Privacy Policy

1. Our role: information we control and information we handle for customers

We handle personal information in two different capacities.

Information we control

This is information about you that we collect for our own purposes. It includes information about website visitors, people who contact us, account holders and users of our products, our clients and their staff, and job applicants. This policy fully applies to it.

Information we handle for our customers

Some of our products let businesses collect and manage information about their own clients and contacts. For example, Flow CRM collects form responses submitted to a business. We call this "Customer Data". We store and process Customer Data on behalf of the business that collected it and on its instructions. We do not use it for our own purposes, except as needed to provide, secure and support the Services.

If you gave your information to a business that uses one of our products, that business is responsible for how your information is handled. Its own privacy policy applies, and you should contact it first with any request. If you contact us instead, we will refer your request to that business and help it respond.

2. What personal information we collect

Information you give us

• Contact and enquiry details: your name, email address and any other details you give us when you contact us. For example, our website contact form asks for your name, email, the type of enquiry, your budget and your message.
• Account details: your name, email address, Organisation name, role, and preferences when you create or are invited to an Account.
• Billing details: billing contact name, email and address, business name, and ABN or tax ID. Your card or bank details are collected and held directly by our payment provider, Stripe. We only see limited details, such as the card type, the last four digits and the expiry date.
• Project information: information you give us during a custom software engagement, including information about your staff and systems.
• Support and communications: the content of your emails, support requests, feedback and survey responses.
• Job applications: your CV, cover letter and any other details you send us when you apply to work with us.
• Information you enter into our products and apps: this depends on the product. For example, it may be the details you enter into a mobile app to use its features.

Information we collect automatically

• Device and log information: your IP address, browser and device type, operating system, language settings, referring pages, and the dates and times of your visits.
• Usage information: the pages and features you use, and errors you encounter. We use it to keep the Services secure and working and to improve them.
• Cookies and similar technologies: see the "Cookies and similar technologies" section.

Information from third parties

• Sign-in providers: if you choose to sign in with a third-party account, such as Google, we receive basic profile information from that provider, such as your name, email address and profile picture.
• Your Organisation: if your Organisation invites you to a product, it gives us your name and email address.
• Payment provider: Stripe tells us whether payments succeeded and gives us related billing information.
• Integrations: if you connect a third-party service to our products, we receive the information needed for that integration to work.

We do not buy personal information, and we do not collect it from data brokers.

You do not have to give us your personal information, and you can contact us without identifying yourself where that is practical. However, we may not be able to provide some Services, such as an Account, without it.

3. Sensitive information

Under the Privacy Act, "sensitive information" includes information about a person's racial or ethnic origin, health, religious beliefs, and certain other matters. We only collect sensitive information about you with your consent, and only where it is reasonably necessary for a Service you have chosen to use, or where the law requires or allows it.

Some of our products are designed to hold information of this kind. For example, an app for preserving cultural knowledge, stories and family histories may hold information about Aboriginal and Torres Strait Islander heritage. Where a product does this, we explain in the product what is collected and who can see it. You stay in control of what you record and share, and we apply additional care and access restrictions.

Businesses that use our products decide whether to collect sensitive information from their own clients. They are responsible for having the necessary consent (see the "Our role" section).

4. How we use personal information

We use personal information to:

• provide, operate and maintain the Services, including creating and managing Accounts;
• process payments, issue invoices and manage Subscriptions;
• respond to enquiries, provide support and onboarding, and deliver custom software projects;
• send service messages, such as receipts, security alerts, and changes to our Terms or this policy;
• keep the Services secure, and detect and prevent fraud, abuse and unauthorised access;
• understand how the Services are used, fix problems and improve our products;
• send you news and offers about our products, where the law allows. You can opt out at any time (see the "Marketing" section);
• assess job applications;
• comply with our legal obligations, such as tax and record-keeping requirements, and enforce our Terms.

We only use your information for other purposes if you consent, or if the purpose is related to one of these and you would reasonably expect it, or if the law allows it.

Legal bases (EU and UK)

If the GDPR or UK GDPR applies to you, we rely on one of these legal bases for each use:

• performance of a contract with you;
• our legitimate interests (such as securing and improving the Services), where these are not overridden by your rights;
• compliance with a legal obligation;
• your consent, which you can withdraw at any time.

5. AI features

Some products include features powered by artificial intelligence, such as generating or summarising content. When you use one of these features, the information needed for it, which may include Customer Data, is sent to a third-party AI model provider for processing.

We only use AI providers under commercial terms that do not allow them to use your information to train their models, and that limit how long they keep it.

We do not use AI features to make decisions that have legal or similarly significant effects on you without human involvement. If that changes, we will update this policy to explain how those decisions are made.

6. Marketing

We may send you emails about our products and services if you have agreed to receive them, or if you are an existing customer and the law allows it.

Every marketing email includes an unsubscribe link, and you can also opt out by emailing . Even if you opt out, we will still send you service and billing messages while you have an Account.

We do not sell or rent personal information, and we do not share it with third parties for their own marketing.

