Privacy Policy.

Keystroke is a two-person business based in Victoria, Australia. The principals are Kieran and Tyler. We rebuild the manual parts of a business: reporting, scheduled work, software, websites and design.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Where we handle health information, we also follow the Health Privacy Principles in the Health Records Act 2001 (Vic).

Contact for anything in this policy: the contact form.

Sensitive information. We do not ask for sensitive information, such as health, racial or ethnic origin, religious or political views, or criminal records. Please do not type it into a form. If a client engagement needs access to systems that hold health information, we handle it under Personal information we handle for clients and the Health Records Act.

Tax file numbers. We do not collect tax file numbers. If a client's payroll or timesheet system holds them, we design our work so we do not need to see them. If we must, we follow the Privacy (Tax File Number) Rule 2015.

• From you, when you use the quiz, send a form, email or call us, book a meeting, or engage us.
• Automatically, when you visit the site. Our host, Cloudflare, records technical data to keep the site secure and working.
• From public sources, when we research businesses we think we can help. We use the business's own website, its Google Business Profile, ABN Lookup, ASIC's public register, public LinkedIn profiles, industry directories, council and chamber of commerce listings and news articles. We do not buy contact lists, and we do not use data brokers or leaked data.
• From our clients, when they give us access to their systems or records to do the work.

If we collect your details from a public source, our first message tells you who we are, where we found your details, and how to stop hearing from us.

Cookies. This site sets no cookies of its own. Google reCAPTCHA, which tells people from automated senders on the forms and the quiz, sets one that it needs to work, on pages where a form has been on screen or the quiz has been finished. Your browser remembers, until you close the tab, that the opening animation on the homepage has played and the quiz result it has just shown you. Neither holds your name or contact details.

We use personal information only for the purpose we collected it, a related purpose you would reasonably expect, or where the law allows or requires it.

The quiz result is written by a software agent built on Anthropic's Claude models. When you answer the last question, your nine answers are sent to our website and on to Claude, which writes the result you see. Kieran and Tyler see a result only if you send it to us with the form beneath it.

• What the agent does. It reads your answers, names the problem back to you, and recommends up to three items from our product list. It cannot quote, commit to dates or agree to anything on our behalf.
• No decisions about you. The quiz makes no decision that significantly affects your rights or interests. A result is a suggestion. Nothing is approved, refused or priced for you by a computer program. If that ever changes, this policy will say which kinds of personal information the program uses and what decisions it makes.
• Your information is not used to train AI models. Under Anthropic's commercial terms, information we send through its API is not used to train its models. Anthropic deletes it within 30 days, except where its own policies require longer, such as investigating misuse.
• Client work. Our scheduled agents ("the crew") process client data only for the work the client engaged us to do, using commercial services whose terms prohibit training on that data. We do not put client personal information into free or consumer AI tools.
• Human review. Anything an agent produces for a client is checked by Kieran or Tyler before it is relied on, unless the client has agreed in writing that a process can run unattended.

When a client gives us access to its systems, the client decides what personal information is in them and why. We act as the client's service provider. We:

• access only what the work needs, and only for that work
• follow the client's reasonable instructions and its privacy obligations
• keep the data secure (see How we keep it secure and how long we keep it)
• tell the client without delay, and within 72 hours, if we become aware of a data breach that affects its data
• return or delete the client's data when the engagement ends, unless the law requires us to keep it

If you are a client's customer, patient or staff member and want to access or correct your information, contact the client first. We will help the client respond.

We send commercial emails only to business addresses that are published for a person's role, where our message relates to that role, and where the business has not said it does not want unsolicited commercial email. We also send them to people who have agreed to hear from us.

Every email identifies Keystroke, gives our ABN and contact details, and has an unsubscribe link. We action unsubscribes within five business days and keep your address on a do-not-contact list so it is not used again.

We make business calls only between 9am and 8pm on weekdays and 9am and 5pm on Saturdays, never on Sundays or national public holidays. We display our number, and we end the call when asked. We check any mobile number against the Do Not Call Register before calling.

We never sell, rent or trade personal information.

We share personal information only with the service providers we use to run the business, and only what each needs.

We may also disclose personal information where the law requires it, for example to a court, a regulator or the police, or where it is needed to prevent a serious threat to someone's life, health or safety.

Some of our providers process information outside Australia, mainly in the United States. Cloudflare's network operates in many countries, so technical data and cached content can pass through any of them. Before we use a provider, we check its terms, and we use providers whose data processing terms bind them to keep information secure and use it only to provide their service to us. We send them only what the task needs.

We use multi-factor authentication on every account, keep access to the two principals, use encrypted connections, apply security updates promptly and keep client data in client systems or our Microsoft 365 tenant, not on personal devices or loose files.

When we no longer need information, we delete it or remove anything that identifies you.

If we suspect a data breach, we contain it, assess it within 30 days, and tell the people affected and the Office of the Australian Information Commissioner (OAIC) where the breach is likely to cause serious harm. Where the breach involves client data, we tell the client within 72 hours.

You can ask what personal information we hold about you, and ask us to correct or delete it. Use the contact form. We may need to confirm who you are. We respond within 30 days, and it costs nothing. If we refuse, we tell you why in writing and how to complain.

You can use the quiz without giving your name. You can ask us a general question without identifying yourself, though we will need your details to do paid work for you.

Use the contact form with what happened. We acknowledge your complaint within five business days and give you a written response within 30 days.

If you are not satisfied, you can complain to the Office of the Australian Information Commissioner on 1300 363 992. If your complaint is about health information in Victoria, you can also contact the Health Complaints Commissioner.

We update this policy when what we do changes. The date at the top shows the current version. If a change matters to clients, we tell them directly.

Privacy Officer, Keystroke. the contact form.