Privacy Policy

1. Introduction

This Privacy Policy explains how GrafBuilder ("we", "us", "our") collects, uses, stores, and discloses personal information when you use GrafBuilder (the "Service") at grafbuilder.com.

We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Information We Collect

2.1 Information you provide directly

When you register for or use the Service, we may collect:

• Contact details: first name, last name, email address
• Business details: company name, website URL, industry
• Account credentials: email address and hashed password (passwords are never stored in plain text)
• Communications: any messages you send us via support or contact forms

2.2 Payment information

Payment processing is handled by Stripe, Inc. We do not store your credit card number, CVV, or full payment card details on our systems. Stripe collects and stores payment information on our behalf in accordance with PCI-DSS standards. We retain only a tokenised reference and billing status returned by Stripe.

2.3 Information collected automatically

When you use the Service, we automatically collect:

• Log data: IP address, browser type, pages visited, referring URLs, and timestamps
• Session data: authentication state stored in server-side sessions
• Cookies: session cookies required for the Service to function (see Section 7)

2.4 Query and content data

As part of delivering the Service, we process query sets and AI citation data that relate to your business. This data belongs to you and is used solely to deliver your GrafBuilder results.

3. How We Use Your Information

We use the information we collect to:

• Create and manage your account
• Deliver the Service, including generating query sets, running AI citation scans, and producing content briefs
• Send transactional emails (account verification, activation confirmations, results notifications)
• Send service-related updates and announcements
• Send marketing communications where you have given consent (see Section 6)
• Process payments via Stripe
• Respond to your support enquiries
• Detect and prevent fraud, security incidents, or misuse
• Comply with our legal obligations

We do not sell your personal information to third parties.

4. Disclosure of Your Information

We may disclose your personal information to third-party service providers who are required to handle your personal information in accordance with applicable privacy laws and only for the purpose of providing services to us.

We may also disclose your information where required by law, court order, or government authority.

5. Storage and Security

Your personal information is stored on servers located in Australia, hosted by VentraIP using NEXTDC data centre facilities in Sydney and Melbourne.

We take reasonable technical and organisational steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These measures include:

• Encrypted HTTPS connections for all data in transit
• Password hashing using industry-standard algorithms
• Access controls limiting database access to authorised systems only
• Regular security reviews

No transmission of data over the internet is guaranteed to be completely secure. You use the Service at your own risk.

6. Marketing Communications

We will only send you marketing communications if you have given your express consent at the time of sign-up or subsequently.

You may withdraw your consent to receive marketing communications at any time by:

• Clicking the Unsubscribe link in any marketing email we send you, or
• Contacting us at privacy@grafbuilder.com

Withdrawal of marketing consent does not affect your receipt of transactional emails (such as account confirmations and results notifications), which are necessary for the delivery of the Service.

We comply with the Spam Act 2003 (Cth) in all electronic communications.

7. Cookies

We use session cookies that are essential for the Service to function. These cookies:

• Maintain your authenticated session while you are logged in
• Do not track you across other websites
• Are deleted when you close your browser or log out

We do not use third-party advertising cookies or cross-site tracking cookies.

8. Retention

We retain your personal information for as long as your account is active or as needed to deliver the Service. If you close your account, we will:

• Delete or anonymise your personal data within 90 days of account closure, unless we are required by law to retain it longer
• Retain transaction records (billing history) for 7 years in accordance with the Corporations Act 2001 (Cth) record-keeping requirements

9. Access, Correction, and Complaints

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct personal information that is inaccurate, incomplete, or out of date
• Make a complaint about how we have handled your personal information

To exercise any of these rights, contact us at:

GrafBuilder
Email: privacy@grafbuilder.com
Website: grafbuilder.com

We will respond to access and correction requests within 30 days.

If you are not satisfied with our response to a complaint, you may contact the Office of the Australian Information Commissioner (OAIC):
Website: oaic.gov.au · Phone: 1300 363 992

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, we will notify you by email or by a notice within the Service.

Your continued use of the Service after any changes constitutes your acceptance of the updated policy.

11. Contact Us

For any privacy-related questions, requests, or complaints:

GrafBuilder
Email: privacy@grafbuilder.com
Website: grafbuilder.com