Privacy Policy

1. About this policy

This website is run by CREO (Legal entity name to be confirmed, ABN ABN to be confirmed), referred to here as “CREO”, “we” or “us”. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) for the personal information this policy covers, whether or not the Act requires it of a business our size.

This policy covers the personal information CREO handles through this website and enquiries, about our clients’ staff and in our client records, and about people who supply or work with us. When we run services for clients, we handle their customers’ information as the client’s service provider, under our agreement with them and the client’s own privacy policy. For that information we apply the security steps in section 8 (its first paragraph) and, for providers we choose, the overseas safeguards in section 6. Section 12 covers how long we keep it, data breaches and access.

2. What we collect

Information you give us

When you send an enquiry or a project brief, we collect:

• your name and email address;
• your company name, if you add it;
• the services you’re interested in, and your budget range and timeline if you choose them;
• what you tell us about your project: what you’d like to do, where it’s up to, your goal, your audience and what success looks like;
• that you asked us to reply, when you sent the enquiry, and whether our spam check marked it as possibly automated.

When you request a demo of our app, we collect your name, email address and company, what you’d like it to help with if you tell us, and the page of our website you came from.

We also keep:

• what you tell us by email, by phone or in meetings, and recordings or transcripts of calls if we tell you first and you agree to continue;
• if you become a client, your business contact details and our project, billing and contract records;
• if you supply or work with us, your contact details, ABN, payment and contract details.

Please don’t include sensitive information (such as health details), identity documents, bank or card details, or other people’s personal information in an enquiry. If you include it anyway, we’ll delete or de-identify it unless we need it to respond to you.

You don’t have to give us your real name, but we need a working email address to reply, and some projects need to know who we’re working with.

This website is for businesses and people aged 16 or over. We don’t knowingly collect information from children under 16. If you think a child has sent us their details, contact us and we’ll delete them.

Information collected automatically

• Server logs. Like most websites, our hosting (AWS Amplify Hosting, part of Amazon Web Services) may record each request: your IP address, the time, the page asked for, the page you came from, and your browser and device type. We use these to keep the site running and secure.
• Spam protection. To stop automated spam, the server holds the IP address of anyone who sends, or tries to send, an enquiry in its memory until about 10 minutes after their last attempt. This check doesn’t write it anywhere else. The server also checks how long the form took to fill in.

We don’t currently use analytics, advertising or tracking tools, and the site loads no scripts, fonts or images from other companies. If that changes, we’ll update this policy first.

3. How we collect it

Mostly directly from you, through the forms on this website, by email or when we talk. Server logs are created automatically when you visit. We may also get your details from your employer or colleagues when your business is our client, from public sources such as your business’s website, and, for services we run for clients, from the client’s systems (see section 12). We don’t buy personal information.

4. Why we use it

• to read and reply to your enquiry, and to prepare a proposal or quote if you ask for one;
• if you request a demo of our app, to contact you about it when demos are available;
• to manage our relationship with you if you become a client, and to prepare for meetings and proposals;
• if you supply or work with us, to manage that relationship and pay you;
• to keep the website working, secure and free of spam;
• to meet our legal obligations.

Three automatic checks on our server protect the form from spam:

• a submission that fills in a hidden field only bots see is discarded;
• more than five attempts to send from one IP address within 10 minutes may be refused for up to 10 minutes;
• very fast sends are marked for us to check, not thrown away.

None of these checks assesses you or your project or makes a decision that significantly affects you, and a person reads every enquiry that passes them. We don’t use AI or other automated decision-making to make decisions about you from your enquiry.

We use your information only for the purposes above, for related purposes you’d reasonably expect (directly related, for sensitive information), or as the law allows.

5. Who we share it with

We don’t sell or rent personal information. We share it with the services that run our business:

These providers handle information on our behalf, to provide their service and for their own security and legal compliance, under their data processing terms. We may also share information with contractors who work on your project, under written confidentiality and privacy terms (Contractors and their countries to be confirmed), with our professional advisers, such as lawyers and accountants, or when the law requires it, for example in response to a court order.

6. Overseas disclosure

Our team works in Australia and Sri Lanka, so people in our Sri Lanka team may access your information to reply to you and to work on your project. The website and its server logs are hosted in Sydney. Amazon CloudFront, the delivery network that delivers the site, may process your connection, including your IP address and what you send through our forms, in any country where it has a location, including the United States, before it reaches Sydney. The countries where our enquiry inbox and business tools store information are shown in the table in section 5, where our contractors are based is listed below that table, and the countries of the providers used for client services are listed in section 12. Before using a provider or contractor overseas, we take reasonable steps to make sure it handles personal information in line with the Australian Privacy Principles, including a written agreement requiring them to handle it in line with the Australian Privacy Principles. We remain responsible for how they handle it.

