Privacy Policy

1. Who we are

Simplify with Sarah (ABN: 83 231 952 046) is a sole trader business operating from Sydney, Australia. This policy explains how we collect, use, store, and protect your personal information when you visit https://simplifywithsarah.com.au or use our services.

We are bound by the Australian Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and we also comply with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) where applicable to our users.

Our diagnostic tools, builders, and assistants use artificial intelligence. Sections 6, 7, and 8 explain exactly how that works and what it means for your information. The Terms and Conditions set out the matching rules on AI generated content, accuracy, and liability.

2. Information we collect

Information you provide directly

• Name and email address (when you subscribe, use a diagnostic tool, or contact us)
• Business name, industry, and access code where a tool requires them
• Responses to diagnostic questionnaires and intake forms
• Prompts, notes, text you paste or upload, and any other content you enter into our AI tools and builders
• The outputs those tools generate for you, including reports, scripts, and drafts
• Payment information (processed securely by Stripe; we do not store card details)
• Any other information you voluntarily provide via email or contact forms

Information collected automatically

• Device type, browser type, operating system
• IP address (anonymised where possible)
• Pages visited, time on site, referring URL
• Tool usage records, such as which tool was run, when, and how many times
• Cookies and similar tracking technologies (see Section 11)

3. How we use your information

We use your personal information to:

• Generate your results by sending your inputs to our AI providers for processing (see Section 6)
• Deliver diagnostic reports, tools, and purchased resources to you
• Send you email communications you have opted into (newsletters, playbook updates)
• Process payments and fulfil orders
• Monitor fair usage, prevent abuse, and enforce access limits
• Improve our website, tools, and services
• Respond to your enquiries
• Comply with legal obligations

We will never sell, rent, or trade your personal information to third parties for their marketing purposes.

4. Legal basis for processing (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, we process your data under the following legal bases:

• Consent: When you opt in to receive communications, agree to the tool terms, or submit a diagnostic form for AI processing.
• Contractual necessity: When processing is required to deliver a service you have purchased.
• Legitimate interest: To improve our services and ensure website security, where this does not override your rights.
• Legal obligation: Where we are required by law to retain or disclose information.

5. Third-party services

We use the following third-party services that may process your data:

• Stripe: Payment processing (PCI DSS compliant). Stripe Privacy Policy
• Supabase: Database, storage, and authentication infrastructure. Supabase Privacy Policy
• Resend: Transactional and report delivery email. Resend Privacy Policy
• Google Analytics: Website analytics (anonymised IP enabled where applicable). Google Privacy Policy

AI providers

Where a tool generates output for you, your inputs are sent to one or more of the following AI model providers, acting as our processors:

• Google (Gemini models): Google Privacy Policy
• OpenAI: OpenAI Privacy Policy
• Anthropic: Anthropic Privacy Policy

These providers process data on servers outside Australia, primarily in the United States. Under Australian Privacy Principle 8 we take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, through contractual terms with each provider. By using a tool that generates output, you consent to this overseas disclosure.

We only share the minimum data required for these services to function. Each provider maintains their own privacy policy and data handling practices. This list may change as we add or replace providers, and we will update this page when it does.

6. AI tools and builders: how your inputs are processed

Our diagnostics, builders, and assistants are powered by third-party AI models. When you run a tool, the content you enter is transmitted to the relevant AI provider so a result can be generated and returned to you.

What is sent

• Your answers, prompts, notes, and any text you paste or upload into the tool
• Business context you supply, such as industry, audience, offers, and voice preferences
• System instructions we write, which are not personal information

What is not sent

• Payment or card details
• Your password or authentication credentials

Training

We do not use your inputs or outputs to train our own models. We select AI providers on terms that exclude the use of our business API data for training their general models. We cannot control or guarantee the internal practices of any third-party provider beyond the terms they publish and agree to, and those terms may change.

Accuracy

AI generated output is general information produced from the inputs you provide. It can be incomplete, out of date, or wrong. It is not legal, financial, medical, tax, accounting, or HR advice, and it does not create a professional or client relationship. You remain the decision-maker and should apply your own judgement and seek qualified advice before acting.

Human review

Inputs and outputs may be reviewed by Sarah or an authorised assistant for quality assurance, support, debugging, and safety. Access is limited to what is needed for those purposes.

