Privacy Policy

Kickstart AI Pty Ltd (ACN 704 098 528, ABN 31 704 098 528) ("we", "us") sets up and looks after job-tracking systems for small trades businesses. This policy explains what personal information we collect, how we use, keep and protect it, and how to contact us about it.

1. Whether the Privacy Act applies to us

Small businesses are generally exempt from the Privacy Act 1988 (Cth), and we believe we are one. Whether or not the Act applies to us, we handle personal information in line with the Australian Privacy Principles, and this policy describes how.

2. What we collect

• Enquiries: when you contact us through our website form, by email or by phone: usually your name, mobile number or email, your business name and what it does, the best time to contact you, and your message. With the website form we also record that you agreed to be contacted about your enquiry, which version of the form's wording was in use, and the page you sent it from.
• Free business discovery (when we offer it): your answers to our discovery questionnaire about your business.
• Discovery calls: our notes of the call (your business, how it runs today, and what you want from us).
• Clients: the contact and business details we need to do the work and invoice you; your answers to our onboarding questionnaire (business and contact details and how your business operates; it refuses passwords and similar secrets); our agreement, approval and payment records; and, only with your consent, testimonial material such as written answers or a recorded interview.
• Website visits: our website host counts visits with Vercel Web Analytics, which does not use cookies; Google Fonts supplies our fonts and so receives your internet (IP) address and browser details; and the system behind our form logs the internet address and browser details of each request to the form.
• Our clients' customers: when we set up and look after a client's system, that system holds the client's customers' details. The client decides how that information is used, under its own privacy obligations; we handle it only for the client, under our agreement with it.

We do not ask for sensitive information, such as health information, and ask you not to send it.

3. How we use it

To reply to your enquiry; to arrange and hold a discovery call; to prepare a proposal if you ask for one; to deliver, support and invoice our services; to keep records of our dealings with you; to protect our website and systems from misuse; and to meet our legal obligations. We publish testimonial material only with your consent, and you see the final version before it goes live. We do not sell personal information.

4. Emails and marketing

• Ticking the box on our website form means you agree to us contacting you about your enquiry.
• After you enquire, we may send you an acknowledgement email. It uses a template we approve in advance, and a person checks each one before it is sent. We do not send automated emails.
• We send marketing about our services only if you have agreed to receive it, or would reasonably expect it, consistent with the Spam Act 2003 (Cth). Each marketing message says who it is from and how to opt out. You can opt out at any time by using the opt-out in the message or by emailing info@kickstartai.com.au, and we act on it within 5 business days. Opting out does not stop messages we need to send you about an active engagement.

5. Artificial intelligence and automated decisions

Our enquiry system does not use artificial intelligence to process what you write: any acknowledgement is a fixed template we approve in advance, and a person reads and handles each enquiry. We do not use automated decisions that significantly affect you. We use AI assistants to help develop and test our systems, using made-up data. They do not access personal information we hold, or act on our live systems, unless a person at Kickstart AI Pty Ltd has authorised that task, security controls are in place, and a person approves each action, and, for a client's systems or their customers' information, the client has authorised it in writing; if they do, the provider (currently Anthropic, in the United States) may process personal information that appears in that work. Before we use artificial intelligence on enquiries, or make any automated decision that could significantly affect you, we will update this policy and, for our clients' customers' information, get our client's permission first.

6. Where it is kept

• Website form enquiries go to a private storage area in our Supabase account, in Supabase's Sydney, Australia region. Our collector, which runs on our own server (a DigitalOcean server in Sydney, Australia), picks them up, usually within minutes while it is running, and records them in our business system; the copy in the storage area is then deleted. An enquiry that cannot be recorded automatically is kept there for a person to handle, and deleted within 30 days. To stop repeated or automated sending, the form also keeps two scrambled codes, one made from your internet address and one from the network it belongs to, which cannot be turned back into the address without a key only our system holds; they are deleted after one day.
• Our staff portal and onboarding questionnaire (portal.kickstartai.com.au and start.kickstartai.com.au) run on that same server in Sydney. Onboarding answers are stored there as files. A questionnaire you start but do not send is deleted after 30 days untouched.
• Email is held in our Google Workspace mailbox. Google stores email in its data centres, which may be outside Australia; our plan does not let us choose where.
• Our business system's database is provided by Supabase in its Sydney region. Supabase keeps daily backups of it for 7 days.
• Backups: every night our server makes an encrypted backup of our business system's database and of the server's own folders (onboarding answers, discovery call notes and an access log). The key is held only by Justin Vetsavong, not on the server or by any provider. A copy of each backup is stored with Cloudflare R2, with an "Oceania" location preference that Cloudflare applies on a best-effort basis, so we cannot guarantee the copy stays in Australia. Copies roll off within 35 days, and we restore them on our own computer to check them.
• Our clients' systems run on servers and storage in each client's own cloud account (DigitalOcean, in its Sydney region, unless a client chooses another provider).

7. Who else handles it, including overseas

These providers handle information for us: Supabase (our database and the website form's storage); Google (Google Workspace email, and Google Fonts); Vercel (website hosting and visit counting); DigitalOcean (our server in Sydney); Cloudflare (encrypted backup copies, and a monitoring check of our two web addresses every 5 minutes that carries no customer information); and Anthropic (the AI assistant in section 5).

Some of these providers are based in, or may store or access information from, other countries. Email (Google), website hosting and analytics (Vercel), font delivery (Google), backup copies (Cloudflare) and our AI assistant (Anthropic) may involve storage or access outside Australia, most likely in the United States, and in other countries where those providers operate. Providers whose data is stored in Sydney (Supabase and DigitalOcean) may still access it from overseas for support and security. We choose providers that protect information with security measures and contracts, and we stay responsible for how we handle your information.

8. How we protect it

We use encrypted connections, private storage, access limited to the people who need it, individual accounts, encrypted backups that we test by restoring them, and the retention periods in section 9. No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you, and what you can do, as soon as we can.

9. How long we keep it

Enquiries: 3 years from when we receive them. Jobs, proposals, quotes, agreements and payment records, if you become a client: 7 years. Records of the work we do for you: 5 years. Unsent onboarding questionnaires: 30 days untouched. Backup copies: up to 35 days. A person at Kickstart AI Pty Ltd deletes records after these periods.

10. Your choices

You can ask us for a copy of the information we hold about you, ask us to correct or delete it, or tell us not to contact you again, by emailing info@kickstartai.com.au. A person handles each request within 30 days. We may need to confirm who you are first. If you are a customer of one of our clients, we will pass your request to that client, who is responsible for it, and help them respond.

11. Complaints

Contact us first at info@kickstartai.com.au, and we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Changes

We may update this policy. The version on this page applies from the date at the top.