Legal

Privacy Policy

Version 1.0 · Last updated 27 June 2026

Plain English first

We collect only what we need to run your engagement, we tell you where it goes, and we delete what we no longer need. If we send your information overseas, we name the country here — and if it’s to deliver your build, we tell you before it happens. The detail follows. If anything here is unclear, the people named at the end will answer plainly.

1. Who this policy applies to

This policy explains how Knotless AI Pty Ltd (ABN XX XXX XXX XXX) (“Knotless”, “we”, “us”, “our”) handles personal information. It covers our website at knotless.com.au and knotless.au, the free Fit Call, the Knotless Assessment, and any implementation work we deliver.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We hold ourselves to these standards as a matter of commitment, whether or not the Act’s small business threshold applies to us at any given time.

2. The personal information we collect and hold

We collect two kinds of personal information.

a. Information about you — when you contact us or become a client. Your name, your company or organisation name, your email address, and your phone number if you give it. If you become a client, it also includes what you and your team tell us during an engagement — for example, the names and roles of the people who run a workflow, and how your business operates.

b. Information about other people — inside the material you share with us during an engagement. To assess or build a workflow, we sometimes need real examples of how that workflow runs. Those examples can contain personal information about your customers, clients, candidates, tenants, suppliers, or staff. Depending on your business, that can include contact details, financial details, or other information.

We treat this second kind as strictly confidential. We use it only to produce your findings or to deliver your build, and we hold it for the shortest time we can (see section 9). When you give us this material, you confirm you are allowed to share it with us. How we handle it is set out in full in your engagement terms, alongside this policy.

We do not set out to collect sensitive information (such as health information) about you through marketing or contact. Where sensitive information happens to sit inside client engagement material, we handle it under the confidentiality, security, and retention rules in this policy.

3. How we collect personal information

We collect it:

Directly from you — when you complete the enquiry form, email us, or speak with us on the Fit Call or during an engagement.
From the material you give us during an engagement, which may contain information about other people, as described in section 2(b).
Automatically and minimally — through privacy-friendly website analytics that do not identify you (see section 5).

We do not buy personal information. We do not collect it from list purchases, competitions, or data brokers.

4. Why we collect it, and how we use it

We use personal information only for the reason we collected it, or for a reason you would reasonably expect:

to answer your enquiry and arrange your Fit Call;
to run your Assessment and produce your findings;
to deliver and support your build, if you proceed;
to meet our record-keeping, professional, and legal obligations.

We may contact you about your enquiry or your engagement. We do not send marketing to purchased lists, and you can ask us to stop contacting you at any time. We do not sell personal information, and we do not use it for advertising.

5. Our website, forms and analytics

Dealing with us anonymously. You can browse our website without telling us who you are. To answer an enquiry or run an engagement we need your contact details, so anonymity is not practical once you get in touch — but you choose what you share, and when.

The enquiry form. Our website has no automated booking calendar. When you complete the enquiry form, you give your name, company name, email, and (optionally) your phone number. The form sends these to our business email so we can contact you, usually within one business day, to arrange a time.

Hosting. Our website is hosted by Netlify, a provider based in the United States. Netlify serves our public web pages. It does not store your engagement information.

Analytics. We use Plausible, a privacy-friendly analytics tool hosted in the European Union. Plausible uses no cookies and does not store information that identifies you. It tells us things like which pages are popular and how visitors found us, in aggregate. Because it is cookieless and does not store personal information, our website does not need a cookie-consent banner.

We do not run advertising and we do not use tracking pixels. If that changes, we will update this policy first.

6. How we hold and secure your information

We hold personal information in Microsoft 365 (email, document and file storage), set up for Australian data residency. Microsoft is a global provider headquartered in the United States; we cover the overseas side of this in section 7.

We take reasonable steps — technical and organisational — to protect personal information from misuse, interference, loss, and unauthorised access. These include access controls that limit access to the founders and authorised team members, multi-factor authentication on our accounts, encryption of information in transit and at rest provided by our platforms, and deleting information once we no longer need it.

