ABOUT
ABOUTAsk AREEA is an AI knowledge assistant embedded in AREEA’s public website. It answers general questions about AREEA, its services and the Australian resources and energy workforce, drawing only on material from AREEA’s website.
This document sets out the technical, security and data-handling information a member company’s IT, security or procurement team needs in order to assess and endorse Ask AREEA for use by staff.
IN SUMMARY
Ask AREEA is a feature of the AREEA website. Nothing is installed on your devices, nothing connects into your network, and no agreement between your organisation and the platform vendor is required. The assistant is read-only: it answers questions and cannot take actions, reach your systems, or browse the open internet.
| Audience | Any visitor to areea.com.au. No membership required. |
| Where it runs | Embedded in AREEA’s public website. |
| Authentication | None. No account, no login. |
| Scope of answers | General questions about AREEA, its work and services. |
| Installed on your devices | Nothing. |
| Connects to your systems | No. |
| Data leaving your organisation | Whatever a user types, plus standard web interaction data. |
| Hosting | Microsoft Azure. No data-residency commitment is published; the vendor’s terms permit storage in the United States. |
| Can it take actions? | No. Read-only. It answers questions and cannot act in any system. |
| Cost to your organisation | None. |
| Contract with the vendor | None required. AREEA holds the licence. |
SPECIFICATIONS
What it is
Ask AREEA is a generative AI assistant embedded in AREEA’s public website. It answers general questions about AREEA, its work and services and the Australian resources and energy workforce, drawing only on material AREEA has selected and loaded into it. It is available to any website visitor without a login.
It is a white-labelled deployment of a commercial platform supplied by BettyBot LLC, trading as Betty. AREEA holds the licence and controls the content, configuration and branding.
It is a white-labelled deployment of a commercial platform supplied by BettyBot LLC, trading as Betty. AREEA holds the licence and controls the content, configuration and branding.
How it works
Ask AREEA is a retrieval-grounded assistant, not a custom-trained model.
- AREEA’s source material is processed and indexed as vector embeddings held in the platform’s storage. Vectors are numerical representations the vendor describes as “large matrices of numbers that cannot be translated into content”.
- When a question is asked, the platform retrieves the content AREEA has loaded that most relevant to the question.
- Those passages, together with the question, are passed to a large language model, which composes an answer from that material and cites the sources it used.
.
The assistant is constrained to the content AREEA has supplied. The vendor states it is “constrained from using any sources other than those provided by your association” and does not search the open internet. AREEA’s content is not used to train the underlying model.
Deployment and integration
Ask AREEA is a feature of a web page.
| Item | Position |
| Software installed | None. No software, agent, browser extension, plugin, certificate or configuration is deployed to any device in your environment. |
| Integration with your systems | None. Ask AREEA does not connect to your network, identity provider, directory, file storage, email, HRIS or any line-of-business system. |
| Inbound connections | None. Nothing connects into your network. All traffic is outbound from the user’s browser over HTTPS. |
| Data supplied by your organisation | None. AREEA does not supply, and the platform does not hold, any member-company data for the public assistant. |
| Agreement required from you | None. Your organisation is not a customer of the platform vendor. AREEA holds that contract. |
| Change to your environment | None required, beyond ordinary web access to the AREEA member portal. |
Access and Authentication
| Item | Position |
| Authentication | None. Ask AREEA is open to any website visitor. |
| Accounts | No account is created and no credentials are collected. |
| User identification | The vendor states that “by default” it does not collect or store data about individual users. |
| Content boundary | AREEA’s members-only material is not reachable through the public assistant. |
Data flow — what leaves your organisation
- What leaves: the text a user types into the assistant, and standard web interaction data — clicks, message opens, and time spent on content.
- Where it goes: to the platform, hosted on Microsoft Azure, and from there to OpenAI language models for the generation step.
- Where it is processed: the vendor publishes no data-residency commitment. Its terms permit storage on servers in the United States, so US processing should be assumed.
- Who can see it: AREEA staff can see question content through the platform’s reporting portal. Other AREEA members cannot see your staff’s questions, and other member companies’ questions are not visible to you.
- What does not leave: nothing is read from the user’s device, network or systems. The assistant has no access to files, mail, directories or applications.
Data collected and retained
| Item | Position |
| Individual user data | The vendor states that by default it “does not collect or store any data about individual users”. Its privacy policy also notes that users “may choose to share personal data in the conversations which do get logged”. |
| Conversation content | Conversations are logged by default. The vendor states it “can wipe that information upon request”. |
| Retention period for logs | Content is retained to provide the service during the agreement term. Chatlogs are available/exportable and may include user ID, questions, responses, feedback, and top content. There is no set period where we will purge conversation logs automatically but can be done on request. If it is not requested, logs will be preserved for the duration of the relationship, then handed over and removed from our systems upon termination. |
| Interaction and behavioural data | The vendor’s terms define “Enrichment Data” — interaction and behavioural data including clicks, message opens and content consumption time — and state that BettyBot LLC owns it and retains it after termination. |
| Aggregated data | The vendor’s terms take a perpetual, irrevocable, worldwide, royalty-free, sublicensable licence over de-identified aggregated data, including rights to modify it, create derivative works from it and make it available. “Sublicensable” and “make available” mean it may be passed to third parties. |
| AREEA visibility | AREEA staff can see question content through the platform’s reporting portal. AREEA uses it in aggregate to find gaps in the source material and improve answers. |
| Conversation memory | Within a conversation, context is retained so follow-up questions work. |
| File upload | File upload is not configured. |
| Deletion on termination | The vendor’s privacy policy states that on termination the customer’s data is provided to the customer and the customer’s content is deleted from the database. |
Encryption and protection at rest
| Item | Position |
| In transit | The vendor states that “SSL is primarily used for data transmission”, covering communications between the user interface, the platform API, content storage and the AI tools. No TLS version, cipher suite or configuration detail is published. |
| At rest | Data at rest is encrypted using TDE as documented by Azure SQL with access restricted to whitelisted IPs and standard Microsoft security settings. |
| Vector storage | Pinecone is the vector storage provider and uses AES-256 encryption for data at rest, TLS 1.2 and AES-256 for data in transit. |
Hosting and data residency
| Item | Position |
| Cloud platform | Microsoft Azure. The vendor states Azure hosts “most system infrastructure”, using Azure SQL and Azure Function Apps. Any components outside Azure are not enumerated. |
| Region | US East, US East 2, and US Central are used. East for the vast majority of production actions but not all services are available in that region. Vector storage is in US East 2. Supporting Azure Foundry services are in US Central. Some staging and development services may be in US Central. |
| Cross-border transfer | The vendor’s terms state that data from users residing outside the United States “may be stored on servers in the United States”. |
Content sources
Ask AREEA draws on a subset of AREEA’s publicly available material — information about AREEA, its services and membership, and general industry and workforce information. It does not draw on AREEA’s members-only guidance, and it does not search the open internet.| Item | Position |
| Open internet access | None. The assistant cannot browse the web and is constrained to the loaded source set. |
| Source citation | The vendor states the assistant “cites its sources on every response”. Users are directed to open the cited source and check it. |
| Content correction | AREEA administrators can flag content so it is not used again. |
| Update cadence | AREEA reviews sources monthly. |
What Ask AREEA cannot do
- Cannot take any action. It answers questions. It cannot create, change or delete anything, send email, make bookings, submit forms or trigger workflows in any system — AREEA’s or yours.
- Cannot reach your environment. No access to your network, devices, accounts, files or applications.
- Cannot browse the open internet. Limited to the source set AREEA has loaded.
- Is not, in AREEA’s assessment, an automated decision-making system. It provides information and does not make decisions about individuals.
- Is not legal advice and is not a legislative currency check. Answers are general information, are not reviewed by a person before the user sees them, may be incomplete or out of date, and are not subject to legal professional privilege. AREEA publishes this prominently and instructs members to open the cited source and speak to their AREEA adviser before acting on anything consequential.
- Does not know your enterprise agreement, policies, contracts or site arrangements.
- Does not hold your account or membership data — invoices, registrations or bookings.
- Cannot represent anyone at the Fair Work Commission or in any tribunal or court. It cannot provide support and advice specific to a specific circumstance. AREEA’s advisers do that.
- Does not answer members-only questions. AREEA members get the full knowledge base assistant, Ari, inside the member portal.
PRIVACY
Privacy
Ask AREEA is not designed to collect personal information, and AREEA instructs users not to enter any. But conversations are logged, so if a user types personal information despite being asked not to, it is collected..
If that happens, the information is disclosed to overseas recipients — the platform vendor in the United States, Microsoft Azure in a region the vendor does not commit to, and OpenAI — which engages Australian Privacy Principle 8.
Everything else in this section follows from those two facts. The single most effective control is the instruction not to enter personal information, because it prevents the collection rather than managing it afterwards.