7. Who we disclose personal information to

We disclose personal information only as described in this policy. The recipients are:

• Hosting and infrastructure providers, such as Google Cloud and Firebase, and Vercel. They host our websites, applications and databases.
• Authentication providers, such as Clerk, which manage sign-in and account security for our products.
• Payment processors, such as Stripe, which process payments, manage Subscriptions and help prevent fraud.
• Email delivery providers, such as Postmark, which send account and service emails.
• Website service providers, such as Web3Forms, which delivers contact form submissions to us, and Contentful, which hosts our website content and images.
• AI model providers, which process information when you use AI features.
• App marketplaces, such as Apple and Google, which distribute our apps and process in-app purchases.
• Your Organisation. If you use a product as part of an Organisation, its administrators can see your account details and the information you add to its workspace.
• Professional advisers, such as our accountants, lawyers and insurers, where reasonably necessary.
• Regulators, courts and law enforcement, where the law requires or allows it, or where we need to protect someone's safety or our legal rights.
• A buyer or successor of our business, if all or part of it is sold or restructured. In that case, your information remains protected by this policy or by an equivalent one.

Our service providers may only use personal information to provide services to us, and must protect it.

We may change or add service providers over time. If you would like a current list, contact us.

8. Disclosure of information overseas

Our primary databases and application infrastructure are located in Australia (Sydney).

Some of our service providers store or process information outside Australia. This applies to authentication, payment processing, email delivery, content and image hosting, contact form delivery and AI processing. The main locations are the United States. Other countries where those providers or their sub-processors operate include those in the European Union, the United Kingdom and Asia.

Before we disclose personal information overseas, we take reasonable steps to make sure the recipient handles it in a way that is consistent with the Australian Privacy Principles. Where information about people in the EU or UK is transferred, we rely on appropriate safeguards, such as the standard contractual clauses our providers offer.

9. Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies include local storage and pixels.

Our website does not use advertising, retargeting or third-party analytics cookies.

Our products use cookies and local storage that are needed for them to work. These keep you signed in, protect your Account, remember your preferences (such as light or dark mode) and help prevent fraud. Some are set by our authentication and payment providers.

You can block or delete cookies in your browser settings, but parts of the Services, such as signing in, may then stop working.

Our Services do not currently respond to "Do Not Track" browser signals, because there is no agreed standard for them. This has little practical effect, because we do not track you across other websites.

If we start using analytics or other non-essential cookies, we will update this policy first and, where the law requires, ask for your consent.

10. How we protect personal information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:

• encryption in transit;
• access controls and the principle of least privilege;
• secure, reputable hosting providers;
• limiting access to personal information to the people who need it.

No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security. Please keep your login details secure, and tell us promptly if you think your Account has been compromised.

11. How long we keep personal information

We keep personal information only for as long as we need it for the purposes in this policy, or for as long as the law requires.

• Account information is kept while your Account is active. After that, it is kept for a limited period so you can reactivate your Account or export your data.
• Customer Data is kept as set out in our Terms of Service (../terms-of-service/index.html), and as instructed by the business that controls it.
• Billing records and tax invoices are kept for at least five years, as required by Australian tax law.
• Enquiries and job applications are kept for as long as we reasonably need them to respond to you or to consider you for future roles. We delete them when you ask us to.

When we no longer need personal information, we delete or de-identify it. Information in backups is deleted in the ordinary course of our backup cycle.

12. Children

Our Services are intended for people aged 18 and over, and we do not knowingly collect personal information from children.

If you believe a child has given us personal information, contact us at and we will delete it.

13. Accessing, correcting and deleting your information

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

You can also ask us to delete your information or close your Account. You can update many of your details yourself in your Account settings.

To make a request, email . We may need to verify your identity before we act on it.

We will respond within 30 days. We do not charge for making a request, but we may charge a reasonable fee to cover the cost of giving you access if the request is complex.

If we refuse a request, we will tell you why, and how to complain. Sometimes the law allows or requires us to refuse; for example, we may need to keep billing records.

Additional rights in some countries

Depending on where you live, you may have additional rights. In the EU and UK, for example, these include the right to:

• object to or restrict our processing of your information;
• data portability;
• withdraw your consent at any time;
• complain to your local data protection authority.

To exercise any of these rights, contact us.

14. Data breaches

If a data breach involving your personal information is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner, as required by the Notifiable Data Breaches scheme under the Privacy Act. We will also meet any notification obligations under other applicable laws.

If a breach affects Customer Data we handle on behalf of a business, we will notify that business promptly and help it meet its obligations.

15. Making a complaint

If you have a concern about how we have handled your personal information, please email us at with details of your complaint.

We will acknowledge your complaint promptly, investigate it, and give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: https://www.oaic.gov.au
• Phone: 1300 363 992

If you are in another country, you can complain to your local data protection authority.

16. Changes to this policy

We may update this policy as our Services, our providers or the law change. The "Last updated" date at the top of this page shows when it last changed.

If we make a significant change, we will let account holders know by email or through the Services before it takes effect.

17. Contact us

For privacy questions, requests or complaints, contact us:

Absurde Software (ABN 32 238 728 072) Queensland, Australia Email: