Privacy Policy

This Privacy Policy describes how Admiral Operations Pty Ltd (ACN 693 495 304) of Level 11, 49-51 York Street, Sydney, NSW, 2000, Australia (“Admiral”, “we”, “us”, “our”) collects, uses, discloses, and protects personal information when you visit our website, use our platform, or otherwise interact with us.

We are committed to protecting your privacy and complying with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and, where applicable, the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

1. Information we collect

We collect personal information in the following categories:

• Account information. Name, email address, company name, role, and password when you create an Admiral account.
• Billing information. Payment card details, billing address, and tax identifiers. Card data is processed directly by our PCI-compliant payment processor; we do not store full card numbers.
• Usage data. Log data, device identifiers, IP address, browser type, pages viewed, and actions taken within the platform.
• Fleet telemetry. Metadata about the Linux devices you manage through Admiral, including hardware identifiers, software versions, health metrics, and configuration state.
• Assistant conversations. If you use AdmiralAI, the Admiral assistant with its hosted model, the messages, tool results and replies of that conversation. See section 7.
• Communications. Emails, support tickets, and any other correspondence you send us.
• Cookies and similar technologies. Necessary cookies for authentication and session management, and limited analytics cookies to understand how our site is used.

2. How we use your information

We use personal information to:

• Provide, operate, and improve the Admiral platform
• Authenticate users and secure accounts
• Process payments and manage subscriptions
• Communicate with you about your account, our services, and product updates
• Provide customer support
• Detect, investigate, and prevent fraud, abuse, and security incidents
• Comply with our legal and regulatory obligations

3. Legal bases for processing

Where the GDPR applies, we process personal information on the following legal bases: performance of a contract with you, our legitimate interests in operating and improving our business, your consent (where required), and compliance with legal obligations.

4. How we share information

We share personal information only as needed, with:

• Service providers (subprocessors). Cloud hosting, payment processing, email delivery, analytics, and customer support tooling. A current list of subprocessors is available on request by emailing privacy@admrl.co.
• Legal and regulatory authorities. Where required by law, court order, or to protect the rights, property, or safety of Admiral, our users, or others.
• Business transfers. In connection with a merger, acquisition, or sale of assets, in which case we will notify affected users.

We do not sell personal information.

5. Data storage and transfers

Admiral's primary infrastructure is hosted in Australia. We offer regional data residency in the United States, European Union, and Asia Pacific for customers who require it. Where personal information is transferred outside your country, we rely on appropriate safeguards, including Standard Contractual Clauses where applicable.

6. Data retention

We retain personal information for as long as necessary to provide the services, comply with our legal obligations, resolve disputes, and enforce our agreements. Account data is typically deleted or anonymised within 90 days of account closure unless a longer retention period is required by law.

7. AdmiralAI, the Admiral assistant

AdmiralAI is the assistant in the Admiral dashboard. It can use the Admiral MCP server (which is open source) to read information about your fleet with your own permissions. How your data is handled depends on which model you choose:

• Hosted by Admiral (default). Your messages and the tool results that AdmiralAI reads go through Admiral's backend to our model provider, with data collection disabled at the provider. We keep a transcript of each hosted conversation for 30 days so we can review abuse, then delete it. Only Admiral platform staff can read transcripts, and that access is audited. Hosted conversations are not copied into your organisation's audit log.
• Your own endpoint. If you enter your own OpenAI-compatible endpoint, your browser calls it directly. The traffic and your API key never reach Admiral. The key is kept in your browser, on this device or for the session only, as you choose.
• In your browser. Saved chats live in your browser's local storage, per user and organisation, and you can delete them at any time. If you export a chat to send to Admiral support, the file does not contain your API key or session token, and Admiral support can open it read-only.

AdmiralAI treats tool output and text reported by devices as untrusted data and asks for your approval before any change, but no safeguard against prompt injection is complete. Do not put secrets into a hosted conversation. We use hosted usage counts (not content) for billing and rate limiting.

8. Security

We implement industry-standard technical and organisational measures to protect personal information, including encryption in transit (hybrid post-quantum TLS 1.3) and at rest (AES-256), strict access controls, continuous vulnerability monitoring, and 24/7 infrastructure monitoring. No system is perfectly secure, but we take security seriously and are transparent about our posture on our Security page.

9. Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information
• Object to or restrict certain processing
• Request a portable copy of your information
• Withdraw consent where processing is based on consent
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email privacy@admrl.co. Australian residents may also contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Children

Admiral is a business-to-business platform and is not directed at children under the age of 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates when it was last revised. Material changes will be notified to account holders by email or through the platform.

12. Contact us

For privacy questions, requests, or complaints, contact our Privacy Officer:

• Email: privacy@admrl.co
• Post: Privacy Officer, Admiral Operations Pty Ltd, Level 11, 49-51 York Street, Sydney, NSW, 2000, Australia

We aim to respond to all privacy enquiries within 30 days.