Privacy Policy

1. Who we are

RedAI Studios Pty Ltd (ACN 700 870 695) is an Australian company that builds and operates software products. We also trade as Redmatic for client software services. In this policy, "we", "us" and "our" mean RedAI Studios Pty Ltd.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where we handle information on behalf of a business customer — for example, their customer or job records inside one of our products — that customer is the controller of that information and we process it under their instructions and our agreement with them.

2. Information we collect

When you visit this website

We collect only what your browser sends in the ordinary course of loading a page: your IP address, browser and device type, the pages you request, and referring page. This is used for security and to understand aggregate traffic. We do not use it to build a profile of you.

When you contact us

If you email us or fill in a form, we collect your name, email address and whatever else you choose to tell us, so we can respond and keep a record of the correspondence.

When you use our products

Depending on the product, this may include:

• Account information — name, email address, the organisation you belong to, and your role or permissions.
• Authentication data — credentials or tokens needed to keep your account secure. Passwords, where used, are stored only as salted hashes and are never readable by us.
• Business and operational data — the content you or your organisation put into the product: customers, jobs, quotes, projects, schedules, notes, documents and messages.
• Integration data — where you connect a third-party system, the data that system makes available to us at your direction. You control what is connected and can disconnect at any time.
• Usage and diagnostic data — logs of feature use, performance metrics and error reports, used to keep the service working and to improve it.
• Health information — in Aurasync, the cycle, symptom, treatment and wellbeing data you choose to record. This is sensitive information under Australian law and is covered separately in section 5.

3. How we use information

We use personal information to:

• provide, operate and maintain our products and this website;
• authenticate you and keep accounts secure;
• respond to your enquiries and provide support;
• diagnose faults, monitor performance and improve reliability;
• develop and improve features;
• send service communications such as security notices, outage notifications and material changes to a product; and
• meet our legal, tax and record-keeping obligations.

We do not sell personal information. We do not use your business or operational data to advertise to you, and we do not disclose it to advertisers.

4. AI processing

Our products use artificial intelligence, including large language models, to perform tasks such as summarising, drafting, classifying and answering questions about your data. Where this happens, some of your content may be sent to a third-party AI provider to be processed and a result returned.

When we do this:

• we send only the content needed for the specific task;
• we use providers under terms that prohibit training their models on our customers' data; and
• we do not use your business data to train models of our own without your express agreement.

AI-generated output can be wrong. Our products present it as a suggestion or a draft to be reviewed, and it should not be relied on as the sole basis for a decision with legal, financial or safety consequences.

5. Health and other sensitive information

Some of our products — Aurasync in particular — collect information about your health, including menstrual cycles, fertility and IVF treatment, pregnancy, and menopause. Under the Privacy Act 1988 (Cth) this is sensitive information, which carries higher protections than ordinary personal information. We treat it accordingly.

Consent

We collect health information only with your express consent, and only what the feature you're using actually needs. You choose which life stage to track and what to record. You can stop at any time, and stopping does not require you to delete your account.

What we will never do with it

• We do not sell health information. Not to anyone, in any form, aggregated or otherwise.
• We do not use it for advertising, ad targeting, or to build marketing profiles — of you or of anyone else.
• We do not share it with data brokers, insurers, employers, or analytics providers.
• We do not use it to train AI models, ours or anyone else's.

Partner sharing

Aurasync can share selected information with a partner's app so they can understand how you're feeling and how to support you. This is entirely optional and off by default. Specifically:

• You initiate it. A partner cannot request, be granted, or gain access without your explicit action.
• You choose what's shared. Sharing is granular — you decide which information a partner sees, and you can share less without sharing nothing.
• You can revoke it at any time, immediately, from within the app. Revoking is always available and never requires a reason, a waiting period, or contacting us.
• Partners cannot export or retain what they see beyond the app, and lose access to all of it the moment you revoke.

Storage and deletion

Health information is encrypted in transit and at rest, and access is restricted to the smallest number of people needed to operate the service. You can delete your health data — or your whole account — at any time, as set out in section 8. Deletion of health data is not subject to the financial record-keeping obligations that apply to billing information.

6. Who we share it with

We disclose personal information only in these circumstances:

• Service providers who help us operate — hosting and infrastructure, email delivery, error monitoring, payment processing and AI processing. They may access information only to perform services for us and are bound to protect it.
• Your organisation — if you use a product through an employer or business, its administrators can access the data in that account, including content you create.
• Systems you connect — where you authorise an integration, at your direction and to the extent you configure.
• Professional advisers — accountants, auditors and lawyers, under confidentiality.
• Legal requirement — where we're required by law, or where disclosure is reasonably necessary to prevent a serious threat to life, health or safety.
• Business transfer — if the business or a product is sold or restructured, information may transfer with it. This policy would continue to apply until you're notified otherwise.

7. Storage, location and security

Data is stored on infrastructure operated by reputable cloud providers. Some providers operate globally, so information may be stored or processed outside Australia. Where that happens we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles.

Our security measures include:

• encryption in transit (TLS) and at rest;
• access control on the principle of least privilege, with multi-factor authentication on administrative accounts;
• logical separation of each customer's data;
• credentials held in a dedicated secrets manager, never in source code; and
• logging and monitoring of access to production systems.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

8. Retention and deletion

We keep personal information only as long as needed for the purpose it was collected, or as long as the law requires. Australian tax and corporate law generally requires financial records to be kept for at least five years.

You can request deletion of your account and its personal information at any time by emailing support@redaistudios.com. We will action it within 30 days, other than information we're legally required to retain or that is needed to resolve a dispute. Where you use a product through an organisation, some requests may need to come from that organisation's administrator, and we'll tell you if that's the case.

Backups are retained on a rolling cycle and are overwritten in the ordinary course.

9. Your rights

You can:

• Access the personal information we hold about you;
• Correct anything inaccurate, out of date or incomplete;
• Request deletion, subject to the retention obligations above;
• Ask for a copy of your data in a common machine-readable format;
• Opt out of non-essential communications at any time; and
• Complain if you think we've mishandled your information.

Email privacy@redaistudios.com. We will respond within a reasonable period, and in any case within 30 days. We may need to verify your identity first. There's no charge for making a request.

10. Cookies and analytics

This website uses only what's necessary to serve pages and keep the site secure. Our products use cookies or equivalent local storage to keep you signed in and to remember your preferences — these are essential to the service and cannot be disabled while you're using it.

We do not use advertising cookies or third-party tracking pixels. Where we use analytics, it is configured to measure aggregate usage rather than to identify individuals.

11. Children

Our products are business tools and are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as our products change or the law changes. The "last updated" date at the top always reflects the current version. If a change materially affects how we handle your information, we'll notify you directly — by email or in the product — before it takes effect.

13. Contact and complaints

For any privacy question, request or complaint:

• Email — privacy@redaistudios.com — the fastest way to reach our Privacy Officer

We take complaints seriously and will acknowledge yours promptly and respond within 30 days. If you're not satisfied with our response, you can refer the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.