Privacy Policy
Last updated 31 October 2026
Social Web (ABN 45 984 876 899) operates from New South Wales, Australia. We build and maintain websites, content tools and AI assistants for small businesses.
This policy explains what personal information we collect, why, where it goes, and how you can have it deleted. We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
1. Who this policy covers
Three groups, with different data:
- Our clients: the businesses who engage us to build a website, run a content Studio, or operate an assistant.
- Visitors to our clients' websites: people who browse a site we built, or send a message to an assistant we operate on our client's behalf.
- People we contact about our own services: businesses whose publicly listed contact details we use to email them about Social Web, and anyone who visits socialweb.ai or uses the chat on it.
For that second group, our client is the business you are actually dealing with. We process that information on their instructions, as their service provider.
2. What we collect
How we collect it. Mostly from you: through our forms, our Studio and your emails to us. Visitors to a client's site give it through that site's forms and assistant. For our own outreach, we collect business contact details that are publicly listed, such as a business's name, email, phone and website on its Google Maps listing or its own website. A service called Apify gathers these for us.
| Information | Why we hold it |
|---|---|
| Client contact details (name, business name, email, phone, address, ABN) | To provide the service, invoice, and communicate |
| Business content you supply (menus, services, prices, hours, photos, logos, brand assets) | To build your site, set up your assistant and write your posts. The text, documents and photos you give us are sent to Anthropic, our AI provider, to draft and edit your pages, and a document or a photo of one is read by Anthropic to sort what is in it. See section 4. |
| Assistant conversations (messages sent to an assistant, and its replies, with timestamps) | To operate the service, and so there is a record if an answer is ever disputed |
| Contact details a visitor voluntarily gives an assistant (such as a phone number for a callback) | Passed to the business so they can respond |
| Enquiries, bookings and email sign-ups made through forms on a client's website (name, email, phone, booking time, message) | Passed to that business so they can respond. Email sign-ups also keep the consent wording shown and part of the IP address, as a record of consent. |
| Orders placed in a shop on a client's website (what was bought, the amount, and the buyer's name, email and delivery address) | Kept so that business can see its orders. The payment itself is taken by Stripe into the business's own account; we never hold card details |
| Documents, checklists and messages in a client area, where a business has one on its website (what that business's own clients upload or are sent, such as tax papers or identity documents; the checklist the business sets; the messages between them) | Kept so the business and its client can exchange them. Stored with Cloudflare. No AI reads them. They are seen by that client, by the business, and by us only when the business asks us for help. Every upload, download and removal is recorded in a log the business can read |
| Business contact details from public listings (business name, email, phone, website) | To email businesses about our own services. See Direct marketing below. |
| Messages typed into the chat on socialweb.ai | Sent to Anthropic, our AI provider, to write the reply. We do not keep a copy. |
| What you save for the Posting plan (about your business, who your customers are, how you want to sound, what we can say, what never to say, your links), what you want from your posts, and the headlines of your recent posts | Sent to Anthropic, our AI provider, to write your posts and check them against your list. We keep the list and the written posts so they appear in your Studio. |
| Photos you add to your Studio under "Your photos" | Kept so your Studio can use them in posts and reels. Each is sent once to Anthropic, our AI provider, to note what it shows and whether a person should look at it before it is posted. If you ask the Studio to find before and after pairs, the photos you pick are sent again for that. Anyone who has a photo's link can open it, so only add photos you are happy to post. You can remove a photo at any time while your Studio is open. After that, email [email protected] and we delete them. |
| What you add under "What works": a screenshot of a post you admire, and the numbers on your own posts | The screenshot is sent once to Anthropic, our AI provider, to describe how the post is built. We do not keep the screenshot. We keep only that description, which you can remove at any time. The likes, comments, shares and saves on your own posts are read from your connected accounts, and the captions of the posts that did best are sent to Anthropic when your posts are written, unless you switch that off. |
| Reviews, comments and private messages that people send to a client's connected accounts, including a Google Business Profile (what they wrote, and the name they go by), when they appear in the client's Studio inbox | Shown to the client so they can reply. They are read from Zernio. When the client asks for a draft reply, that one message and the sender's first name are sent to Anthropic, our AI provider, in the United States, to write it. The draft goes back to the client to check, and nothing is sent until the client presses Send. When a draft is written we do not keep the message, the draft or the name. We keep the replies the client saves, until they remove them. |
| A keyword message a client sets up (the words to watch for, the message and any link, and an optional public reply) | Zernio sends the message by direct message to anyone who comments the keyword on the client's Instagram or Facebook post, once for each person and post. We keep the client's setup and a count of how many were sent each month. |
| A problem or an idea you send us from your account | What you write, the page you were on, your phone or browser, the time, any error the page showed, and a screenshot if you add one. We use it to look into the problem or consider the idea. We keep the screenshot for 90 days and the report for 12 months. |
| A free check you ask for at socialweb.ai/free-check (your business name, suburb, website, email and phone, and what the check finds) | To run the check and email you the result once a person has read it. Your email is used for nothing else. We keep it for 90 days, then delete it. |
| Basic technical data (IP address, browser type, pages viewed) | Security, abuse prevention, and keeping sites working |
We do not sell personal information, ever. We do not use your data, or your customers' data, to train our own AI models. We do not run advertising networks across our clients' sites.
3. Sensitive information
We ask clients not to load sensitive information (health, racial or ethnic origin, political or religious views, sexual orientation, criminal record, biometric data) into a Studio or an assistant's knowledge base.
Assistants we build are instructed never to request health information and never to give health, medical, legal or financial advice. Where a question touches on safety, allergies or health, the assistant is designed to hand the conversation to a human rather than answer it.
A client area is different: it can hold sensitive documents, because a business may ask its clients for them. The business decides what it asks for and is responsible for having a proper reason to hold it. We store those documents for the business and do nothing else with them.
4. Who we share it with
We use a small number of established providers to run the service. Some store or process data outside Australia.
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, DNS, security, data storage | United States and global edge network |
| Anthropic, PBC | The AI model that drafts and edits the pages of a client's website from the details, documents and photos they give us; reads a document, or a photo of one, that a client uploads; generates assistant replies; writes and checks Posting plan posts; looks at photos you add to your Studio; and drafts replies to the reviews, comments and messages in the Studio inbox | United States |
| Google LLC | Business email and workspace, including emails we send about our own services from Gmail | United States |
| Stripe, Inc. | Payment processing and, for a business with a shop on its website, taking payments from that business's own customers into the business's own Stripe account | United States and Australia |
| Zernio | Connecting a client's social media accounts and Google Business Profile, publishing their posts, reading the numbers on their posts, reading the reviews, comments and private messages sent to their accounts for the Studio inbox, and sending the replies and keyword messages a client chooses to send, at the client's request | United States |
| Resend | Sending email: sign-in links, notifications, and email campaigns a client sends to their own customers | United States |
| Shotstack | Making short videos from photos a client adds to their Studio, at the client's request | Australia and United States |
| Google LLC (Gemini) | Generating images a client asks the Studio to create, and drawing the logo options for the logo design add-on from the business name, type of business and style the client gives us (and a logo the client likes, when they ask for more options) | United States |
| Apify Technologies s.r.o. | Finding businesses' contact details in public business listings, which we use to email businesses about our own services; and reading a business's public Instagram profile, when that business gives us its address | Czech Republic and United States |
| Google LLC (Search Console and Places) | Checking whether Google has indexed a client's website pages, and, for the monthly listings check and the free check, looking up a business on Google Maps by its name, area and phone number | United States |
| Brave Software, Inc. | Searching the web for a business's entries in business directories, for the monthly listings check and the free check, by the business's name | United States |
| Meta Platforms, Inc. | Publishing to a client's own Facebook or Instagram, where the client has connected them, through Zernio | United States |
We share information with these providers only so far as it is needed to run the service. We may also disclose information where the law requires it.
5. Social media account connections
If a client chooses to let us publish on their behalf, they connect their own social media accounts through that platform's official authorisation process. Connections are made through Zernio, a social publishing service: Zernio holds the access the platform grants, and Social Web stores only the account's name, handle, picture and an identifier, so the Studio can show which account is connected.
