Privacy policy

1. Who we are

Anurag Dial, trading as GraySpark.ai, ABN 81 991 438 742, of 3 Longstaff Court, Doncaster East VIC 3109, Australia. For anything in this policy, email andy@grayspark.ai.

We are bound by the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where we handle information about people in the United States, we also follow the commitments in this policy; where state law there gives someone more rights than this policy does, that law wins.

2. This website

This website sets no cookies, loads no analytics, no tracking pixels and no third-party fonts. We do not build a profile of you for browsing it.

If you arrive from a link carrying campaign parameters (for example utm_source), we pass those to our checkout so we know which page a sale came from. They are attached to the subscription record, not to you, and nothing is stored on your device.

Our hosting provider (Netlify) keeps standard server logs including IP addresses for a short period for security and abuse prevention. We do not use them for marketing.

3. If you are our customer

We hold your business name, your email address, the website address you gave us, the email address you nominated for enquiries, your emergency number where your industry needs one, your subscription details, and whether you agreed to be a case study.

We also hold the text of your public website pages, which we read to build the FAQ the assistant answers from. You can ask us to re-read your site or delete what we hold at any time.

Payments are processed by Stripe. We never see or store your card details.

4. Chat conversations on your site — the important part

When someone uses the assistant on your website, we store the question, the answer, the time, the pages the answer came from, and a random identifier that groups one visit's messages together. We also store answers the assistant refused to give, so you can see what it held back.

What we do not do: we do not set a cookie on your visitor's device, we do not track them across sites, we do not build advertising profiles, and we do not use your conversations or your website content to train any AI model. The random visit identifier is held in the browser tab only and disappears when the tab closes.

If your visitor types personal information into the chat — a name, a phone number, their pet's details — it is stored as part of the conversation, which is visible to you in your dashboard and emailed to the address you nominated when the assistant hands the enquiry over. Please do not invite your visitors to type sensitive information into the chat. You are the business with the relationship to that person; we process it for you.

Retention: conversations are kept for 24 months so your monthly reports and your log are useful, then deleted. You can ask us to delete a conversation, or all of them, sooner.

5. Our use of AI

We use Anthropic's Claude models to generate the assistant's answers and to build the FAQ from your website. Questions, the retrieved parts of your website content, and the answers pass through Anthropic's API, which is hosted in the United States. Anthropic does not use data submitted through its API to train its models. We send no more of a conversation than the current question and the relevant parts of your own site.

The assistant always identifies itself as an assistant rather than a person, in the header of the chat window and again whenever it is asked.

6. Who else sees it

Only the suppliers that make the service work: Netlify (hosting, United States), Supabase (database, Australia or Singapore region), Anthropic (AI, United States), Stripe (payments, United States and Australia), and our email provider for the enquiry notifications we send you. Each one sees only what it needs. We do not sell personal information and we do not share it for advertising.

7. Overseas disclosure

Some of those suppliers are in the United States, so by using the service you are agreeing to your information being handled there. We take reasonable steps to ensure they handle it consistently with this policy, but once information is overseas, Australian Privacy Principle 8.1 protections may not apply in the same way.

8. Marketing

If we email you about our services, every message identifies us, includes our postal address and ABN, and carries a working unsubscribe link. We honour an unsubscribe across every address and domain we send from, within five business days and usually immediately. We never email cold from grayspark.ai.

9. Security

Access is restricted to Andy. The database is not reachable by the public. Our dashboard is behind a password. The key that sits in the snippet on your website is public by design: it identifies your account to the chat endpoint and authorises nothing else — it cannot read your conversations or your settings.

10. Your rights

You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email andy@grayspark.ai and we will respond within 30 days, usually much sooner. We will not charge you for asking.

11. Complaints

Email us first and we will try to put it right. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

12. Changes

We post changes here with a new date at the top, and email our customers about anything material.