Diyaby Design Industries

Privacy policy

Effective: 6 October 2026

What changed: who at Design Industries can see your content, and when.

1. Who we are

Diya (diya.au) is an AI assistant built on Anthropic's Claude models. It is operated by Design Industries Pty Ltd (ABN 98 111 471 179), an Atlassian Solution Partner headquartered in Melbourne, Australia ("Design Industries", "we", "us"). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What we collect

  • Account information. Your name, email address and profile picture, and the identifier Google gives your Google account, when you sign in with Google; or your email address when you sign in with a one-time code.
  • Profile. If you answer the questions Diya asks when you start: the name you prefer, your company and its size, your industry and role, the Atlassian products you use, your challenges and goals, and that conversation.
  • Chats and files. The messages you send to Diya, Diya's replies, the files you attach and the files Diya makes for you.
  • Feedback. The thumbs up or down you give a reply.
  • Projects and workflows. A project's instructions, the files and web pages you add to it as sources, the workflows and tasks you set up, and the record of each run.
  • Memories. Short notes Diya keeps from your chats (for example, your role or preferences) so that later replies suit you. You can view and delete them at any time.
  • Connection details. If you connect another service (such as Jira and Confluence, Slack, Google Calendar, Google Drive, Microsoft SharePoint, Xero or HubSpot), we store the sign-in tokens Diya needs to act for you in that service.
  • Enquiries. If you use the enquiry form, your name, work email, organisation and message.
  • Usage and technical data. Message counts, the models you use, approximate cost, IP address, and security events such as sign-ins.

3. How we use it

We use this information to provide and personalise the service, enforce usage limits, keep the platform secure, investigate faults, improve Diya and answer enquiries. We do not sell personal information, and we do not use your chats for advertising.

Your chats are private to you unless you share one with the members of a project. A project's members can see the runs of its workflows and tasks, including what each workflow step produced, and the project's owner and managers can see the full detail of every run.

Who at Design Industries can see your content. Design Industries runs Diya. By default, Design Industries staff have no access in Diya to your chats, their titles or your projects. They can see your account details and how much you use Diya, for example message counts, the models you use and approximate cost.

A Design Industries administrator can add themselves to a team project as a manager, for example to help its owner. The project's owner and managers are told straight away and can remove them. The administrator then sees what the project's managers see, including the chats its members have shared. An administrator can't add themselves to your personal project.

Otherwise, we look at your chats only:

  • when you ask us to, for example to fix a problem with one;
  • to investigate a security incident affecting Diya or your account;
  • to investigate a credible report or sign that Diya is being misused in breach of our terms or the law; or
  • when the law requires it, or where the law allows us to act to prevent a serious threat to someone's life, health or safety.

We look only at what the reason needs. We tell you afterwards, unless the law prevents it, telling you could put someone at risk, or it would undermine an investigation that is still going (then we tell you when it ends).

Our engineers keep Diya's servers, database and backups running and can technically reach the data stored there, including chats and the stored sign-ins for services you connect. They may read it only for the reasons above, with one addition until we finish cleaning up our logs: to fix a fault, using our application logs, which can contain extracts of what Diya sends to the tools it uses and the pages it reads (section 7).

Services you connect, and tools an administrator adds for everyone, receive what Diya sends them, which can include text from your chats (section 8). AWS may review Claude Fable 5 traffic for abuse (section 4).

4. AI processing

Diya's replies are written by Anthropic's Claude models, which Amazon Web Services (AWS) runs for us. AWS does not use your prompts or Diya's replies to train the models and does not share them with Anthropic. The standard models (Claude Opus, Sonnet and Haiku) run in Australian regions, and so do the other models Diya uses behind the scenes, for example to index documents for search and to keep Memories.

Claude Fable 5 is an optional model. Diya uses it only when someone chooses it for a chat, a task or a workflow step. Fable 5 may be processed outside Australia, and AWS keeps its prompts and replies for up to 30 days to check for abuse, which can include review by AWS staff.

