Call +61 413 691 821
Legal

Privacy Policy

How we collect, use, store and protect personal information — in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Effective 1 July 2026 · Last updated 1 July 2026

Clever AI is the trading name of Joshua Sapwell, sole trader, of Victoria, Australia (ABN 55 896 185 179). In this policy, "we", "us" and "our" mean Clever AI, and "you" means the person whose personal information we handle.

We build AI-powered tools and automations for Australian small businesses on Google Cloud and Firebase. Being privacy-ready from day one is one of the things we stand for. This policy explains how we handle personal information across our website (cleverai.au) and our client engagements.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Guidance from the Office of the Australian Information Commissioner (OAIC) is available at oaic.gov.au.

A note on the 2026 privacy reforms. Australia is reforming its privacy laws, including removing the long-standing small-business exemption and introducing new transparency rules for automated decision-making (in effect from 10 December 2026). We have chosen to operate to full APP standards now rather than wait — so if you are a client in a regulated sector, this is the privacy-ready posture you need.

On this page

  1. What personal information we collect
  2. How and why we use it
  3. Automated decision-making & AI
  4. How we store and protect it
  5. When we disclose it
  6. Access and correction
  7. Data breaches
  8. Cookies and analytics
  9. Complaints
  10. Changes to this policy
  11. Contact us

1. What personal information we collect

On our website and in enquiries

  • Contact details you give us — name, email, phone, business name.
  • The content of your enquiry or correspondence.
  • Basic technical and analytics data — such as IP address, browser type and pages viewed, where analytics are enabled.

During client engagements

  • Contact and account details of your nominated staff.
  • Credentials and access you grant us to deliver the project (handled under our data-handling and security practices).
  • Any data inside the systems we build or work on. This may include personal information about your customers or staff if it sits in those systems. We act on your instructions in relation to that data.

We collect only what we reasonably need. We do not collect sensitive information unless it is necessary and you have consented.

2. How and why we use it

We use personal information to:

  • respond to enquiries and provide quotes;
  • deliver, support and maintain the tools and automations you engage us to build;
  • manage our relationship with you, invoice and keep records; and
  • meet our legal obligations.

We use it only for the purpose it was collected for, a directly related purpose you would reasonably expect, or where you have consented. We do not add enquiry contacts to marketing lists without consent.

3. Automated decision-making & AI

On our own website and enquiries, we do not use automated processing to make decisions that significantly affect your rights or interests. Enquiries are read and answered by a person.

AI processing. Some tools we build for clients use AI (for example Anthropic or OpenAI models) to process data. Where AI is used, it is called server-side and configured so that data is not used to train third-party models, in line with the provider's business/API terms. We design validation and human-review guardrails around AI outputs.

Where a tool we build for a client makes automated decisions that could significantly affect an individual, the client is generally the responsible entity for that system. We help our clients meet their transparency obligations, including the automated decision-making disclosure requirements taking effect on 10 December 2026.

4. How we store and protect it

  • Client project data is stored in Australian regions of Google Cloud and Firebase where reasonably available.
  • Data is encrypted in transit (TLS) and at rest using our cloud providers' standard encryption.
  • We apply least-privilege access and secure credential handling.
  • We keep personal information only as long as needed for the purpose it was collected, or as required by law, then delete or de-identify it.

5. When we disclose it

We do not sell personal information. We may disclose it to:

  • Sub-processors and platforms that help us deliver services — primarily Google Cloud / Firebase (hosting and enquiry storage), Google Analytics (website usage statistics), Cal.com (call bookings), and AI providers such as Anthropic and OpenAI (server-side processing). Others may apply to specific features or app builds.
  • Professional advisers (such as our accountant or solicitor) under confidentiality.
  • Authorities, where required or authorised by law.

Overseas disclosure. Some providers may process data overseas (for example AI APIs hosted in the United States). Where this occurs, we take reasonable steps to ensure the data is handled consistently with the APPs, and we identify it in the relevant statement of work. We prefer Australian data regions for storage wherever practical.

6. Access and correction

You can ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Contact us at joshua@cleverai.au. We will respond within a reasonable time (usually 30 days) and may need to verify your identity. If we refuse access or correction, we will explain why.

Where the personal information is held inside a system we built for a client, that client is generally the responsible entity for access and correction requests, and we will help them respond.

7. Data breaches

We maintain an incident-response process. If a data breach is likely to result in serious harm, we will act under the Notifiable Data Breaches (NDB) scheme — assess and contain it, notify affected individuals and the OAIC as required, and work with any affected client to coordinate notification.

8. Cookies and analytics

Our website uses Google Analytics to understand traffic and improve the site — for example which pages are viewed and roughly where visitors arrive from. Google Analytics sets cookies and processes limited data (such as your IP address) on our behalf as a sub-processor. We have configured it for analytics only: advertising and cross-site tracking signals are turned off, and IP addresses are anonymised. We do not use advertising cookies. You can opt out by blocking or deleting cookies in your browser, or by installing Google's browser opt-out add-on. We will always disclose analytics here, and will seek your consent before introducing any tracking that legally requires it.

9. Complaints

If you think we have mishandled your personal information, contact us first at joshua@cleverai.au and we will investigate and respond. If you are not satisfied, you can complain to the OAIC at oaic.gov.au or 1300 363 992.

10. Changes to this policy

We may update this policy from time to time. The current version is always on cleverai.au, with the effective date shown at the top.

11. Contact us

Clever AI — Joshua Sapwell
Email: joshua@cleverai.au · Phone: +61 413 691 821 · Web: cleverai.au
Victoria, Australia · ABN 55 896 185 179

This policy is provided in good faith and describes our current practices. It is general in nature and does not constitute legal advice.