INTERIM: published pending lawyer review, v2026-10-16-interim
Privacy policy
RR Consulting Group Pty Ltd (ACN 702 529 940, ABN 33 702 529 940) ("RR", "we", "us") is an Australian software consultancy based in Sydney. This policy explains how we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It also covers our clients and contacts in the United States. It is an interim text: it has not yet been reviewed by a lawyer, and we will publish a reviewed version when that is done.
What we collect
- Contact and account details: names, work email addresses, phone numbers, job titles, and the business you represent (including an ABN, which for a sole trader can identify you).
- Project information: what you tell us about your business and project, in writing or by voice; answers to our onboarding questions; photos, files and voice notes you upload; feedback and comments.
- Billing records: invoices, payments and bank transfer references. Card payments are made on our payment provider's own pages; we never see or store your card number.
- Access you grant us: credentials for your systems (for example a store collaborator code or an API key), held encrypted.
- Technical records: sign-in times, IP addresses, browser details and security logs.
- Consent and signing records: which version of our terms and notices you accepted, when, and the name you signed with.
We do not ask for sensitive information such as health details or government identifiers. Please do not include it in messages or uploads. If we receive it without asking, we delete it or remove it from our records when we notice it, unless we need to keep it for the project and you agree.
How we collect it
Mostly from you: through our website, the client portal, email, calls and the files you send. We also collect it from other people at your business who use the portal, from public records such as the ABN register when we check an ABN, from our payment provider when you pay, and from the systems you give us access to.
When we work inside your systems (for example your online store), the personal information of your own customers stays under your control and your privacy policy. We use it only to do the work you asked for.
Why we collect it
To quote, plan and deliver your project; to run the client portal and sign you in securely; to bill you and keep tax records; to keep our systems and yours secure; to meet our legal obligations; and, only if you opt in, to send you news and offers. You can opt out of marketing at any time with the unsubscribe link in any marketing email, or by emailing us.
If you do not give us the information we ask for, we may not be able to quote or complete the work.
How we use software and AI
We use software, including AI models, to help us do the work:
- When you describe a project, software drafts a list of what to build and checks it against our list of standard features. It can tell you straight away that a request looks like something we do not build, or that it needs a call before we can quote. We review every spec before we send a quote, and no price is sent to you without our approval.
- On our website you can speak instead of typing (the 🎙️ button). Your browser turns your speech into text with its own speech service: in Chrome that is Google, and in Safari that is Apple. The audio may be processed outside Australia, including in the United States, under their terms. We receive only the text that appears in the box, never a recording. If you would rather not, type instead.
- AI models help read onboarding answers and feedback, sort them, and draft replies and plans. A person approves every reply before it is sent to you.
These tools use what you tell us about your business and project, your contact details, and the answers and files you give us. They do not make decisions about you as an individual, such as credit or employment decisions. If you think software has got something wrong about your project, email us and a person will look at it again.
Who we share it with
We use a small number of service providers to run our business. They handle personal information for us, only for the purpose below and under business terms that limit how they may use it. We do not publish their names, so that the way our systems are built stays private; we will name a provider on request where the law requires it.
| What for | Where |
|---|---|
| Hosting this website, delivered through a content network | Sydney region; pages may be served from locations outside Australia |
| Hosting the client portal | Sydney region |
| Our database and file storage | Sydney, Australia |
| AI models that help read project descriptions, onboarding answers and feedback, and help plan and build the work | United States |
| Turning voice recordings into text | United States |
| Generating creative and brand images from your brief and reference images, if your project includes creative work. This provider's terms allow it to use uploaded images to improve its models. | United States |
| Card and bank payments (you enter card details on the payment provider's own pages; we never see them) | United States and other countries |
| Storing the code we write for you, which can include names in comments and change history | United States |
| Our business email, including messages you send to us | Region not yet confirmed |
| Booking calls, if you book one | United States |
| Sending our email notifications and sign-in links | United States |
We may also disclose information where the law requires it, or to professional advisers (such as our accountant or lawyer) who must keep it confidential. We do not sell personal information.
Overseas disclosure
Some of the providers above are in the United States, so information you give us may be sent there. Our main database and files are stored in Australia (Sydney). We choose providers whose business terms limit how they may use the information, and under the Privacy Act we remain responsible for how they handle it.
How long we keep it
| Information | How long |
|---|---|
| Sign-in links, sessions, security tokens | Deleted 30 days after they expire |
| Abuse and rate-limit counters | 2 days |
| Operational logs | 90 days |
| Email delivery records | 180 days |
| Enquiries that never became a project | Anonymised after 2 years |
| Voice transcripts from enquiries that never became a project | Anonymised after 90 days |
| Voice notes, transcripts and answers given during a project | Part of the project record (see below) |
| Data export downloads | Available for 7 days |
| Credentials you shared | Flagged for revocation 7 days after they are no longer needed |
| Client and project records | For the life of the relationship plus 7 years, then reviewed and deleted or de-identified |
| Tax and financial records | 5 to 7 years, as tax and company law requires |
| Audit, consent and signing records | For the life of the relationship plus 7 years |
Security
Information is encrypted in transit and at rest. Staff access is limited by role. No system is completely secure. If we have a data breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), following the Notifiable Data Breaches scheme.
Cookies and browser storage
The client portal uses one cookie to keep you signed in and secure. Our website and portal also save some drafts in your own browser (for example a project description you have not sent yet, or an unsent voice recording) so a refresh does not lose them; that copy stays on your device until you send it or clear it. We do not use advertising trackers or analytics cookies.
Your rights
You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email adam@rrconsult.ing. We may need to confirm who you are first. We answer within 30 days. Some records (for example tax records and signed agreements) must be kept for a time even if you ask us to delete them; we will tell you which.
If you are in the United States, you can also opt out of the sale or sharing of personal information. We do not sell or share it for advertising, and we honour Global Privacy Control signals.
Complaints
Email our privacy officer at adam@rrconsult.ing. We will respond within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
Changes
We publish each new version of this policy with its version and date. The version in force is the one shown in the portal.
Contact
RR Consulting Group Pty Ltd, ACN 702 529 940, ABN 33 702 529 940, Sydney NSW. Privacy officer: adam@rrconsult.ing
This page
- The application form. Your answers, name, business, email, mobile, website if you give it, who referred you, and a tag showing which link brought you here. They are emailed to us through our email provider in the United States so we can reply. If that fails, the page opens an email to us in your own email app instead, and nothing is sent until you send it.
- Email. Anything you send to adam@rrconsult.ing.
- Technical records. This page is hosted by a US hosting provider and may be served from locations outside Australia. The provider keeps standard request logs, such as IP address, browser type and the page requested, for security and to keep the page running.
This page uses no advertising trackers, analytics or cookies.