Web search and page reading use services outside Australia. When Diya searches the web, your search words go to Brave Search. When it reads a web page, or you add a web page to a project as a source, the page's address goes to Firecrawl, which fetches the page.

5. Storage and security

Diya runs in Sydney, on AWS. Your account, chats, files, projects and memories are stored there: chats and account data in an encrypted database, files on encrypted storage. Sign-in tokens for your connections are also encrypted inside the application (AES-256-GCM). Your connection to Diya is encrypted with HTTPS. Sign-ins, administrator changes and other security events are recorded in a security audit log.

6. When information leaves Australia

Diya stores your information in Sydney. It may be handled outside Australia in these cases:

  • Claude Fable 5, when it is chosen (section 4).
  • Web search, page reading and web pages added as project sources (section 4).
  • Email. Sign-in codes, invitations, approval requests, run notifications, enquiries and our notice of each new sign-up are sent through Google Workspace, our email provider. Google may process and store these emails outside Australia. A copy of each email we send is kept in our Google Workspace mailbox.
  • Google. Google's sign-in code loads with every page of diya.au, and our home, pricing, privacy and terms pages load their fonts from Google. Both send your IP address and browser details to Google, as does signing in with Google. Google may handle them outside Australia.
  • Cloudflare. Every visit to diya.au passes through Cloudflare, which protects the site and runs the human check when Diya asks for one. Cloudflare may handle your traffic outside Australia.
  • Services you connect. Jira, Confluence, Slack, Google, Microsoft, Xero, HubSpot and other connected tools receive what Diya sends them for you, and keep their own data in their own locations under their own terms.

7. Retention

  • Chats are kept while you use them. A chat is permanently deleted 91 days after its last message, and you can delete a chat yourself at any time.
  • Files Diya makes for you are deleted after 30 days.
  • Memories are kept until you delete them, or until we delete your account at your request. Your account information is kept until you ask us to delete it.
  • Security audit logs are kept for 365 days.
  • Our application logs can include your email address, your web searches, the addresses of pages Diya reads and what Diya sends to the tools it uses. Our central copy of these logs is kept for 365 days.
  • Backups are encrypted. Chats and files you delete can remain in our backups after they are deleted from Diya.
  • Disconnecting a Google, Microsoft, Xero or HubSpot connection deletes its stored sign-in tokens. An Atlassian or Slack connection is stored with the chat you connect it in, and a copy goes into each new chat you start from a connected one. Disconnecting removes it from that chat only. Each copy is deleted with its chat.

8. Third parties

We share information only with the service providers needed to run Diya, and with the services you or an administrator connect:

  • Amazon Web Services (AWS). Hosting and storage in Sydney, and the Claude models in Australian regions (Claude Fable 5 excepted).
  • Cloudflare. Delivery and protection of the site, and the Turnstile human check when Diya asks for one.
  • Google. Sign-in with Google, email through Google Workspace, and the sign-in code and fonts that load with our pages.
  • Brave Search and Firecrawl. Web search, page reading and web pages added as project sources.
  • Connected services. Atlassian (Jira and Confluence), Slack, Google Calendar, Google Drive, Microsoft SharePoint, Xero, HubSpot, and other tools an administrator adds for everyone. They receive what Diya sends them while it works on your requests.

9. Cookies

Diya uses three first-party cookies, all strictly necessary for sign-in: a short-lived access token, a refresh token, and a CSRF protection token. We do not use advertising or cross-site tracking cookies. The app also keeps a sign-in token, your user id, the chat and project you last opened, and settings such as your theme and the model you last chose in your browser's local storage.

10. Your rights

You may request access to, correction of, or deletion of your personal information by contacting enquiry@di.net.au. You can delete individual chats and memories from within the app. If you are unsatisfied with our handling of a complaint, you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

11. Changes and contact

We may update this policy from time to time; material changes will be flagged on this page with a new effective date. Questions: enquiry@di.net.au or 1300 73 63 63.