Storage of prompts and outputs

Your inputs and the results generated are stored in our database so you can return to them, so we can resend a report, and so we can support you. Retention is covered in Section 10.

7. What not to enter into our AI tools

Our tools are built for business context, not sensitive personal data. Please do not enter:

• Health, medical, genetic, or biometric information about yourself or anyone else
• Government identifiers such as tax file numbers, passport, licence, or Medicare numbers
• Financial account numbers, card numbers, or passwords
• Information about children
• Criminal record, racial or ethnic origin, political, religious, sexual orientation, or trade union information
• Client, patient, or staff records that are confidential or that you are not permitted to disclose

If you do enter information about other people, such as your own clients or team, you confirm you have the right to disclose it, you remain the controller of that information, and you are responsible for any notice or consent required from those individuals. We act only as your processor for that content.

If sensitive information is entered by mistake, email us at sarah@simplifywithsarah.com.au and we will delete it from our systems.

8. Automated decision making and human review

Our tools produce scores, diagnostics, and suggestions. They do not make decisions that produce legal effects or similarly significant effects concerning you. There is no automated profiling used to approve, refuse, price, or terminate any service.

This position is aligned with the Australian Voluntary AI Safety Standard and with Article 22 of the GDPR. If you believe a result has affected you unfairly, you can request a human review by emailing sarah@simplifywithsarah.com.au. We respond within 30 days.

9. Data storage and security

Your data is stored on secure servers. While some data may be processed on servers located outside Australia (including the United States and the European Union), we ensure all providers meet equivalent privacy standards through contractual safeguards (such as Standard Contractual Clauses for GDPR).

AI processing takes place on infrastructure operated by the providers listed in Section 5, generally in the United States. Data is encrypted in transit and at rest with our backend provider, and access to stored inputs and outputs is restricted to authorised accounts.

We implement reasonable technical and organisational measures to protect your information from unauthorised access, loss, or misuse. No method of electronic storage is 100% secure, and we cannot guarantee absolute security. If a data breach likely to cause serious harm occurs, we will notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.

10. Data retention

We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required by law. Specifically:

• Email subscriber data: Until you unsubscribe
• Diagnostic and tool responses: 12 months from submission, then anonymised or deleted
• AI prompts and generated outputs: 12 months from generation, then anonymised or deleted, unless you ask us to delete them sooner
• Purchase records: 7 years (as required by Australian tax law)
• Website analytics: 26 months (Google Analytics default)

Our AI providers may hold transmitted data briefly for abuse monitoring under their own published retention terms. We do not control those windows.

11. Cookies

Our website uses cookies and similar technologies to:

• Remember your preferences and session state
• Understand how you use our site (analytics)
• Improve site performance

You can control cookies through your browser settings. Disabling cookies may affect the functionality of some tools on this site.

We do not use cookies for third-party advertising or retargeting.

12. Your rights

Under Australian Privacy Law (APPs)

You have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Complain to the Office of the Australian Information Commissioner (OAIC) if you believe your privacy has been breached

Under GDPR (EEA/UK residents)

You additionally have the right to:

• Request erasure of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability (receive your data in a structured, machine-readable format)
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

Under CCPA (California residents)

You have the right to:

• Know what personal information we collect and how it is used
• Request deletion of your personal information
• Opt out of the sale of your personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights

Rights relating to our AI tools

• Request a human review of any AI generated result that concerns you
• Request deletion of specific prompts and generated outputs at any time
• Withdraw your consent to AI processing. Because the tools cannot run without sending your inputs to an AI provider, withdrawing consent means we can no longer generate results for you, though the rest of the site remains available.

To exercise any of these rights, email sarah@simplifywithsarah.com.au. We respond within 30 days.

13. Children's privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us and we will delete it promptly.

14. Affiliate links

Some links on this site are affiliate links. If you purchase a product or service through one of these links, we may earn a small commission at no additional cost to you. All recommendations are independently researched and tested. Affiliate relationships do not influence our recommendations.

15. Changes to this policy

We may update this policy from time to time, including as we add, replace, or change AI providers. Changes will be posted on this page with an updated revision date. Where a change materially affects how we handle your information, we will notify subscribers by email. We encourage you to review this page periodically. Continued use of our website after changes constitutes acceptance of the updated policy.

16. Contact us

If you have questions about this privacy policy, wish to exercise your rights, or have a complaint, contact us at: