Privacy Policy

1. Who we are

RedAI Studios Pty Ltd (ACN 700 870 695) is an Australian company that builds and operates software products. We also trade as Redmatic for client software services. In this policy, "we", "us" and "our" mean RedAI Studios Pty Ltd.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where we handle information on behalf of a business customer — for example, their customer or job records inside one of our products — that customer is the controller of that information and we process it under their instructions and our agreement with them.

2. Information we collect

When you visit this website

We collect only what your browser sends in the ordinary course of loading a page: your IP address, browser and device type, the pages you request, and referring page. This is used for security and to understand aggregate traffic. We do not use it to build a profile of you.

When you contact us

If you email us or fill in a form, we collect your name, email address and whatever else you choose to tell us, so we can respond and keep a record of the correspondence.

When you use our products

Depending on the product, this may include:

• Account information — name, email address, the organisation you belong to, and your role or permissions.
• Authentication data — credentials or tokens needed to keep your account secure. Passwords, where used, are stored only as salted hashes and are never readable by us.
• Business and operational data — the content you or your organisation put into the product: customers, jobs, quotes, projects, schedules, notes, documents and messages.
• Integration data — where you connect a third-party system, the data that system makes available to us at your direction. You control what is connected and can disconnect at any time.
• Usage and diagnostic data — logs of feature use, performance metrics and error reports, used to keep the service working and to improve it.
• Health information — in Aurasync, the cycle, symptom, treatment and wellbeing data you choose to record. This is sensitive information under Australian law and is covered separately in section 5.
• Preferences and region — in Sportrack, the teams and competitions you follow, your notification settings, and the country you are in. See below.

Sportrack specifically

Sportrack is a consumer app, so it is worth being precise about the small amount it collects:

• Your country or region, because which channel is showing a match depends on where you are. This is determined from the region you select, or from an approximate country-level lookup of your IP address. We do not collect precise location, we do not request GPS access, and we do not track your movements.
• The teams and competitions you follow, and your notification preferences, so the app can show you the right fixtures and alert you at the right times.
• Questions you ask the app about form, fixtures and history, which are processed as described in section 4. Ask it about a team, not about yourself.
• Usage and crash data, in aggregate, to keep the app working.

Sportrack does not need your contacts, photos, microphone, calendar or precise location, and does not ask for them.

3. How we use information

We use personal information to:

• provide, operate and maintain our products and this website;
• authenticate you and keep accounts secure;
• respond to your enquiries and provide support;
• diagnose faults, monitor performance and improve reliability;
• develop and improve features;
• send service communications such as security notices, outage notifications and material changes to a product; and
• meet our legal, tax and record-keeping obligations.

We do not sell personal information. We do not use your business or operational data to advertise to you, and we do not disclose it to advertisers.

4. AI processing

Our products use artificial intelligence, including large language models, to perform tasks such as summarising, drafting, classifying and answering questions about your data. Where this happens, some of your content may be sent to a third-party AI provider to be processed and a result returned.

When we do this:

• we send only the content needed for the specific task;
• we use providers under terms that prohibit training their models on our customers' data; and
• we do not use your business data to train models of our own without your express agreement.

AI-generated output can be wrong. Our products present it as a suggestion or a draft to be reviewed, and it should not be relied on as the sole basis for a decision with legal, financial or safety consequences.

5. Health and other sensitive information

Some of our products — Aurasync in particular — collect information about your health, including menstrual cycles, fertility and IVF treatment, pregnancy, and menopause. Under the Privacy Act 1988 (Cth) this is sensitive information, which carries higher protections than ordinary personal information. We treat it accordingly.

Consent

We collect health information only with your express consent, and only what the feature you're using actually needs. You choose which life stage to track and what to record. You can stop at any time, and stopping does not require you to delete your account.

What we will never do with it

• We do not sell health information. Not to anyone, in any form, aggregated or otherwise.
• We do not use it for advertising, ad targeting, or to build marketing profiles — of you or of anyone else.
• We do not share it with data brokers, insurers, employers, or analytics providers.
• We do not use it to train AI models, ours or anyone else's.

Partner sharing

Aurasync can share selected information with a partner's app so they can understand how you're feeling and how to support you. This is entirely optional and off by default. Specifically:

• You initiate it. A partner cannot request, be granted, or gain access without your explicit action.
• You choose what's shared. Sharing is granular — you decide which information a partner sees, and you can share less without sharing nothing.
• You can revoke it at any time, immediately, from within the app. Revoking is always available and never requires a reason, a waiting period, or contacting us.
• Partners cannot export or retain what they see beyond the app, and lose access to all of it the moment you revoke.