- We never see or store social media passwords.
- We use the connection to publish content the client has approved, to confirm it published, and to read the numbers on the client's own posts (likes, comments, shares and saves) for the What works view described above.
- We also use it to read the reviews, comments and private messages that other people send to the client's accounts (a Google Business Profile included) and show them in the client's Studio inbox. These are written by the client's customers and other people, not by the client. When the client asks for a draft reply, that one message and the sender's first name are sent to Anthropic, our AI provider, in the United States. The client checks the draft, and only the client can send it.
- A client can set up a keyword message on Instagram or Facebook. Anyone who comments the keyword on a post then gets the client's message as a direct message, sent by Zernio, once for each person and post.
- A client can disconnect any account at any time in the Studio, from within their own platform account settings, or by asking us. Disconnecting in the Studio removes it from Zernio too.
6. Email lists a client uploads
When a client uses the Studio to email their own customers, the client decides who is on the list and is responsible for having their consent. Social Web stores the list only to send that client's emails, includes an unsubscribe link in every email, honours every unsubscribe permanently, stops sending to addresses that bounce or report spam, and never uses a client's list for anything else.
Direct marketing
We sometimes email businesses about Social Web, using business contact details that are publicly listed. Every one of these emails tells you how to opt out. Reply "no thanks", or email [email protected], and we will not email you about our services again. We keep your address on a do-not-contact list so it stays that way. We never sell or share these details, and we never add them to a client's email list.
7. How long we keep it
- Client business records and content: for the life of the engagement, then up to 7 years where tax or legal obligations require it.
- Client area documents, checklists and messages: until the business removes them. When a business's plan ends we keep them for at least 30 days, so the business can take them. After that we delete them by hand, so it can take a little longer than 30 days.
- Assistant conversation logs: about 13 months, unless a client asks for a shorter period.
- Messages typed into the chat on socialweb.ai: not kept.
- Problems and ideas you send us: the screenshot for 90 days, the report for 12 months.
- Free checks you ask for: 90 days, then deleted.
- Inbox replies: the messages, drafts and names are not kept when a draft is written. Replies a client saves are kept until the client removes them or the business is deleted.
- Technical logs: typically 30 days.
8. Accessing or deleting your information
You can ask us at any time to tell you what personal information we hold about you, correct it, or delete it.
How to request deletion
Email [email protected] with the subject line "Data deletion request", and tell us:
- your name and the email address or phone number you used,
- which business's website or assistant you interacted with, if you know it.
We will confirm receipt within 7 days and complete the deletion within 30 days. We will tell you if any information must be retained, and why (for example, a record we are legally required to keep for tax purposes).
If you are a visitor to one of our clients' sites, you can also ask that business directly and they can instruct us on your behalf.
If you are a client of a business that uses a client area, ask that business first: the documents are held for them. If you ask us, we will tell the business and act on your request with them.
Deleting data held via a social media connection
If a client has connected a social account to us and wants that connection and its associated data removed, they can revoke our access from within their own platform account settings, or email [email protected] and we will remove the connection (at Zernio too, if it was made through Zernio), delete any access token we hold for it, and delete the posts waiting to go out.
9. Security
Data is transmitted over encrypted connections and stored with the providers listed above. Access is limited to people who need it to deliver the service. No system is perfectly secure, and we will notify affected individuals and the OAIC where a data breach is likely to result in serious harm, as required by the Notifiable Data Breaches scheme.
10. Cookies
Our own website uses only what is needed to serve the site and keep it secure. We do not run advertising or cross-site tracking cookies on socialweb.ai. We keep a daily total of how many times our free check and sign-up pages are opened, and how many free checks, sign-ups and paid sign-ups follow. These are plain numbers that do not identify anyone: we do not keep your address, browser details or a cookie for them. Websites we build for clients may use analytics if that client chooses; where they do, it is disclosed on that client's own site.
11. Complaints
If you think we have mishandled your personal information, contact us first at [email protected] and we will respond within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.
12. Changes
If we change this policy we will update the date at the top. Material changes affecting existing clients will be communicated directly.
13. Contact
Social Web
ABN 45 984 876 899
New South Wales, Australia
[email protected]