Maintained by Aquafruit Media Pty Ltd (ABN 72 126 463 434), Suite 151, 139 Cardigan Street, Carlton VIC 3053, Australia. Last updated: August 2026.
1. Purpose and scope
This page describes the security and data-handling practices Aquafruit Media Pty Ltd ("Aquafruit") applies to the aquafruit.io website — a marketing site featuring the Talora AI chat assistant, AI-assisted article generation, and a contact form. It is not an audit report, certification, or independent attestation, and it is updated periodically as our practices evolve.
The security controls, contractual commitments and operational detail for the Aquafruit Growth Engine client platform are described separately, in documentation provided to Growth Engine customers. That is customer documentation only — it does not limit the vulnerability disclosure policy in section 7, which covers grow.aquafruit.io as well as this website. Vulnerabilities found on the Growth Engine should be reported through section 7.
2. What data we collect
Through this website, we collect: information you submit via the contact form (name, email address, and message); transcripts of conversations with the Talora chat assistant; and aggregate site analytics (page views and similar usage data), collected only after cookie consent is granted. Full detail is in our Privacy Policy.
3. How we protect it
Data in transit is encrypted using TLS 1.2 or above. Access to administrative functions — content management, Talora configuration, and lead data — requires authenticated sign-in, is role-restricted, and is logged.
4. Legal basis
Personal information collected through this website is handled in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Full detail on what we collect, why, how long we retain it, and your rights is set out in our Privacy Policy.
5. Third parties
We share data with a limited number of vetted subprocessors to operate this website. The complete list, including purpose and data categories, is published on our Subprocessors page.
6. If something goes wrong
Aquafruit maintains an internal incident response process. Where a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).
7. Vulnerability disclosure policy
How to report. Email [email protected] with the subject line "Security". Include the affected host or URL, a clear description of the issue, the steps needed to reproduce it, evidence of the impact you observed, and the date and time of your testing. Reports in English are preferred.
Scope. This policy covers aquafruit.io, aquafruit.net and the Aquafruit Growth Engine at grow.aquafruit.io, including their subdomains. Third-party services we use, and systems belonging to our clients or suppliers, are out of scope.
No bounty. Aquafruit does not operate a paid bug bounty and does not pay for vulnerability reports. Reports are reviewed on their merits regardless.
No unvalidated scanner output. Reports consisting of automated scanner findings without demonstrated impact will not be actioned. Please show what an attacker could actually do.
Safe harbour. If you research in good faith and stay within this policy and its scope, Aquafruit will not treat your activity as unauthorised access and will not pursue action against you in relation to it. The conditions are: do not access, modify, exfiltrate or retain data that is not your own; do not degrade, disrupt or overload the service; no social engineering of our people, clients or suppliers; no physical access attempts; report promptly; and do not disclose the issue publicly before we have responded. This does not waive the rights of any third party.
What to expect. We aim to acknowledge reports within five Australian business days and will let you know the outcome of our assessment. We do not commit to a remediation timeframe; fixes are prioritised by severity and exposure.
Reports involving personal information. If a report involves access to, or exposure of, personal information, it is escalated to [email protected] and handled as a privacy matter, including any assessment and notification obligations under the Notifiable Data Breaches scheme. Please do not download, copy or retain any personal information you encounter — describe it instead.
8. Contact
Security vulnerabilities and disclosure reports: [email protected] (see section 7). Privacy enquiries and requests also go to this address.
General enquiries: [email protected]
Phone: +61 3 7003 9474
9. What this page is not
This page is app-owned editable content. It is not an independent certification and does not constitute a warranty. Nothing on this page overrides or limits any Non-Excludable Right under the Australian Consumer Law.
Last updated: August 2026