. Breach Notification

13.1 If Excavata becomes aware of a notifiable Personal Information breach as defined under the laws, we will notify the Information Commissioner and the affected individuals in accordance with the requirements of the Privacy Act and any other applicable laws.

14. Analytics, advertising and tracking

14.1 Excavata does not currently include third-party analytics, advertising, attribution or crash-reporting SDKs and does not use the App to build advertising profiles.

14.2 This does not mean that external services receive no technical network information: a service necessarily receives information such as an IP address when the App communicates with it.

15. Retention

15.1 Local project data remains on the device until the User deletes it, resets the App or removes the relevant local storage.

15.2 Account and associated Excavata community/membership data are retained while the account exists, subject to the deletion process described below.

15.3 Cloud-backup retention is controlled through the App's backup-management functions and the User's chosen provider, subject to provider policies.

15.4 Excavata does not control all provider-side retention. In particular, final retention periods for payment records, delivered bug reports and external AI/OCR processing must be understood by reference to the relevant provider arrangements.

15.5 Excavata will delete any Personal Information of the Users within its control in accordance with item 16.5 of this Policy.

16. Deletion of Personal Information

16.1 The App provides an account-deletion function. It deletes the Excavata authentication account, the User’s community profile, the User’s organisation memberships, and any organisation of which the User is the sole member. Questions and replies the User has posted to the community board are not deleted but are de-identified: the link to the User’s account is removed and they are shown as posted by “[deleted user]”. If the User owns an organisation that has other members, ownership must be transferred before the account can be deleted.

16.2 Account deletion does not delete archaeological project data stored on the User's device or backups held in the User's own cloud account.

16.3 It also does not automatically erase records already held independently by external providers, such as Stripe billing records or bug reports already delivered to the bug-report service.

16.4 Excavata shall not be responsible for any loss of data caused by any User’s decision to utilise the account-deletion function.

16.5 Where Excavata has collected and stored Personal Information in connection with the provision of Services, Excavata will take all reasonable technical and organisational measures to de-identify or destroy the User’s Personal Information, unless Excavata is otherwise required by or under an Australian law or a court/tribunal order to retain the User’s Personal Information.

17. Accessing and correcting Personal Information

17.1 Users have the right to request details of the Personal Information that we hold about the User and to advise us of any inaccuracy in accordance with the provisions of the Privacy Act. If you would like a copy of such Personal Information or believe it to be inaccurate, out of date, incomplete, irrelevant, or misleading, please email us at the address given below.

17.2 Excavata will require you to verify your identity and to specify what Personal Information you require. We may charge a fee to cover the cost of verifying the application and locating, retrieving, reviewing, copying and amending any Personal Information as requested.

17.3 Excavata will respond to a User request for Personal Information within a reasonable period and will provide the User with the Personal Information that we hold about you, unless otherwise permitted or required by law.

17.4 If Excavata denies your request to access or amend your Personal Information, we will notify the User in writing regarding the basis for such denial unless an exception applies.

17.5 We take reasonable steps to ensure that the Personal Information a User has provided to us is accurate, complete and up to date, including updating Personal Information when you provide it to us. However, we rely on the User to advise Excavata of any changes or corrections to the Personal Information we hold about you.

18. Privacy complaints

18.1 A User may contact Excavata on the contact details given below if the User:

believes that Excavata has interfered with its privacy, or breached the Privacy Act;

no longer wants Excavata to collect, access, store or use the User’s Personal Information.

18.2 The User is required to provide Excavata with details of the complaint, as well as any supporting evidence and information.

18.3 Excavata will review the privacy complaints received and will seek to respond to the complaints promptly.

18.4 If a User is not satisfied with Excavata’s response, the User may discuss any concerns with or complain to the Australian Privacy Commissioner (Office of the Australian Information Commissioner) via www.oaic.gov.au.

19. Sale and marketing of personal information

19.1 Excavata does not sell Personal Information and does not use Personal Information for third-party advertising.

19.2 Marketing communications, if offered, are opt-in and should provide an appropriate means to unsubscribe.

20. Contact details

20.1 All complaints, correspondence and privacy related queries and concerns should be directed to Excavata via email to support@excavata.app.

21. Changes to this Policy

21.1 This Policy may be updated (in full or part) to reflect changes in the Services, providers or legal requirements. Please review this Policy periodically for changes.

21.2 If Excavata decides to change this Policy, we will host the revised Policy containing those changes on https://www.excavata.app/privacy so that the Users are aware of the changes.

22. Effective Date

22.1 This Policy shall be effective from 1 November 2026.