What personal information is involved
| Category | Position | Collected? |
| Identity of the user | No account is created and no credentials are collected. The vendor does not collect or store data about individual users. | Not by design |
| Content of questions | Conversations are logged by default. A question is free text, so it may contain personal information about the person asking, about an employee, or about a third party. | Yes — logged |
| Personal information about employees or third parties | Prohibited by AREEA’s instruction to users, reinforced in the assistant footer, the terms of use and member guidance. Users are shown how to ask the same question generically. | Prohibited, but possible |
| Sensitive information | Health information, and information about disciplinary matters that reveals health or other sensitive attributes, is sensitive information under the Privacy Act and attracts a higher standard of protection. AREEA prohibits it as an input for exactly this reason. | Prohibited |
| Technical and usage data | The application collects the IP address of the caller along with the information explicitly passed in such as the user’s question and anything AREEA chooses to feed to the widget on deployment. | Yes |
| Behavioural data | The vendor’s terms define “Enrichment Data” — clicks, message opens and time spent on content — and state that BettyBot LLC owns it and retains it after termination. | Yes — vendor-owned |
| Membership or account data | Not held by the platform. The assistant has no access to membership records, invoices, registrations or bookings. | No |
Position against each relevant Australian Privacy Principle
Only the Australian Privacy Principle’s that are engaged are listed. Where AREEA’s position depends on something not yet confirmed, it indicates and includes in the open items register.| APP | Obligation | Position |
| APP 1 | Open and transparent management | AREEA maintains a privacy policy and publishes this document. |
| APP 3 | Collection of solicited personal information | AREEA does not solicit personal information through Ask AREEA. Users are instructed not to provide it. Any collection that occurs is incidental to the user’s own free-text input. |
| APP 5 | Notification of collection | A collection notice is displayed with the assistant and on the page hosting it, covering what is collected, why, who it is disclosed to, and that recipients are overseas. |
| APP 6 | Use and disclosure | Question content is used to generate the answer, and in aggregate to identify gaps in the source material and improve the service. It is disclosed to the platform vendor and the model provider as a necessary part of delivering the service. It is not disclosed to other members, to other member companies, or to any party for an unrelated purpose. |
| APP 7 | Direct marketing | Ask AREEA is not used for direct marketing, and question content is not used to target marketing to an individual. |
| APP 8 | Cross-border disclosure | Engaged whenever personal information is entered, because the recipients are overseas and no Australian data residency is offered. |
| APP 10 | Quality of personal information | AREEA does not use Ask AREEA as a record of personal information and does not rely on anything a user types as an accurate record about any individual. Conversation logs are used for service improvement, not as a data source about people. |
| APP 11 | Security | SSL protects data in transit. Access to data at rest is restricted to whitelisted IP addresses with standard Microsoft security settings. AREEA does not assert that data at rest is encrypted. Each organisation’s knowledge base is held separately with no cross-contamination. |
| APP 11.2 | Destruction or de-identification | Personal data volunteered in logged conversations can be wiped on request, and data/content is deleted upon termination per the MSA and/or at AREEA’s request. |
| APP 12 | Access to personal information | An individual may ask AREEA what it holds. |
| APP 13 | Correction | An individual may ask AREEA to correct or remove information. Because the assistant does not use conversation content as a record about any person, correction in practice means deletion. |
Retention, deletion and individual requests
| Item | Position |
| Retention period | Customer content is retained for the life of the service agreement. No specific retention period for conversation logs is published. |
| Deletion on request | Deletion is request-triggered. |
| How an individual makes a request | Contact AREEA’s Privacy Officer at [email protected] or on 1800 627 771. AREEA’s published policy commits to responding within one week. AREEA will locate and remove what it can, and will tell the individual plainly if it cannot. |
| Vendor commitment on individual requests | Personal data volunteered in logged conversations can be wiped on request, but Ask AREEA currently stores no individual data or PII for any users. |
Cross-border disclosure
Australian Privacy Principle 8 requires before disclosing personal information to an overseas recipient, an APP entity must take reasonable steps to ensure the recipient does not breach the APPs. Under section 16C of the Privacy Act, the disclosing entity generally remains accountable for an act of the overseas recipient that would breach the APPs, accountability does not transfer with the data.| Question | Answer |
| Who are the overseas recipients? | BettyBot LLC, a United States company. Microsoft Azure, in a region the vendor does not commit to. OpenAI, which provides the language models. The vendor’s terms state that data from users outside the United States “may be stored on servers in the United States”. |
| Is an APP 8.2 exception available? | AREEA does not rely on one. The exception for recipients bound by a substantially similar law is not available for a United States recipient in these circumstances, and AREEA does not seek informed consent at the point a user types a question, because it would normalise entering personal information rather than preventing it. |
| What does AREEA do instead? | Three things. It prevents the collection — users are instructed not to enter personal information, and shown how to ask the same question generically. It discloses the overseas disclosure in its collection notice and privacy policy, so the position is transparent. |
| What does this mean for a member company? | Your own obligations may be engaged. If your employee enters personal information into the assistant in the course of their employment, your organisation may itself be disclosing personal information to an overseas recipient — and section 16C accountability may follow. That is the reason the prohibited-inputs instruction matters more than any technical control, and why AREEA asks member companies to reinforce it in their own acceptable-use guidance. |
Cookies and website tracking
AREEA’s privacy policy states that cookies are used for statistical analysis, that they “do not contain any information that could identify an individual”, and that users may disable them with some loss of functionality.
