FacilityVR Privacy Policy

1.1 Account & Organisation Data

When an organisation registers for FacilityVR, purchases credits, or executes a Statement of Work (SOW), we collect administrative contact information, including:

• Name, business email address, phone number, and job title.
• Organisation name, industry sector, and billing details.
• Authentication credentials and system access permissions.

1.2 Customer Ingested Materials & Facility Data (SE Curation)

When your organisation engages us for turnkey facility digitisation or Solutions Engineer (SE) curation, you may upload or transmit technical operational materials ("Ingested Materials"), including:

• CAD drawings, BIM models, 3D mesh files, and LIDAR point-cloud scans.
• Facility floorplans, schematics, high-resolution photo walkthroughs, and equipment placement lists.
• Standard Operating Procedures (SOPs), safety manuals, assessment rubrics, and custom courseware logic.

1.3 Learner Performance & Telemetry Data

During interactive VR and desktop training exercises, the Service automatically collects operational performance telemetry, including:

• Scenario completion status, step-level interaction scores, procedural error counts, and time-stamped task logs.
• Virtual equipment interaction telemetry and hazard identification speed.
• No Biometric Data: FacilityVR does not collect, scan, or store biometric identifiers, including facial recognition data, eye-tracking vectors, heart rate, or other physiological measurements.

1.4 Automatically Collected Technical Data

When you access the web portal or launch VR desktop runtimes, we collect technical log data, including:

• IP addresses, browser type, operating system, device hardware specs, and headset model IDs.
• Platform credit transaction logs, session durations, and error reports.

3.1 Authorised Human Processing (Solutions Engineers)

Unlike fully automated self-serve software, our turnkey model involves human-in-the-loop technical curation. You acknowledge and agree that authorised Solutions Engineers and technical support personnel will view, inspect, and process your uploaded Ingested Materials and scenario configurations solely to build, test, and maintain your custom virtual environments.

3.2 Specialised 3D & Spatial Sub-Processors

To prepare CAD files and LIDAR data for real-time VR playback, Solutions Engineers may process Ingested Materials using enterprise 3D modelling, spatial conversion, and photogrammetry software. All third-party sub-processors used in this workflow are bound by strict enterprise confidentiality, security, and zero-retention data protection agreements.

3.3 Payment Processing

Payment transactions are processed through Stripe. We do not store complete credit card information on our servers. Stripe maintains your payment details according to its own privacy policy.

4.1 Zero AI Model Re-Training Guarantee

Your Ingested Materials, structural facility blueprints, CAD files, proprietary operational procedures, and custom courseware prompts are NEVER used to train, fine-tune, or improve public or commercial AI models (including models serving other customers).

4.2 AI Sub-Processor Processing

Generative AI tools utilised within the platform (or internally by SEs during drafting) send text or spatial prompts to third-party enterprise AI providers (currently Anthropic) via privacy-isolated API connections. Prompts are processed strictly to fulfil the immediate computational request and are subject to zero-data-retention policy agreements.

11.1 Where your data is processed

FacilityVR is operated by Facility Labs from Australia. Customer data (account details, training records, scenarios, layouts, application submissions) is stored on Microsoft Azure infrastructure. AI features are processed by Anthropic (United States) on a per-request basis; AI prompts and the immediate context required to fulfil them are sent to Anthropic and processed under their own data-handling terms. Email is delivered through Mailgun.

11.2 Australian customers

Where data is disclosed to overseas recipients (including AI processing in the United States), We take reasonable steps to ensure the recipient handles personal information in a manner consistent with the Australian Privacy Principles, in accordance with APP 8 of the Privacy Act 1988 (Cth). By using the Service, you also acknowledge and consent to your information being transferred to and processed in jurisdictions outside Australia, including the United States.

11.3 Singapore customers

Where data is transferred outside Singapore (including to Australia, where we are based, and to the United States for AI processing), the transfer is made on the basis of (i) your consent to such transfer through your acceptance of these terms and (ii) FacilityVR taking reasonable steps to ensure recipients are bound to a comparable standard of protection, consistent with section 26 of the Singapore Personal Data Protection Act 2012. You may withdraw your consent to such transfer at any time, but doing so will mean we can no longer provide the Service to you.

11.4 Malaysian customers

Where data is transferred outside Malaysia (including to Australia and the United States), the transfer is made on the basis of your express consent through acceptance of these terms, in accordance with section 129 of the Malaysian Personal Data Protection Act 2010. We take reasonable precautions to ensure that recipients of personal data outside Malaysia handle the data in line with the standards set by the Act. You may withdraw your consent at any time; doing so will mean we can no longer provide the Service to you.

