Privacy Policy

Immersive Realities Pty Ltd ("Immersive Realities", "we", "us", or "our") is committed to protecting your privacy and managing your personal information in an open, transparent, and respectful manner. We comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Privacy and Other Legislation Amendment Act 2024 (Cth).

This Privacy Policy applies to all personal information collected through our website at immreal.io, our spatial computing, AI, and extended reality (XR) platforms, and related digital services (collectively, the "Services").

---

1. Overview and Commitment

Immersive Realities designs, builds, and deploys AI, digital twin, and extended reality systems for enterprise. We are committed to protecting your privacy and managing your personal information in an open, transparent, and respectful manner across every part of our business — from this website through to the spatial computing and immersive applications we build for our clients.

2. Information We Collect

We collect personal information that is necessary to deliver our immersive solutions, maintain secure account infrastructure, and provide seamless spatial computing experiences.

2.1 Personal information provided directly (APP 3)

• Account & contact data: Your name, email address, phone number, organisation details, password credentials, and billing details.
• Communications: Correspondence, support requests, survey responses, and feedback submitted via immreal.io — including through our contact form.

2.2 Spatial telemetry, XR & technical data

Where we deliver spatial computing platforms for our clients, we process technical telemetry required for immersive rendering:

• Spatial pose & motion data: Real-time head, controller, and hand positioning data necessary for frame rendering and multiplayer spatial synchronisation.
• Spatial mesh data: Bounding geometry and volume metrics of a physical interaction space, processed locally on-device wherever feasible and stripped of physical visual room capture.
• Device & network identifiers: IP address, device hardware model, operating system version, browser type, and unique XR headset identifiers.

2.3 Sensitive information & biometrics

• We do not collect sensitive information (for example, health data or racial/ethnic origin) unless strictly necessary, explicitly consented to, and permitted under APP 3.3.
• Where eye-tracking or dynamic gesture analytics are used for interaction within XR applications we build, this raw biometric telemetry is processed transiently on local hardware and is never transmitted to or stored on external servers without explicit, opt-in consent.

2.4 Children's privacy

Our website and services are intended for general adult audiences and enterprise users. We do not knowingly collect personal information from children under the age of 18 without verifiable parental or guardian consent.

3. How We Collect Personal Information

We collect personal information through lawful, fair, and non-intrusive means:

• Direct interaction: When you complete our contact form, subscribe to updates, or contact us directly.
• Automated technologies: When you visit immreal.io, system logs and analytics tools capture technical operational data (see Section 12).
• Third parties: When authorised by you, via integrated identity providers (for example, enterprise single sign-on systems or OAuth providers).

4. Purposes for Collecting, Holding, Using, and Disclosing Information (APP 6)

We collect, hold, use, and disclose personal information for purposes including:

• Service delivery: Responding to enquiries, scoping engagements, and client onboarding.
• Platform optimisation: Monitoring platform performance and improving usability.
• Customer support: Responding to technical queries and resolving service disruptions.
• Security & fraud prevention: Detecting unauthorised access, cyber threats, and misuse of immreal.io.
• Direct marketing: Providing updates, product releases, and newsletter communications, only where you have explicitly opted in or where legally permissible, with an option to opt out at any time.

We process your personal information only in ways that are fair and reasonable in all circumstances, consistent with reasonable user expectations.

5. Automated Decision-Making (ADM) and AI Disclosure

• Immersive Realities uses automated systems and algorithmic logic across immreal.io to detect fraudulent login attempts, optimise site performance, and personalise content.
• Impact & governance: None of our automated decision-making processes produce legal or similarly significant effects on individuals without human review.
• User rights: You may request details on how an automated decision affecting your account was made, or request human review, by contacting privacy@immreal.io.

6. Disclosure of Personal Information to Third Parties & Overseas Transfers (APP 8)

6.1 Third-party service providers

We disclose personal information to trusted third-party service providers who help us operate our business:

• Cloudflare, Inc. (United States) — website hosting, CDN, security, Cloudflare Web Analytics, and Turnstile spam protection on our contact form.
• Google LLC (United States) — website analytics (Google Analytics 4).
• Resend Inc. (United States) — transactional email delivery for contact form notifications and acknowledgements.
• LinkedIn Ireland Unlimited Company (Ireland) — our company social media presence.

6.2 Overseas disclosures

Where our service providers operate overseas — including Cloudflare, Google, and Resend in the United States, and LinkedIn in Ireland — we take reasonable steps under APP 8.1 to ensure overseas recipients do not breach the Australian Privacy Principles, including by contractual data protection obligations equivalent to Australian standards.

7. Direct Marketing and Consent Management

• No bundling or pre-ticked boxes: We obtain clear, affirmative, specific, and unambiguous consent for marketing communications. We do not use pre-ticked consent boxes or bundled consent agreements.
• Opt-out mechanism: You can unsubscribe from direct marketing at any time via the "Unsubscribe" link in any marketing email, or by contacting privacy@immreal.io.

8. Data Security and Safeguards (APP 11)

We protect your personal information against misuse, interference, loss, unauthorised access, modification, or disclosure through security measures including:

• Encryption: TLS encryption for all data in transit across immreal.io.
• Access control: Role-based access controls and multi-factor authentication for internal administrative access.
• Infrastructure: Cloudflare's security infrastructure, including DDoS mitigation, Web Application Firewall, and bot/spam protection via Turnstile.
• Restricted access: Internal access to personal information on a need-to-know basis.

No method of transmission over the internet is completely secure. While we take reasonable precautions, we cannot guarantee the absolute security of information transmitted to us.

9. Data Retention and Destruction

Personal information is retained only as long as necessary to fulfil the operational or legal purposes for which it was collected. When personal information is no longer required, we take reasonable steps to permanently destroy or securely de-identify it. Full retention periods by data category, and our destruction and de-identification standards, are set out in our Data Retention & Destruction Policy.

10. Notifiable Data Breaches (NDB) Scheme

In the event of a security incident resulting in unauthorised access to or disclosure of personal information likely to cause serious harm to any individual:

• We will conduct an immediate assessment pursuant to Part IIIC of the Privacy Act 1988 (Cth).
• If an eligible data breach is confirmed, we will promptly notify the Office of the Australian Information Commissioner (OAIC) and affected individuals, detailing the breach and recommended mitigation steps.

11. Access, Correction, and Individual Rights (APP 12 & APP 13)

11.1 Accessing your data

You have the right to request access to the personal information we hold about you. To submit a request, email privacy@immreal.io. We will respond within 30 days.

11.2 Correcting your information

If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, contact us to request a correction.

11.3 Statutory rights & tort protection

Under Australian privacy law, individuals are protected against serious, intentional, or reckless invasions of privacy. Immersive Realities maintains rigorous data governance to respect these rights and prevent intrusive data handling practices.

12. Cookies and Web Tracking

immreal.io uses the following to ensure site functionality and measure platform engagement:

• Cloudflare Web Analytics — a privacy-first analytics service that does not use cookies, does not track individual users across websites, and does not collect personally identifiable information. It provides aggregated, anonymised data about website traffic.
• Google Analytics 4 — uses cookies and similar identifiers to collect information about how visitors use the site, such as pages viewed, session duration, and approximate geographic location. This information is used in aggregated form to understand site usage and improve our content.

You can prevent Google Analytics from collecting your data using the Google Analytics Opt-out Browser Add-on, or by blocking analytics cookies in your browser. You can adjust your browser settings to refuse non-essential cookies at any time.

13. Privacy Contact, Complaints, and Escalation

If you have questions, concerns, or a complaint regarding how Immersive Realities handles your personal information, please contact our Privacy Officer:

Internal dispute resolution

• Submit your complaint in writing to privacy@immreal.io.
• We will acknowledge receipt within 5 business days and investigate your complaint.
• We will provide a formal written response within 30 days.

External escalation

If you are unsatisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Address: GPO Box 5288, Sydney NSW 2001
• Phone: 1300 363 992
• Website: www.oaic.gov.au

This Privacy Policy was last updated on 1 October 2026. We may update it from time to time to reflect changes in our practices, technology, or legal requirements; any changes will be posted here with a revised date.