Storage and deletion

Health information is encrypted in transit and at rest, and access is restricted to the smallest number of people needed to operate the service. You can delete your health data — or your whole account — at any time, as set out in section 8. Deletion of health data is not subject to the financial record-keeping obligations that apply to billing information.

6. Who we share it with

We disclose personal information only in these circumstances:

• Service providers who help us operate — hosting and infrastructure, email delivery, error monitoring, payment processing and AI processing. They may access information only to perform services for us and are bound to protect it.
• Sports data providers — Sportrack receives fixtures, scores, statistics and broadcast schedules from third-party feeds. Information flows from them to us. We do not send them your personal information, your identity or the teams you follow.
• Your organisation — if you use a product through an employer or business, its administrators can access the data in that account, including content you create.
• Systems you connect — where you authorise an integration, at your direction and to the extent you configure.
• Professional advisers — accountants, auditors and lawyers, under confidentiality.
• Legal requirement — where we're required by law, or where disclosure is reasonably necessary to prevent a serious threat to life, health or safety.
• Business transfer — if the business or a product is sold or restructured, information may transfer with it. This policy would continue to apply until you're notified otherwise.

7. Storage, location and security

Data is stored on infrastructure operated by reputable cloud providers. Some providers operate globally, so information may be stored or processed outside Australia. Where that happens we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

Our security measures include:

• encryption in transit (TLS) and at rest;
• access control on the principle of least privilege, with multi-factor authentication on administrative accounts;
• logical separation of each customer's data;
• credentials held in a dedicated secrets manager, never in source code; and
• logging and monitoring of access to production systems.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. Retention and deletion

We keep personal information only as long as needed for the purpose it was collected, or as long as the law requires. Australian tax and corporate law generally requires financial records to be kept for at least five years.

You can request deletion of your account and its personal information at any time by emailing support@redaistudios.com. We will action it within 30 days, other than information we're legally required to retain or that is needed to resolve a dispute. Where you use a product through an organisation, some requests may need to come from that organisation's administrator, and we'll tell you if that's the case.

Backups are retained on a rolling cycle and are overwritten in the ordinary course.

9. Your rights

You can:

• Access the personal information we hold about you;
• Correct anything inaccurate, out of date or incomplete;
• Request deletion, subject to the retention obligations above;
• Ask for a copy of your data in a common machine-readable format;
• Opt out of non-essential communications at any time; and
• Complain if you think we've mishandled your information.

Email privacy@redaistudios.com. We will respond within a reasonable period, and in any case within 30 days. We may need to verify your identity first. There's no charge for making a request.

10. Cookies and analytics

This website uses only what's necessary to serve pages and keep the site secure. Our products use cookies or equivalent local storage to keep you signed in and to remember your preferences — these are essential to the service and cannot be disabled while you're using it.

We do not use advertising cookies or third-party tracking pixels. Where we use analytics, it is configured to measure aggregate usage rather than to identify individuals.

Advertising

We do not currently serve advertising in any product. If a consumer product becomes ad-supported in future, we will update this policy and our app-store data declarations before any advertisement appears, so that what you are told matches what the app does.

Two commitments hold regardless. We will never base advertising on health or other sensitive information, in any product, in any form — the undertakings in section 5 are absolute and are not affected by any advertising arrangement. And we will not sell personal information to advertisers or data brokers.

11. Children and young people

Minimum ages differ by product, because the products differ. They are also set out in the Terms of Service.

• Our business products — Albot, Redeal CRM and the PM Tracker — are workplace tools, are not directed at children, and are used by adults in the course of their work.
• Aurasync is for people aged 16 and over.
• Sportrack is a general-audience sports app and is for people aged 13 and over. We recognise that sport is followed by young people, so Sportrack is deliberately built to need very little: no precise location, no contacts, no advertising identifiers, and no profile beyond the teams you choose to follow.

We do not knowingly collect personal information from a child below the relevant minimum age. If you believe a child has provided us with personal information, contact privacy@redaistudios.com and we will delete it. A parent or guardian can ask us to access, correct or delete their child's information on the same basis.

12. Changes to this policy

We may update this policy as our products change or the law changes. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your information, we'll notify you directly — by email or in the product — before it takes effect.

13. Contact and complaints

For any privacy question, request or complaint:

• Email — privacy@redaistudios.com — the fastest way to reach our Privacy Officer

We take complaints seriously and will acknowledge yours promptly and respond within 30 days. If you're not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.