1. Identity and Contact Details (APP 1.4(a))
This privacy policy is provided by Rockhawk Pty Ltd trading as Leagen (ABN 17 673 537 123) ("Leagen", "we", "us", "our").
Leagen provides an AI-powered chatbot and CRM platform for Australian Registered Training Organisations (RTOs). Our platform enables RTOs to deploy AI agents on their websites that handle student inquiries, course enrolments, and knowledge management.
Privacy Officer: privacy@leagen.co
You can also reach us through our contact page.
2. Types of Personal Information Collected (APP 1.4(b))
We may collect the following types of personal information depending on how you interact with our platform:
- Identity information: Name, email address, mobile phone number
- Chat transcripts: Messages exchanged with AI agents via the chat widget
- Enrolment data: Course preferences, enrolment status, prerequisite completion, USI (Unique Student Identifier)
- Technical information: IP addresses, browser user-agent strings, cookie identifiers, session identifiers
- Account information: Workspace name, team member details (for RTO administrators)
3. How Personal Information is Collected (APP 1.4(c))
We collect personal information through the following means:
- Chat widget conversations: When you interact with an AI agent on an RTO's website, your messages are recorded to provide continuity and enable human oversight
- Enrolment forms: When you proceed through the enrolment process, information is collected to facilitate your enrolment with the RTO
- OTP verification: When you verify your identity via SMS one-time password during enrolment
- Automated logging: Technical information is collected automatically during chat sessions for security and service improvement purposes
- Account registration: When RTO administrators create accounts on the Leagen platform
4. Purpose of Collection (APP 1.4(d))
We collect personal information for the following primary purposes:
- Enrolment processing: Facilitating course enrolments on behalf of RTOs, including eligibility assessment, prerequisite verification, and payment processing
- Customer support: Enabling AI-powered responses to student inquiries about courses, fees, schedules, and prerequisites
- Service improvement: Analysing conversation patterns to improve AI response quality and knowledge base accuracy
- Compliance with legal obligations: Meeting requirements under the Privacy Act 1988, ASQA Standards for RTOs, and NCVER data collection requirements
- Security and fraud prevention: Protecting the platform and users from unauthorised access, misuse, or abuse
5. Disclosure to Third Parties (APP 1.4(e))
We may disclose your personal information to the following third parties:
- aXcelerate (sub-processor for student management) — Your enrolment data is transmitted to the RTO's student management system for processing and record-keeping
- National Centre for Vocational Education Research (NCVER) — RTOs are legally required to report VET (Vocational Education and Training) student data to NCVER. This is a mandatory government requirement, not a commercial disclosure
- Supabase (database hosting) — Your data is stored in Supabase-hosted PostgreSQL databases
- Vercel (application hosting) — The platform is hosted on Vercel's infrastructure
- OpenAI / Anthropic (AI model providers) — Chat messages are processed by AI models to generate responses. These providers do not store personal information from API calls beyond temporary processing
6. Overseas Disclosure (APP 1.4(f))
Your personal information is primarily stored in Australia. Specifically:
- Primary data residency: Sydney, Australia (AWS ap-southeast-2 region) via Supabase
- Application hosting: Vercel may process requests through global edge locations, though application data remains in the primary database in Sydney
- AI model providers: OpenAI and Anthropic may process chat messages in the United States. These providers process data transiently and do not retain personal information from API calls
We take reasonable steps to ensure that overseas recipients of personal information comply with the Australian Privacy Principles.
7. Access and Correction (APP 1.4(g))
You have the right to request access to, and correction of, your personal information held by us.
- For students: Contact the RTO that deployed the chat agent you interacted with. The RTO is the data controller and will coordinate with Leagen as needed to fulfil your request.
- For RTO administrators: You can access and update your account information directly through the Leagen platform. For data export or deletion requests, contact privacy@leagen.co.
We will respond to access and correction requests within 30 days. We may refuse access in limited circumstances permitted by the Privacy Act 1988, in which case we will provide reasons.
8. Complaints (APP 1.4(h))
If you have a complaint about how we handle your personal information:
- Contact us first: Email privacy@leagen.co with details of your complaint. We will acknowledge receipt within 5 business days and respond within 30 days.
- Escalation: If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5218, Sydney NSW 2001
9. Automated Decision-Making (APP 1.8)
Leagen uses automated systems (AI chatbots) as part of its platform. The following decisions may involve automated processing of your personal information:
Course Recommendations
We use your profile information, interests, and learning history to provide course recommendations. These recommendations are generated by automated systems (AI chatbot) designed to assist rather than replace human judgment. You are free to disregard any automated recommendation.
Enrolment Processing
Your eligibility for enrolment is assessed using automated systems that evaluate prerequisite completion and enrolment criteria based on your personal information. You have the right to request a human review of any automated enrolment decision. To request human review, contact the RTO directly or ask the chatbot to connect you with a human agent.
Conversation Routing
The AI system may automatically assess conversation sentiment and confidence levels to determine when to escalate a conversation to a human agent. This routing is designed to ensure you receive appropriate support.
10. Processor/Controller Distinction
Leagen acts as a data processor on behalf of the RTO (data controller). Your enrolment data is governed primarily by the RTO's own privacy policy. Leagen's role is limited to facilitating the enrolment process and student inquiry handling on the RTO's behalf.
This means:
- The RTO determines what personal information is collected and why
- Leagen processes that information only as directed by the RTO
- Data subject requests (access, correction) should be directed to the RTO in the first instance
- Leagen and the RTO enter into a Data Processing Agreement (DPA) that governs this relationship
11. Data Retention (APP 11.2)
We retain personal information for as long as your account (or the RTO's account) remains active on the platform.
- Account closure: On account closure, data is soft-deleted (marked as inactive) rather than permanently erased. This approach supports audit trail integrity and compliance with ASQA record-keeping requirements.
- Enrolment-linked data: Data associated with enrolments processed through aXcelerate is retained in accordance with the RTO's NCVER data retention agreement. RTOs are required to retain student records for specified periods under ASQA Standards for RTOs 2015.
- Chat transcripts: Retained while the RTO's account is active. Available for export on request.
Australia does not have a general right to erasure. Under APP 13, you have the right to request correction of inaccurate information, but not deletion of accurate records that we are required or authorised to retain.
12. Cookies and Browser Storage
Leagen uses cookies and browser storage to support account access, preferences and chat continuity. Authentication cookies maintain login sessions. Local storage and session storage can retain chat identifiers, messages, widget state and preferences such as currency or calculator inputs.
The storage used depends on the features you access. Local storage can remain across visits until cleared, while session storage is normally cleared when its browser tab closes. Authentication cookie expiry is managed by our authentication service.
You can manage cookies and site storage in your browser. Removing or blocking them may sign you out, reset preferences or interrupt chat continuity. It does not itself delete information already submitted to the service. A customer website hosting our widget may also use its own technologies under its own policy.
For details about purposes, storage and controls, see our Cookie Policy.
Effective Date: 13 September 2026
Last Updated: 13 September 2026
Version: 1.0