7. When we disclose information, including overseas

Who we share information with. We disclose personal information only to:

our service providers, who help us run the business — mainly Microsoft (email and storage) and Netlify (website hosting);
our delivery partners, if you proceed to a build and technical work is carried out by a vetted partner firm (see below);
others, where you direct us to, or where the law requires it.

We do not sell personal information, and we do not disclose it for advertising.

Sending information overseas. We are likely to disclose personal information to recipients in:

the United States — because our website host (Netlify) and our email and storage provider (Microsoft) are US-headquartered. Microsoft is set up for Australian data residency.
Pakistan — but only if you choose offshore delivery for a build. We work with a small set of vetted delivery partners in Australia and Pakistan. You choose where your build is delivered: in Australia, or in Pakistan at a lower cost. We tell you which applies, and what each costs, before you sign anything. If you choose Australian delivery, your engagement information is not disclosed to Pakistan.

Before any build is delivered overseas, we take reasonable steps to make sure the overseas partner handles personal information consistently with the Australian Privacy Principles. That includes vetting the partner and putting a written agreement in place that binds them to APP-equivalent standards. No client information goes to a partner until that agreement is in place.

We stay responsible. Even when a build is delivered overseas, we remain accountable under Australian privacy law for how our delivery partner handles your information. Choosing offshore delivery does not change that.

If our business changes hands. If Knotless is sold, merged, or restructured, personal information may pass to the new owner, who would be bound by this policy or one at least as protective. If Knotless closes, we securely delete personal information, or return it where we have agreed to do so. We will tell you if a change like this affects how your information is handled.

8. If something goes wrong: data breaches

If we suspect a data breach that could affect you, we assess it quickly. If a breach is likely to cause serious harm, we notify the Office of the Australian Information Commissioner (OAIC) and the people affected, as the Notifiable Data Breaches scheme requires, and we tell you what we are doing about it.

9. How long we keep information, and when we delete it

We keep personal information only as long as we need it.

Engagement deliverables — your findings, registers, plans, and the signed contract — are kept for seven years after the engagement ends. These are the record of the professional advice we gave, and they may be needed if a question about that advice comes up later. They are archived with restricted access.
Raw client material — the working data, sample records, credentials, and access details we used to produce your findings — is deleted within 30 days of the engagement finishing.
Website enquiries that don’t become engagements are deleted within 12 months.
General contact information is kept until you ask us to remove it.

10. Automated decision-making

We do not use computer programs or artificial intelligence to make — or to substantially help make — decisions about you. Our assessments, findings, and verdicts are reached by people, using professional judgement. The AI work we do is advice to our clients about their own use of AI; it is not automated decision-making about the individuals whose information we hold. If this ever changes, we will update this policy to explain it, in line with the transparency rules that apply from December 2026.

11. How to access or correct your information

You can ask what personal information we hold about you, and you can ask us to correct it. Email us at privacy@knotless.com.au. We will respond within a reasonable time, normally within 30 days. There is no charge to ask. If we cannot give you access or make a correction, we will explain why in writing.

Where we hold deliverables for the seven-year period in section 9, we may need to keep those records even after a correction or deletion request, for the reasons explained there. If that applies to your request, we will tell you.

12. How to make a complaint

If you think we have mishandled your personal information, tell us first. Email privacy@knotless.com.au, addressed to Insiya, and we will look into it and respond. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au, by phone on 1300 363 992, or by mail to GPO Box 5288, Sydney NSW 2001.

13. Contact us

Knotless AI Pty Ltd ABN XX XXX XXX XXX PLACEHOLDER address line, Adelaide SA 5000, Australia

Privacy contact: Insiya (primary), Huzefa (secondary) Email: privacy@knotless.com.au

14. Changes to this policy

We update this policy when our information-handling practices change — for example, if we start running online advertising, or change our analytics or delivery arrangements. The current version is always at knotless.com.au. Version 1.0 · Last updated 27 June 2026.