11.5 Other jurisdictions

For users outside Australia, Singapore, and Malaysia, your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws. By using our Service, you consent to such transfers and accept that the Service may not be specifically tailored for the law of your jurisdiction. Where local mandatory consumer-protection or privacy law provides rights that cannot be excluded by contract, those rights continue to apply.

12.1 We remain a data processor / handler

We continue to process this data as part of operating the Service: storing it, making it available to authorised Employer-tier users, and providing access / correction / deletion mechanisms in accordance with this Policy and applicable law.

12.2 The Employer organisation is a separate controller

On receipt of an application, registration, or directory record, the Employer organisation handling that data becomes a separate data controller (or the equivalent term in the applicable jurisdiction — APP entity under Australian law, "organisation" under Singapore PDPA, "data user" under Malaysian PDPA). The Employer is responsible for its own privacy notice, retention policy, and security measures over data it has received. We require Employer-tier customers to commit to such obligations under our Terms of Service (Section 10.3).

12.3 Data-subject requests

Where you exercise an access, correction, or deletion right with us:

• We will action the request against data held in our systems within a reasonable period (and within any timeframe required by applicable law).
• For data already received by an Employer organisation in connection with an application or directory visibility you opted into, we will, on your request, notify the Employer of your request in good faith. However, the Employer is the controller of that copy and we cannot compel them to action your request. You may need to contact the Employer directly.

12.4 Limits on Employer use

Employers receiving data via the Service have agreed (in our Terms of Service) not to use that data for purposes other than evaluating the application or registration to which it relates, and not to sell or commercially disclose the data. We rely on this contractual undertaking. If you become aware of a misuse, you may report it to us at privacy@facilityvr.com and we will investigate and take appropriate action with the Employer concerned.

13.1 What’s visible by default

By default, your training records, profile, and bio are visible only to your own organisation and to us. They are NOT visible to any external Employer organisation, to other learners, or to the public.

13.2 Opt-in directory visibility

Learners may opt in to either or both of the following visibility settings, separately and at any time through their account settings:

• Visible to your organisation’s industry partners: Employer-tier organisations that have an accepted industry-partnership relationship with your organisation can see your name, completed courses, and bio in their directory.
• Visible to all employer-tier organisations: Any Employer-tier organisation on FacilityVR can see your name, completed courses, and bio in their directory.

Both settings default to OFF. Either setting can be turned off at any time. The Learner Directory does NOT display your email address, phone number, or any other contact detail. Employer-tier organisations contact candidates only through the platform’s structured application and registration flows.

13.3 Applying to a job or registering for an event

When you apply for a job posted on FacilityVR or register for a career event:

• Your name, email address, the answers you provide on the application form, and any attachments you upload are sent to the Employer that posted the role or event.
• Your training history (completed courses and assessment outcomes from your FacilityVR records) is included with the application unless you indicate otherwise on the application form.
• Once received, the Employer is a separate data controller (see Section 12.2) and handles your data under its own privacy notice and policies.
• The status of your application or registration (e.g., reviewing, shortlisted, completed) is shared between you and the Employer through the platform.

13.4 Withdrawing an application

You may withdraw an application or cancel a registration at any time. Withdrawing removes the application from the active queue but does not automatically delete the copy already received by the Employer; you may contact the Employer directly to request deletion of their copy.

13.5 Children and minor learners on Career Portals

Where a learner is under 18, the directory and application features remain disabled by default. A school administrator or parent / guardian must explicitly enable these features for a minor’s account. We do not knowingly facilitate Employer-tier access to a minor’s profile or applications without such explicit consent. See also Section 10.

13.6 Applying or registering without an account

You can apply for some jobs, and register for some career events, on our public careers pages without a FacilityVR account. When you do:

• We collect your name, email address, an optional phone number, the answers you give on the employer’s form, and any files you upload (such as a CV). We check your email address with a one-time code. The code doesn’t sign you in or create an account.
• We send what you give to the Employer named on the form. Once it’s received, the Employer is a separate data controller (see Section 12.2) and handles it under its own privacy notice.
• We keep your application or registration for 12 months after the job closes or the event ends, then delete it with its files. Email checks are deleted after a day.
• You can withdraw at any time with the link in your confirmation email. Withdrawing deletes your application or registration, and its files, from our systems at once. A copy the Employer has already downloaded is theirs; contact them to delete it.
• If you have a FacilityVR account, apply with it instead (the form links to it). An application made without signing in isn’t added to your account unless the Employer invites you and you accept.
• The Employer may invite you to FacilityVR. Nothing changes unless you accept. If you do, an account is made for you (or the Employer is added to the account you have), and your application or registration becomes part of it, kept as Section 8 describes.
• An Employer may mark an application or registration as spam. We then delete it, and keep your email address on that Employer’s block list, which stops guest applications from that address to that Employer.
• We don’t use these details for marketing or add you to a mailing list.

14.1 What your AI assistant sends us

When your AI assistant uses FacilityVR Careers Hub, it sends us a request it has written: the tool it is using and what it is looking for, such as a job title or a place you mentioned. We don’t receive your conversation. We never ask for your name, your contact details or your device’s location.

Some AI assistants also send a general location (such as your country), a language setting, or an anonymous identifier for you. We use the location and the language setting only to choose between "data centre" and "data center". We use the identifier, and the internet address the request comes from, only to limit how many requests each can make in a minute. Our servers hold them in memory for that minute. We never write them to storage or to our logs.

14.2 What we keep

For each request, we write one line to our service logs: the tool, what it asked for (up to 200 characters), the name of the assistant’s app, whether it worked, and how long it took. These logs are kept for 30 days, then deleted.

We also count requests by tool, by result, by assistant app, and by the country, region (such as a state) and job role asked about. The counts hold no request text and nothing that identifies anyone. Only Facility Labs’ platform staff can see them. They are never shown to, or used for, any employer or recruitment agency on FacilityVR, including Facility People, the recruitment agency Facility Labs runs.

14.3 Cards and links

Some assistants show an answer as a card. A card can show an employer’s logo, which your device loads from our servers like an image on our website (see Section 1.4). Links in an answer open our public careers pages. Applying or registering there is covered by Section 13.

14.4 Your AI assistant’s provider

Your AI assistant’s provider, such as OpenAI or Anthropic, handles your conversation under its own privacy policy. We don’t control what it keeps.

16.1 What the figures are

Market Intelligence counts what employers ask for in data centre job ads they publish on their own careers sites and applicant tracking systems. It holds what an ad asks for, never its text, and job ads carry no information about candidates. The figures are aggregates: they name no employer and contain no personal information.

16.2 Enquiries

When you send an enquiry from facilitylabs.ai, what you type (your name, email address, organisation, country and message) is emailed to our team through our email provider, Mailgun, and is not stored by the Service. We keep the email for as long as the enquiry is open. We limit how many enquiries come from one IP address, which we hold in memory and never write down.

16.3 Subscriber accounts and named seats

A subscription belongs to an organisation, and each of its seats to a named person with their own account. We hold each account’s name, email address and organisation, who holds a seat and since when, who gave it, and sign-in records as Section 1.4 describes. The organisation’s administrator sees who holds its seats. We use this to give seat holders the dashboard, to keep the subscription to the seats it includes, and to support the organisation.

If your organisation uses FacilityVR, its Market Intelligence subscription comes with it, and its administrator names the seat holders in the same way.

16.4 Subscribing by card

You can subscribe on facilitylabs.ai without an invitation. When the payment succeeds, we create an organisation and an account for the email address you gave, with you as its administrator and first seat holder, and email you how to sign in. We keep a record of the purchase: the plan, your name, email address and organisation, the version of the subscription terms you accepted, and Stripe’s references for the payment and subscription.

Payment is handled by Stripe, as Section 3.3 describes: your card details, billing address and any tax number go to Stripe, which also calculates tax and sends your receipts. We never see or store your card details. We keep the purchase record for as long as the law requires us to keep records of a sale: five years, under Australian tax law.

16.5 The newsletter

Facility Labs sends a monthly newsletter in two editions. The free edition goes only to people who ask for it on facilitylabs.ai, and only after they confirm by clicking the link in the email we send to the address they gave. Until then we send nothing else to that address. The subscriber edition goes to each named seat holder of a Market Intelligence subscription, as part of the subscription, while they hold the seat. A seat holder receives the subscriber edition in place of the free one.

For the newsletter we hold your email address, the editions you receive, and the record of your consent: the wording you agreed to, when you signed up and when you confirmed. If you stop a newsletter, we record when, so that we don’t send it again. We record which editions we sent to your address and whether they were delivered. We don’t keep your IP address, and we don’t track whether you open a newsletter or click its links.

Every newsletter email carries an unsubscribe link and a one-click unsubscribe that your email program can offer. Either takes effect at once, and in any case within five business days. You can choose which editions you receive, or stop all of them, from the preferences link in any newsletter or by asking for a link at facilitylabs.ai/newsletter/. Each email says who sent it and how to contact us, and gives our postal address.