AREEA has a full domain list and can be provide on request.
Notifiable data breaches, complaints and contact
| Item | Position |
| Notifiable Data Breaches | AREEA is subject to the scheme and would notify affected individuals and the Office of the Australian Information Commissioner where an eligible data breach occurs. |
| Complaints to AREEA | AREEA’s Privacy Officer can be reached at [email protected] or on 1800 627 771. AREEA’s commits to responding within one week. |
| Escalation | An individual who is not satisfied with AREEA’s response may complain to the Office of the Australian Information Commissioner. |
| Regulator guidance applied | The Office of the Australian Information Commissioner guidance on privacy and the use of commercially available AI products is the applicable guidance. |
PRIVACY COLLECTION NOTICE
What we collect. Ask AREEA is an AI assistant provided by AREEA. We record the questions you ask it and the answers it gives, together with basic technical and usage information such as your device and browser type and how you interact with the assistant. You do not need and account and we do not ask you to identify yourself.
We do not want your personal information. Ask AREEA does not need personal information to answer your question, and we ask you not to provide any. Please do not enter names, contact details, health information, disciplinary information, or anything commercially sensitive or legally privileged — about yourself, an employee, or anyone else. Describe the situation generally instead: you will get the same answer. If you do enter personal information, it will be recorded along with the rest of your question.
Why we collect it. To generate an answer to your question; to understand what people need so we can improve the assistant and fill gaps in the material it draws on; and to maintain and support the service. We do not use your questions to market to you.
Who we disclose it to. To the provider of the assistant platform, BettyBot LLC, and to the provider of the language model it uses, as a necessary part of generating your answer. AREEA staff can see question content through the platform’s reporting tools and use it to improve the service.
Your information goes overseas. The assistant is hosted on Microsoft Azure and the platform provider is based in the United States. Your questions will be stored and processed outside Australia, including in the United States. We have asked our provider about Australian hosting and will update this notice if that changes. By using the assistant you should assume that anything you type leaves Australia.
How long we keep it. For as long as we operate the service. You can ask us to delete your conversation data – see below – and we will do what we can, though because questions are free text we cannot always guarantee we have found every instance.
Access, correction and complaints. You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete your conversation data. Contact AREEA’s Privacy Officer at [email protected] or 1800 627 771. We aim to respond within one week. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner.
More information. See AREEA’s Privacy Policy for how we handle personal information generally, and the [Terms of Use] for Ask AREEA.
PLATFORM AND VENDOR
The platform and the vendor
| Item | Position |
| Platform | Betty, an AI knowledge platform built for member associations, deployed white-labelled as Ari under AREEA’s own name and branding. |
| Vendor | BettyBot LLC, a United States company. “Betty” is a registered trademark of the vendor. |
| Contracting party | AREEA. Member companies are not parties to the vendor agreement and are not required to enter one. |
| Governing law and disputes | The vendor’s terms of use are governed by Louisiana law, with disputes resolved by American Arbitration Association arbitration in Louisiana, venue New Orleans. |
Architecture and AI model
| Item | Position |
| Approach | Retrieval-grounded generation over a curated content set. Content is ingested, indexed as embeddings, retrieved on demand and summarised by a language model with citations. |
| Platform structure | The vendor describes three components: a knowledge repository for ingestion, knowledge discovery for queries with source citations, and knowledge synthesis for pattern analysis. |
| Model provider | OpenAI language models. |
| Fine-tuning on AREEA content | None. The assistant is retrieval-grounded, not fine-tuned. Content is “never used to train shared AI models”. |
| Model training on user prompts | Vendor does not use any client’s data to train other clients’ environments, and that third-party tools such as the language models “must include clear and strict terms of use regarding what they do with data they receive”. |
| Languages | The assistant can respond in a range of languages, though the source material is in English and answers are strongest in English. |
| Devices | Works on desktop, tablet and mobile through a standard web browser. |
Third parties and sub-processors
| Party | Role |
| BettyBot LLC | Platform vendor and processor. Holds the Ask AREEA instance, the content index and conversation logs. |
| Microsoft Azure | Cloud hosting for what the vendor describes as “most system infrastructure” — Azure SQL for data at rest, Azure Function Apps for compute. |
| OpenAI |
Current sub-processors: – Microsoft Azure (United States) – hosting, application services, database and blob storage – Pinecone (United States) – vector storage – OpenAI (United States) – language model API – Google Gemini (United States) – language model API – Jina.ai (Germany) – content processing API – Browserbase (United States) – web content retrieval – Auth0 / Okta (United States) – authentication for the Betty:INSIGHTS management portal Vendor maintains a sub-processor register and notifies customers of the appointment of any new sub-processor in advance. |