7. Storage on your device and cookies

The website doesn’t set cookies, and nor does our hosting. The site saves a few small items in your browser’s own storage, which stay on your device and aren’t sent to us unless you send the form:

You can clear or block site storage and cookies in your browser settings; the site still works, but drafts and preferences won’t be remembered. On a shared computer, clear the site’s data if you leave a form without sending it.

8. Security and keeping information

We hold personal information electronically, in the inbox and business tools listed in section 5 and, for services we run for clients, in the systems and providers listed in section 12; the website itself stores no enquiries. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, change or disclosure. The site is served only over encrypted HTTPS, enquiries are passed to our inbox over an encrypted (HTTPS) connection with a signature that shows they came from our website, and access to our systems is limited to the people who need it. No system is perfectly secure, so please don’t send anything through the website that you’d need to keep absolutely secret.

We keep an enquiry that doesn’t become a project for up to 12 months, then delete or de-identify it, including in our inbox. We keep a demo request until demos of our app are available, then for up to 12 months after we contact you, unless you ask us to delete it sooner. Emails about an enquiry are kept for the same period. If you become a client, we keep your information for as long as we need it for the work, and our business records for at least 5 years, as Australian tax law requires (7 years for a company’s financial records). Our hosting’s server logs are kept for up to 30 days.

If a data breach is likely to cause you serious harm, we’ll tell you as soon as we can and what you can do, and notify the Office of the Australian Information Commissioner where the Notifiable Data Breaches scheme applies.

9. Marketing

Sending an enquiry doesn’t sign you up to a mailing list. We’ll only send you marketing emails or SMS if you agree to them, and every one will identify us and include a way to unsubscribe, which we act on within 5 business days, as the Spam Act 2003 (Cth) requires. You can ask us to stop any direct marketing at any time, by any channel, and ask where we got your details.

10. Access and correction

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Email us at hello@creohive.net. There’s no charge. We’ll check it’s you, then reply within 30 days. If we can’t do what you ask, for example because the law requires us to keep something, we’ll explain why in writing and how to complain. If we don’t correct information you think is wrong, you can ask us to attach a note saying so. If we correct information we’ve shared with someone else, we’ll tell them if you ask.

You can also ask for this policy in another format, free of charge.

11. Questions and complaints

If you have a question or think we’ve mishandled your information, contact us first so we can put it right:

• Email: hello@creohive.net
• Post: Postal address to be confirmed

We’ll acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992. If the Privacy Act doesn’t cover us, the OAIC may not be able to investigate, but we’ll still handle your complaint under this policy.

12. Information we handle for clients

When we run a service for a client, such as their website, booking system, AI receptionist, CRM or email automation, we may handle their customers’ personal information, for example names, contact details, bookings, messages, SMS and email, call recordings and chat transcripts, booking deposits (processed by the payment provider), photos or video they appear in, and website-visitor and advertising data from the tracking and analytics we set up, which the client’s own policy explains. This can include sensitive information, such as health or treatment details a customer gives when booking or calling. We do this as the client’s service provider, only on their instructions, for that service and under our agreement with them, and our agreement requires each client to explain in its own privacy notice why it collects this information, and to get its customers’ consent for sensitive information.

Some of these services use providers that store or process information outside Australia, including AI and phone providers: Client service providers and their countries to be confirmed. We tell each client which providers their service uses before it starts. Some of these services make simple decisions automatically, using the details a customer gives: for example, a booking system offering or declining available times, or an AI receptionist answering, routing or ending a call and taking a message. They use details such as the customer’s name, phone number, requested time and reason for calling. We set up each AI receptionist to tell callers and chat users they’re dealing with an AI and, before any recording, that the call is recorded, and that chats are kept as a transcript, so they can choose whether to continue. We describe these to each client and ask them to explain them to their customers. Contact us if you’d like to know how a service we run for a business you deal with works.

We use this information only to provide that service. We keep it for as long as our agreement with the client says, then delete it or return it to the client. We send marketing for a client only to people the client confirms have consented. Every message identifies the client and includes an unsubscribe, and we stop sending to anyone who unsubscribes, within 5 business days of their request. If there’s a data breach involving it, we tell the client promptly and help it notify the people affected. To access or correct information held for a business you deal with, contact that business, or contact us and we’ll pass your request on and help it respond.

13. Changes to this policy

We’ll update this policy when our practices change, for example if we add analytics, and change the date at the top. We’ll handle information we already hold in line with the policy that applied when we collected it, unless you agree otherwise or the new policy gives you more protection. See also our Terms of Use.