Privacy Policy
Draft date: 26 October 2026 · Australian deployment
1. Operator and scope
This draft describes the intended information handling practices of [REGISTERED OPERATOR / ABN / CONTACT EMAIL] for Workspace One. Depending on the nature and size of the business and processing, obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles may apply. Other laws can also apply.
2. Types of information collected
The proposed service may receive a user's email address, workspace and team roles, business contact information and source links, CRM notes, financial figures entered by users, website drafts, marketing plans, service usage and security logs. Provider integrations may require access tokens when explicitly connected. Live payment card details should be handled by an approved payment processor, not stored by the app itself. Users must avoid entering personal health records or confidential legal case material into ordinary lead searches.
3. Purpose and lawful collection
We use information to create and secure accounts, manage workspaces, deliver requested product functionality, provide support, prevent abuse, process purchases after payments are enabled, and comply with legal obligations. Where required, individuals will be notified and consent will be obtained for specific handling.
4. Source-backed business leads
Customer-supplied contact lists and permitted external business-data providers may contain personal information. A public contact method does not itself constitute consent for commercial outreach. Users control contact-stage and consent records and must verify their own authority before using lead information for direct marketing. The service will not infer a private person's need for medical treatment, legal representation or other sensitive services.
5. Hosting and recipients
The planned infrastructure includes Cloudflare Pages/Workers and Cloudflare D1 for app delivery and workspace storage. Email verification may use Resend when configured. Optional Workers AI, lead-data, telephony, social and payment vendors will be integrated only after their terms, permissions and processing practices are reviewed. Processing and storage may occur outside Australia, depending on selected providers and contract terms; the operator must document actual overseas recipients or classes of recipients as required.
6. AI features
If an AI provider is connected, some queries and limited authorised business statistics may be sent for processing to return requested suggestions. The intended advisor sends aggregate workspace figures rather than the full contact database. Integrations must be separately evaluated before transmitting more detailed customer information.
7. Security
The proposed account system uses server-validated one-time email codes, Cloudflare Turnstile, HTTPS, HttpOnly session cookies and server-enforced role permissions. An email code is not independent two-factor authentication; authenticator-based MFA remains a future feature. Browser-only preview data stays on the device and is unsuitable for sensitive records. No system is completely risk free.
8. Retention, access and deletion
Retention periods for prospects, user accounts, logs, verification attempts and backups must be finalised before launch. Users should be given means to access, correct and request deletion of personal information where legally required, subject to any legal retention obligations. Contact [PRIVACY EMAIL] to make a request. A full self-service deletion flow is not included in the preview.
9. Cookies and analytics
Authenticated sessions use necessary cookies. The local preview also saves theme preferences and non-sensitive demo records in browser storage. No third-party behavioural advertising service is included in this build. If future analytics or advertising cookies are added, this policy and consent mechanisms must be updated as applicable.
10. Complaints, breaches and changes
Contact [PRIVACY EMAIL] for questions, corrections or complaints. Where applicable, the operator will comply with the Notifiable Data Breaches scheme and other incident-response obligations. Material privacy changes will be made available with effective dates and notice where required. Eligible complainants may also contact the Office of the Australian Information Commissioner.