Privacy policy
Last updated 15 November 2026.
Wavefront Labs Pty Ltd ("we", "us") handles personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. This policy says what we collect, why, who sees it and how to contact us about it.
What we collect
- Account and billing: your name, business name, email address, phone number and billing address. Card details go directly to Stripe; we never receive the card number.
- Content you give us to run a service: text, photos, menus, prices, hours, logos.
- Service records: emails you send us, support requests, changes made through an edit link, and server logs (IP address, browser, pages requested, time) kept for security and to fix faults.
- Business contact details from public sources when we offer our services to a business: the name, address, website, phone and email that the business has published on its own site or in public listings such as Google. We use these only to contact the business about our services, and every such email identifies us and tells you how to stop further contact.
Why we use it
- To provide, bill, support and improve the services you have asked for.
- To contact businesses about services we think are relevant to them (you can opt out at any time by replying or emailing [email protected]; we keep a record of opt-outs so we do not contact you again).
- To meet legal obligations, such as tax records, and to keep our systems secure.
We do not sell personal information and we do not use it for advertising networks.
Who else sees it
We use these providers to run the business. Each only receives what it needs for its job and is bound by its own privacy terms:
- Stripe (payments and invoices), United States and Australia.
- Cloudflare (hosting, DNS, security, basic traffic analytics without tracking cookies), global network.
- Microsoft 365 (our email), Australia region.
- Google (public business listing data, maps and photos), United States.
- Anthropic (AI assistance for drafting website copy from public business information and for sorting incoming email), United States. We do not send card details or passwords to it.
- Domain registries and registrars when we register a domain in your name, which requires your business name, ABN and contact details to be recorded with the registry.
Some of these providers store data outside Australia. We take reasonable steps to make sure they protect it to a standard comparable to the Australian Privacy Principles.
Cookies
Our own sites use only cookies strictly needed to work, such as a session cookie after you log in or open an edit link. We do not use advertising or cross-site tracking cookies.
How long we keep it
Account and billing records: 7 years after the last transaction, as Australian tax law requires. Content for a service: deleted within 90 days of the service ending unless you ask for a copy first. Server logs: 30 days. Outreach contact details: until the business becomes a customer, asks us to stop, or 12 months after our last contact, whichever is first; opt-out records are kept indefinitely so the opt-out holds.
Security
Data is encrypted in transit and at rest with our providers, access is limited to the people who need it, and credentials are stored in managed secret stores, never in code. If a data breach is likely to cause serious harm we notify affected people and the OAIC as the Notifiable Data Breaches scheme requires.
Your rights
You can ask to see, correct or delete the personal information we hold about you, or ask us to stop contacting you, by emailing [email protected]. We respond within 30 days. If you are not satisfied with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Contact
Privacy officer, Wavefront Labs Pty Ltd, [email protected].