Last updated: 10 May 2026
Summary: Validera processes booking data and insurance claim information solely to verify that bookings comply with claim requirements. We do not sell your data, do not use it for advertising, and retain it only as long as needed for audit compliance. We act as a data processor on behalf of our customer (the insurer), who remains the data controller.
Validera is operated by Agentic Labs Group Pty Ltd (ACN 692 724 584), based in Sydney NSW Australia. In this policy, "we", "us", and "our" refer to Agentic Labs Group Pty Ltd.
For most personal data we process (claim ticket content, agent identifiers, booking transaction details), Validera acts as a data processor within the meaning of Article 4(8) of the EU GDPR and as a service provider under the Australian Privacy Act 1988. The data controller is the insurer or other organisation that has procured Validera. We process this data only on the documented instructions of the controller, set out in the customer agreement and the Data Processing Agreement (DPA) we sign with each customer.
For a limited set of data (information you give us directly through validera.io, such as enquiry emails to support@validera.io), Validera acts as the data controller.
Contact: privacy@validera.io
When an agent uses the Validera browser extension, we process:
We process data for the following purposes only:
Where the GDPR applies, we rely on the following lawful bases under Article 6:
We do not rely on consent as a legal basis for the core verification processing, because that processing is necessary to deliver the service the customer has procured. Marketing communications, where applicable, do rely on consent and can be withdrawn at any time.
We use the following sub-processors to deliver Validera. The current, dated list is published at validera.io/subprocessors. We commit to giving customers thirty days notice via email before adding a new sub-processor.
Some of our sub-processors are located outside the European Economic Area (EEA), the United Kingdom, and Australia — specifically, Anthropic processes data in the United States, and Vercel functions may execute in any of its global edge regions.
For transfers from the EEA or UK, we rely on the European Commission's Standard Contractual Clauses (SCCs) as the transfer mechanism, supplemented where necessary by additional safeguards (encryption in transit and at rest; minimisation of data sent to sub-processors; contractual restrictions on use). Copies of the relevant SCCs are available to customers under our DPA.
For transfers from Australia, our sub-processor contracts include the equivalent commitments required under Australian Privacy Principle 8.
For a fuller engineering description of our security posture, see validera.io/security.
If we become aware of a personal data breach affecting customer data, we will notify the affected customer (the controller) without undue delay and, where feasible, within 72 hours of becoming aware, in line with GDPR Article 33. Customers can use that notification to meet their own controller-side reporting obligations to data protection authorities and to data subjects.
For Australian customers, where a breach is likely to result in serious harm to individuals, we will support the customer's compliance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988.
Our notification will include: the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed to address it.
Under the Australian Privacy Act 1988 and, where applicable, the EU General Data Protection Regulation (GDPR), you have the right to:
To exercise any of these rights, contact privacy@validera.io. Where we act as a processor on behalf of a customer, we will route the request to that customer (the controller) and assist them in responding within the statutory time limits.
The Validera Chrome extension does not use cookies. Our web applications (app.validera.io) use only essential session cookies required for authentication. We do not use tracking cookies, analytics cookies, or advertising cookies.
Validera is a business-to-business product designed for use by professional insurance claim handlers. We do not knowingly collect data from anyone under 18 years of age.
We may update this policy from time to time. Material changes will be communicated to customers via email and posted on this page. The "last updated" date at the top reflects the most recent revision.
For privacy-related enquiries: