Privacy Policy

Last updated: 25 October 2026

This policy explains how System 365 ("we", "us", "our") collects, uses, stores and shares personal information. It covers our website, the enquiries you send us, the marketing emails and text messages we send, and the AI chat and text assistants we run.

We are based in Australia. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We send marketing under the Spam Act 2003 (Cth). If you are in the European Union, the United Kingdom or California, the extra sections near the end also apply to you.

Who we are

System 365 builds websites and lead follow-up systems for local service businesses.

• Business name: System 365
• ABN: TODO (to be added)
• Address: TODO (to be added)
• Email: hello@system365.co

Two roles we play

When you deal with us directly (you visit our site, send us an enquiry, book a call, or get our emails), we decide how your information is used. This policy covers that.

When we run systems for our clients (for example, a chatbot or text follow-up on a client's website), we handle their customers' information on the client's behalf and on their instructions. The client's own privacy policy covers how they use it. We only use that information to provide our service to the client, and we never sell it or use it to market our own services.

What we collect

We only collect what we need.

Information you give us

• Contact details: your name, email address and mobile number.
• Your message: what you tell us in a form, a chat, or a text reply.
• Marketing choices: whether you agreed to get marketing emails and texts. We also record the exact wording you agreed to, when you agreed, and on which page.
• Booking details: if you book a call, the time you chose and anything you add to the booking.

Chat and text conversations

If you use an AI chat assistant on our site, or reply to a text from our assistant, we keep a transcript of that conversation. The transcript is linked to your contact record so we can follow up properly.

Information collected automatically

• Technical data: your IP address, browser type and the page you came from. We use this to keep the site secure, block spam and limit repeated form submissions.
• Bot checks: our forms use Cloudflare Turnstile to tell people from bots. It may read basic browser signals to do this.

We do not run advertising cookies or cross-site tracking. If we add analytics later, we will update this policy first.

What we never ask for

We do not ask for health information, payment card details, government ID numbers, or other sensitive information. Please don't send it in a form, chat or text. If you do, we will not use it for anything beyond answering your message.

How we use your information

• To reply to your enquiry, including by text message within moments of you submitting a form.
• To hold a conversation with you, through a person or our AI assistant, and help you book a call.
• To send you useful information, newsletters and offers, only if you agreed to marketing.
• To provide our services to our clients.
• To keep our site and systems secure, and to stop spam and abuse.
• To meet our legal obligations.

Text messages and email marketing

We follow the Spam Act 2003. That means:

• We ask first. We only send marketing emails or texts if you tick the consent box on our form. The box is never ticked for you, and you can still send an enquiry without ticking it.
• We say who we are. Every marketing message names System 365 and tells you how to reach us.
• You can stop any time. Every marketing email has an unsubscribe link. Every marketing text lets you reply STOP. We act on it straight away, and always within 5 business days.

Replying to an enquiry you just sent us is not marketing. We may text or email you about that enquiry even if you didn't tick the box.

How often we send marketing depends on what you signed up for. It is usually weekly, fortnightly or monthly.

AI assistants

Some of our chats and text replies are handled by an AI assistant.

• We tell you when you're talking to an AI assistant, and you can ask for a person at any time.
• The assistant answers questions and helps you book. It does not make decisions that have legal or similarly significant effects on you.
• Conversations are processed by our AI provider to generate replies. We choose providers that do not use our data to train their models.
• Our staff may read transcripts to follow up with you and to check the assistant is working well.

Who we share it with

We don't sell your personal information, and we don't share it for cross-context advertising.

We share it only with service providers who help us run our business, and only as much as they need:

• Customer relationship (CRM) software: stores contact records, messages and conversation transcripts. We currently use GoHighLevel.
• Website hosting: Vercel.
• Security and spam protection: Cloudflare (bot checks) and Upstash (form rate limiting).
• Text message, email and AI providers: used to send texts and emails and to power our assistants. TODO: name each provider once chosen.
• Booking tool: TODO: name the scheduling tool once confirmed.

We may also share information if the law requires it, or to protect our rights or someone's safety.

Sending information overseas

Some of our providers store or process information outside Australia, mainly in the United States. Before we use a provider, we check its security and privacy practices, and we take reasonable steps to make sure it handles your information in line with the APPs.

How we keep it safe

• Information is sent over encrypted connections (HTTPS).
• Our forms check every field on our server, block bots, and limit repeated submissions.
• Access to our systems is limited to people who need it, and protected with strong passwords and two-factor sign-in where available.
• Our website itself does not store your form details. They go straight to our CRM.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

How long we keep it

We keep your information while we're talking with you or working with you. If we haven't been in touch for 24 months, we delete or anonymise your contact record and transcripts, unless the law requires us to keep it longer. If you unsubscribe, we keep a minimal record of that so we don't contact you again.

Your choices and rights (Australia)

You can:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct it if it is wrong or out of date.
• Unsubscribe from marketing at any time, as described above.
• Deal with us without giving your name where that's practical, for example when asking a general question. We need contact details to reply.

Email hello@system365.co and we'll respond within 30 days. We may need to confirm who you are first.

Complaints

If you're unhappy with how we've handled your information, email us first and we'll try to fix it within 30 days. If you're still not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If you are in the EU or UK (GDPR)

If the General Data Protection Regulation or the UK GDPR applies to you, these extra terms apply.

Legal bases. We use your information:

• to reply to your enquiry and provide our services: contract, or steps you asked for before a contract;
• for marketing emails and texts: your consent, which you can withdraw at any time;
• for security, spam prevention and improving our service: our legitimate interests;
• to meet legal requirements: legal obligation.

Your rights. You can ask to access, correct, delete or restrict your information, ask for a copy in a portable format, and object to processing based on legitimate interests. You can withdraw consent at any time; this does not affect anything we did before.

International transfers. Where your information leaves the EU or UK, we rely on adequacy decisions or standard contractual clauses with our providers.

Complaints. You can complain to your local data protection authority. In the UK, that is the Information Commissioner's Office (ICO).

If you are in California (CCPA/CPRA)

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to you, these extra terms apply.

Categories we collect: identifiers (name, email, phone number, IP address); the contents of your messages and conversation transcripts; internet activity limited to the security signals described above; and your marketing preferences. We collect them from you directly and from your browser, for the purposes listed in "How we use your information".

We do not sell or share your personal information, as those words are defined in the CCPA, and we have not done so in the last 12 months. We don't collect sensitive personal information for the purpose of inferring things about you.

Your rights. You can ask to know what we collect and how we use it, ask us to delete it, ask us to correct it, and opt out of any sale or sharing (we don't do either). We won't treat you differently for using these rights. You can ask through an authorised agent, and we will verify the request before acting on it.

To make a request, email hello@system365.co.

Children

Our services are for businesses. We don't knowingly collect information from anyone under 18. If you think we have, contact us and we'll delete it.

Changes to this policy

We may update this policy as our services change. We'll change the "Last updated" date at the top, and if the change is significant, we'll tell you by email where we can.

Contact us

Questions about privacy? Email hello@system365.co.