01Who we are

This website, rufen.com.au, is run by Rufen Pty Ltd (ACN 685 507 279, ABN 84 685 507 279), an Australian software company based in Mernda, Victoria. In this policy, "Rufen", "we" and "us" mean Rufen Pty Ltd.

This policy explains how we handle personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). It covers this website, including the booking page, the contact form, the AI chat and the blog at rufen.com.au/blog.

It doesn't cover other websites we link to. Our free Graph Builder at workflows.rufen.com.au has no sign-in or forms and doesn't collect personal information.

02Our two roles

We handle personal information in two different ways.

• For our own business. When you visit this site, book a consultation, send us an enquiry or work with us, we decide how your information is used. This policy applies.
• For our customers. When we build and run a system for a customer, such as an AI business assistant or an automated workflow, we handle the information in it on that customer's behalf. The customer decides what the system holds and how it's used, and the customer's own privacy policy applies to the people whose information is in it. We use that information only to run the system, under a contract that limits what we can do with it.

If your information is in a system we run for one of our customers, please contact that customer. If you contact us instead, we'll pass your request on to them.

03What we collect, and how

We collect personal information directly from you, through the forms and chat on this site, by email, by phone and in meetings. Here's what each part of the site collects.

Booking a consultationrufen.com.au/book

Your name, email address, the time you choose, whether you want a Teams call or a phone call, and, if you give them, your company, phone number and notes. We need your name and email to book the meeting. A phone number is required only if you choose a phone call.

The contact formBook and contact pages

Your name, email address and message.

The AI chatEvery page, and the consultation assistant

Whatever you type into it. The consultation assistant on the contact and booking pages will ask for your name, business email, what you're trying to fix, your industry, and a rough idea of size or budget. You can skip any of these. See section 4.

Visiting the siteAll pages

Like every website, our servers receive technical details from your browser so they can send the page back: your IP address, browser and device type, the page you asked for and the time. We don't use these to work out who you are. See section 11 for how long they're kept.

Working with usCustomers and suppliers

Names, job titles, organisation, business contact details, and records of our dealings with you, such as emails, proposals, contracts and invoices.

We don't ask for sensitive information, such as health information, and we ask you not to put it in a form or the chat.

You don't have to identify yourself to read the site, read the blog or use the chat. To book a meeting or get a reply from us, we need at least a name and an email address.

This site isn't designed for children, and we don't knowingly collect information from anyone under 18.

04The AI chat

The chat on this site is an AI assistant, not a person. When you send a message, it goes through our server to Google's Gemini AI service, together with the earlier messages in the same conversation, so Gemini can write the reply. Our server adds instructions for the assistant but nothing about you.

• We don't keep a copy. Our server passes the conversation to Gemini and streams the answer back. It doesn't save the conversation, and the conversation is gone when you close or reload the page.
• Unless you ask us to. When the consultation assistant has what it needs, it offers to send a summary to our team. If you choose to send it, we receive your name, your email and the full transcript of the conversation by email, and we treat it like any other enquiry.
• What Google does with it. Google processes your messages to produce the reply, under its terms for the Gemini API. Google may also use them to improve its products, and people at Google may review them, so please treat the chat as you would a public enquiry form.

The assistant doesn't make decisions about you. It answers questions and, if you want, passes your details to us. Every decision about working with you is made by a person at Rufen.

Please don't put passwords, payment details or other sensitive information in the chat.

05Why we use it

We use personal information to:

• book, confirm, change or cancel the consultation you asked for, and send you the meeting details;
• reply to your enquiry and prepare a proposal if you ask for one;
• deliver, support and invoice the work we do for you;
• keep the site and our booking and contact services running, and stop spam and abuse;
• meet our legal obligations, such as tax and record-keeping.

We use it for another purpose only if you'd reasonably expect it and it's related, if you agree, or if the law requires or allows it.

We don't sell, rent or trade personal information, and we don't give it to anyone for their own marketing.

06Who handles it for us

We use a small number of service providers to run this site. They handle personal information only to provide their service to us.

Microsoft 365Email and calendar

Bookings are created as events in our Outlook calendar, and enquiries, booking confirmations and booking notices are sent and stored as emails. Online consultations run on Microsoft Teams. Our Microsoft 365 data is stored in Australia.

Google Cloud and FirebaseHosting and servers

Hosts this website and runs the server code for bookings, the contact form, the chat and the blog, in Google's Sydney region. The pages themselves are delivered through Google's global network.

Google GeminiAI chat and blog

Writes the chat assistant's replies (see section 4). Our blog is also written with Gemini, from public news articles. No visitor information is used for the blog.

Google MapsWho We Are and Contact pages

Shows the map of our office. The map is loaded from Google, so Google receives your IP address and browser details, and may set its own cookies (see section 8).

Google Fonts and unpkgFonts and icons

Our fonts come from Google Fonts and our icons from unpkg.com. Your browser downloads them directly, so those services receive your IP address and browser details. They set no cookies.

We may also share information with our professional advisers, such as our accountant, lawyer or insurer, where the law requires or allows it, or with your consent.

07Information sent overseas

Our booking, contact and chat servers run in Sydney. Some of the services above process information outside Australia:

• Google Gemini may process your chat messages outside Australia, including in the United States.
• Google Maps, Google Fonts and unpkg receive your IP address and browser details from servers around the world, including in the United States.
• Google Cloud's global network delivers the website's pages, which contain no personal information.
• Microsoft stores our email and calendar in Australia, and may access it from overseas to provide support.

We choose large providers that publish their security and privacy commitments, and we use them under their standard business terms.

08Cookies and similar technologies

We don't set any cookies, and we don't use analytics, advertising or tracking tools. We don't store anything in your browser's local storage either.

The Google Maps map on our Who We Are and Contact pages is provided by Google, and Google may set its own cookies when it loads. Google's privacy policy applies to those. You can block third-party cookies in your browser settings and the rest of the site still works.

If we ever add analytics or any other cookies, we'll update this policy first and tell you about it on the site.

09Emails we send

We email you only about something you started: the confirmation and calendar invitation for a booking, a notice if that meeting is moved or cancelled, and our reply to your enquiry. Every email comes from a rufen.com.au address and says it's from Rufen.

We don't add you to a mailing list when you book, send an enquiry or use the chat. If we ever send marketing emails, we'll ask you first, and every one will identify us and have an unsubscribe link that works, as the Spam Act 2003 (Cth) requires. You can tell us to stop contacting you at any time.

10How we protect it

We protect personal information in proportion to how sensitive it is. In particular:

• everything between your browser and our site is encrypted, and the services we use encrypt information they store;
• the keys our servers use to reach Microsoft 365 and Gemini are held in Google Secret Manager, never in the website's code;
• our forms reject oversized and automated submissions, and limit how often one connection can use them;
• each of us has our own account, with multi-factor authentication, and only people who need information for their work can see it.

If a data breach is likely to cause serious harm, we'll notify the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires.

11How long we keep it

Bookings and enquiries

Kept in our email and calendar while we're dealing with you, and then for one year after our last contact, unless they become part of our business records for work we do for you.

Chat conversations

Not kept by us, unless you send us the consultation summary. Then it's kept like an enquiry.

Server logs

Google Cloud keeps our server logs, which can include IP addresses, for 30 days, then deletes them.

Customer and supplier records

Kept for as long as the law requires, for example tax records for five years.

When we no longer need information, we delete it or remove anything that identifies you.

12Access and correction

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Contact us using the details in section 15.

We'll check who you are first, so we don't hand your information to someone else. We'll respond within 30 days, and there's no charge. If we can't do what you ask, we'll tell you why in writing and how to complain.

13Complaints

If you're concerned about how we've handled your personal information, please contact us first (section 15). We'll acknowledge your complaint, look into it, and give you our answer within 30 days.

If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14Changes to this policy

We review this policy every year, and whenever we change what the site collects or who handles it. The current version is always on this page, with the date it was last updated.

15Contact us

For privacy requests, questions or complaints: