Privacy
RADDLabs complies with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and treats them as the floor, not the ceiling.
Three commitments that go beyond the minimum
Australian data residency by default
Personal information is stored and processed in Australian cloud regions unless a client explicitly agrees otherwise in writing.
72-hour breach notification
Affected clients are told within 72 hours of us confirming a breach involving their data: what happened, what's affected, what we're doing, and what they should do.
Client control over which AI platforms touch their data
Personal information reaches AI platforms only under contractual no-training terms. The platform list is named per engagement and changes need client sign-off. De-identification or masking is applied before processing wherever the outcome allows.
What this website collects
Analytics is kept to what improves the site. It is first-party: the data goes to our own backend, not to a third-party analytics product.
This website sets no cookies and runs no third-party scripts. Its analytics is our own, and we use no advertising or tracking cookies anywhere.
What's recorded per event:
- the page path
- which hero variant was shown
- a random session identifier held only for the browsing session
Not recorded:
- IP address
- user agent
- referrer
- screen size
- anything that identifies or fingerprints a visitor
The session identifier is random, lives in sessionStorage, disappears when the session ends, and cannot be used to recognise someone on a later visit.
Do Not Track and Global Privacy Control are honoured — if either is enabled, no events are sent at all.
Forms
The contact form, the Credlyst early-access form and the newsletter signup store what you type so we can reply. Nothing more is collected than the fields shown on each form. Submissions are stored in Australia, in Sydney.
When you send one, a copy of what you typed is emailed to our own inbox so we can reply quickly. That notification passes through an email delivery service that processes it in Japan. It is a narrow exception to our Australian data residency default: it covers only the notification of your own enquiry, and the stored record stays in Australia.
Newsletter consent
Consent is express — you get the email because you asked for it. Every email identifies us accurately and carries a working unsubscribe that is honoured promptly, per the Spam Act 2003.
The newsletter is sent through Apollo, which stores and processes subscriber email addresses on servers outside Australia. That is an exception to our Australian data residency default, and it applies only to newsletter subscribers — not to client data, which stays in Australian regions unless a client agrees otherwise in writing. If you would rather not have your address held overseas, don’t subscribe, or unsubscribe and ask us to delete it.
Rights and requests
Anyone can ask what personal information we hold about them, ask for it to be corrected, or complain. Requests are acknowledged within 5 business days. If we don't resolve it, the Office of the Australian Information Commissioner (OAIC) can be contacted.
Contact for privacy matters
Questions are also welcome through the contact page.
Last updated: 29 October 2026