We send the newsletter in line with Australia’s Spam Act 2003, the UK and EU GDPR and the e-Privacy rules (on the basis of your consent, or for seat holders, our legitimate interest in serving the subscription they use), and the US CAN-SPAM Act. The newsletter is sent through our email provider, Mailgun, from a sending domain of its own. We never sell, rent or share the list. We keep your address while you receive a newsletter, and the record of your consent and of your unsubscribing for three years after you unsubscribe, so we can show you consented and make sure we don’t write to you again. You can ask us to delete it sooner.

16.6 Reports and report requests

Subscribers’ named seat holders read our published reports on facilitylabs.ai, and an organisation that commissions a special-purpose report reads it there too. Each report opens through a link made for the person who asked, which works for a few minutes. Beyond our servers’ ordinary request logs, we keep no record of who opened which report.

When a seat holder asks us for a special-purpose report, we keep the request: what it is about, the details they give, who sent it and for which organisation, and our progress on it with any note we add. Their organisation sees its requests and our notes. The request is also emailed to our team through Mailgun. We keep requests for as long as the subscription lasts and then as a record of the sale, for five years. Anyone without a subscription asks through the enquiry form, which section 16.2 covers.

17.1 Registering interest in a course

On some courses you can register interest instead of enrolling: to hear from the provider, to ask a question, or to be told when enrolment opens. You can do this on FacilityVR Courses without an account, or signed in, in the course catalogue in FacilityVR. When you do:

• We collect your name and email address, and the details you choose to add: a phone number, your country, your postcode or town, the intake you’d prefer and a message. We also keep whether you asked to be emailed when enrolment opens, and the line you agreed to (that the provider may contact you about the course), with when you agreed.
• Without an account, we check your email address first with a one-time code. The code doesn’t sign you in or create an account. Email checks are deleted after a day.
• We make your registration available to the course’s provider: its staff see it in the course’s list of registrations and can download that list. We tell them someone has registered, naming you and the course. The provider may contact you about the course, and its staff may add a status and notes to your registration. Once received, the provider is a separate data controller for what it holds, as an Employer is (see Section 12.2), and handles it under its own privacy notice.
• If you asked, we email you once when enrolment opens for the course or one of its intakes.
• Every email we send you about it has two links. One stops the "enrolment is open" emails and keeps your registration. The other withdraws it, which deletes it from our systems at once. Signed in, you can also withdraw it in the course catalogue. A copy the provider has already downloaded is theirs; contact them to delete it.
• Registering again for the same course with the same email address updates your registration rather than adding another.
• We keep a registration for 12 months after its last activity (you registering again, or the provider updating it), then delete it. It is also deleted with its course.
• We don’t use these details for marketing or add you to a mailing list.

17.2 What we count

To give each provider a report on its courses, we count:

• views of a course’s page and of the provider’s own page about it, plays of its information video, and clicks on links that take you to enrol on the provider’s own website;
• how often each Featured course (Section 17.3) is shown at the top of the results, and clicked;
• how often each Sponsored ad is seen (once half of it has been on screen for a second) and clicked, by where on the site it appeared.

We keep these only as totals for each course, promotion or ad for each day, and the provider sees the totals for its own courses. They contain nothing about you: no cookie, visitor identifier or internet address is kept with them. We leave out requests from search engines, link previews and other automated visitors. To stop the counts being inflated, we limit how many come from one internet address; we hold the address in memory for that and don’t keep it with the counts.

17.3 Featured courses and Sponsored ads

Providers can pay to feature a course at the top of the results, labelled "Featured", or for an ad, labelled "Sponsored", for visitors in their own country. The site’s "How results are ordered" page explains how they are placed. To place them:

• Your browser keeps a random value for your visit in its session storage, and sends it with each search, so the order stays the same while you browse and changes on your next visit. It isn’t a cookie, it says nothing about you, your browser clears it when you close the tab, and we don’t store it.
• We work out the country you’re browsing from, to show that country’s promotions: the country you chose in the filters, otherwise a lookup of your internet address in a country table held on our own servers (IP Geolocation by DB-IP), otherwise your browser’s time zone. We don’t keep the country, the address or the time zone.
• Nothing else about you is used to choose what is featured or which ad you see. We don’t use advertising cookies, build a profile of you, or follow you to other sites.

17.4 Why there is no cookie banner

FacilityVR Courses sets no cookies. When you enrol in or buy a course, your account, signing in and payment are handled by FacilityVR and Stripe, as Sections 3.3 and 9 describe. The value for your visit (Section 17.3) is the only thing the site keeps in your browser. It is needed to keep the results in the order you are paging through, and neither it nor anything we count can identify you, so the site doesn’t ask for consent with a banner. If your browser blocks site storage, the site still works, and the order is chosen afresh on each page.