Legal

Privacy Policy

Effective April 28, 2026. Last updated July 1, 2026.

TurnkeyAI, a trading name of Black and White Renos Pty Ltd (ABN 82 665 395 791) ("TurnkeyAI", "we", "us", "our"), respects your privacy. This Privacy Policy explains how we collect, use, store, and disclose personal information in compliance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. What we collect

When you submit our contact form, request a quote, or engage us for a deployment, we may collect:

  • Identity data: name, business name, role.
  • Contact data: business email, phone number, business address.
  • Engagement data: industry, package interest, workflow descriptions, the tools your business uses.
  • Operational data: during a deployment, we may temporarily process samples of your business data (e.g. emails, invoices) to test workflows. This data is anonymised where possible and deleted at the end of the build phase.
  • Technical data: standard server logs (IP, user agent, referrer) when you visit our website.
  • Usage & analytics data: how you interact with our website — pages viewed, links and buttons clicked, scroll depth, time on page, traffic source, approximate location (city/country, derived from IP) and device/browser type. This is collected via cookies and the analytics providers listed in section 5. Microsoft Clarity may also record anonymised session interactions (mouse movement, clicks, scrolling) to build aggregate heatmaps; form fields and text content are masked by default.

2. How we use it

We use personal information to:

  • Respond to your enquiry and send confirmation emails.
  • Scope, build, deliver, and support your deployment.
  • Send transactional notifications related to your engagement.
  • Improve our service and operational metrics in aggregated, de-identified form.
  • Comply with legal obligations (e.g. tax records).

We do not use your personal information for unrelated marketing without your consent. We do not sell your data.

3. Where it lives

Form submissions are processed by Netlify (deployment hosting) and Resend (transactional email), both of which are subject to their own privacy commitments. Operational data during a deployment is processed locally on our build infrastructure in Australia and on the Mac Mini hardware delivered to your office. Once the hardware leaves us, your operational data lives only on your premises.

4. Disclosure to third parties

We disclose personal information only:

  • To service providers who help us deliver the engagement (hosting, email, accounting), bound by confidentiality obligations.
  • Where required by law (e.g. court order, regulatory request).
  • With your express consent.

Some of our service providers and analytics/advertising partners (e.g. Resend, Netlify, Google, Microsoft, OpenAI) operate in the United States. Where data is transferred overseas, we take reasonable steps to ensure the recipient is bound by privacy commitments substantially equivalent to the APPs.

5. Cookies, analytics & advertising

Our website uses cookies and similar technologies, including from the third-party providers below, to understand how the site is used and to measure the performance of our advertising. We use this data in aggregate to improve the site and our campaigns. We do not use it to build profiles of you for unrelated marketing, and we do not sell it.

  • Google Analytics 4 (Google LLC): measures site usage and traffic sources. Sets analytics cookies and processes data such as pages viewed, events, device and approximate location.
  • Microsoft Clarity (Microsoft Corporation): session-level analytics and aggregate heatmaps. Captures anonymised interaction data; form fields and text content are masked by default.
  • Google Ads (Google LLC): measures whether visits and form submissions originated from our ads (conversion tracking). Where you submit our form having arrived from a Google ad, we may also share a hashed (irreversibly encoded) version of your email and/or phone number with Google so it can match the conversion to the ad click ("Enhanced Conversions"). Google receives this data only in hashed form and cannot read your actual email or phone number.
  • OpenAI / ChatGPT Ads (OpenAI): measures conversions originating from ads shown in ChatGPT.

These providers may process data on servers in the United States. You can opt out of analytics cookies via your browser settings, the Google Analytics opt-out add-on, and Google's Ads Settings. Disabling these cookies will not affect your ability to read the site or submit our form.

6. Security

We protect personal information using industry-standard security: encryption in transit (TLS), encryption at rest for credentials, principle of least privilege for our team's access, and physical security of our build infrastructure. No system is 100% secure; if a breach affects you, we will notify you in line with the Notifiable Data Breaches scheme.

7. How long we keep it

We retain contact and engagement data for the duration of our relationship with you and for 7 years after the last engagement to comply with Australian record-keeping obligations. Operational data sampled during a deployment is deleted within 14 days of handover. You may request earlier deletion subject to our legal obligations.

8. Your rights

Under the Privacy Act 1988, you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate or out-of-date information.
  • Request deletion of personal information we are not legally required to retain.
  • Withdraw consent for marketing communications at any time.
  • Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email start@tkai.com.au. We respond within 30 days.

9. Children

Our Services are intended for businesses and their authorised representatives. We do not knowingly collect personal information from individuals under the age of 18.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. Material changes will be communicated to active clients by email.

11. Contact

Privacy questions or requests: start@tkai.com.au. Our postal address is available on request.