Privacy Policy

1. Who we are

PulseForge Pty Ltd is a Melbourne-based Australian business technology company. We provide Business Automation (fixed-price workflow automation of internal admin inside the client's own Microsoft 365 and supported business apps), Microsoft 365 & Cloud Migration, Websites and requirement-led Business Product Sourcing for Australian businesses.

This Privacy Policy applies to: visitors to our website (pulseforge.com.au), people who request a Website Review or request a discovery call, prospective and current clients, and the staff and customers of clients whose data is processed by workflows we configure on the client's behalf.

2. Information we collect

We collect personal information that is reasonably necessary for our business activities. Categories include:

From website visitors and enquiry forms

• Name, email address, phone number and company name
• The service you're interested in, your company size and your timeframe
• Where a form asks for them: your website address, suburb or city, business sector and the tools you already use
• Anything you write in the message field
• Technical data: IP address, browser type, device type, pages viewed

From clients during an engagement

• Contact details of the people we work with
• Process maps and workflow descriptions
• System and licence details for the platforms in scope
• Test data and sample records used to build and test workflows
• Documentation, runbooks and configuration settings
• Billing details (we don't store full card numbers)

We do not collect, store or route client identity or KYC documents, tax file numbers, or health or participant clinical records as part of our automation work.

Referral partners and referred businesses

If you apply as a referral partner, we collect your contact details, ABN and payment details to administer commissions. If a partner introduces a business to us, we only contact that business after the partner has told them about us and they have agreed to hear from us. We tell them who referred them and stop if they ask us to.

Data processed inside a client's own systems

Workflows we configure run inside the client's own Microsoft 365 tenant and business apps. They may process the client's business data, such as client and job records, documents, approvals and internal messages. That data stays in the client's systems. PulseForge accesses it through delegated access granted by the client, only for the engagement, and that access is removed at the end of the engagement.

When we handle data on behalf of a client, the client remains responsible for its lawful collection and use, and we handle it only as needed to deliver the agreed work.

3. How we collect it

We collect information in the following ways:

• Directly from you via website forms, email, phone, meetings and engagement documents
• Automatically via website analytics and server logs
• Through systems you give us delegated access to during an engagement (for example, your Microsoft 365 tenant)
• From publicly available information (such as your website) when preparing a Website Review

4. How we use your information

We use personal information for:

• Service delivery — scoping, building, testing, handing over and supporting Business Automation, Microsoft 365 & Cloud Migration, Websites and Business Product Sourcing engagements for you
• Website Reviews — reviewing your public website to prepare your Website Review
• Communications — responding to enquiries, sending Website Reviews, assessment reports and project updates, sending invoices
• Improvement — monitoring the workflows we support under Care, fixing faults and improving our website
• Legal & compliance — meeting our legal obligations, responding to lawful requests, protecting our rights

We do not sell personal information. We do not use our clients' business data for our own marketing.

5. When we disclose your information

We disclose personal information only when needed to deliver our services or as required by law. This includes:

• Service providers — the tools listed in Section 6 below
• Your authorised third parties — for example, your existing IT provider at handover
• Legal authorities — when required by Australian law or a valid legal process
• Business transfers — if PulseForge is sold or merged, personal information may transfer to the new owner, subject to the same protections

We do not share personal information with advertising networks or data brokers.

6. Third-party tools we use

We use a small number of third-party tools to run our business and deliver our services. Each tool has its own privacy practices, and data flowing through these tools is subject to their terms:

• Netlify: website hosting and website form submissions
• Resend: sends form notification and confirmation emails
• Google Analytics 4: website analytics (see Section 9)
• Microsoft Clarity: website usage insights (see Section 9)
• Microsoft 365: PulseForge's own email, calendar and documents
• Microsoft Power Automate: workflows we build, running in the client's own Microsoft 365 tenant under the client's licences
• Zapier or Make: only where a client's workflow uses them, in the client's own account
• AI providers: only where a client's workflow uses them, with human approval of anything important (see Section 7)

We can provide a current list on request and will notify clients of material changes where reasonably possible.

7. AI-assisted automation

Most workflows we build don't use AI. Where AI genuinely helps, it prepares or sorts information; your team approves anything important. Key points:

• AI is used only to classify or route incoming requests, pre-fill or extract data for review, summarise internal documents, or draft content for staff to review
• AI is never used to make regulated professional decisions, approve payments, change bank details or make binding commitments
• The AI provider and deployment are agreed with the client, and data is handled under that provider's terms and the client's settings
• Where supported by the provider, we configure settings to minimise data retention and to stop client data being used to train models
• Items a workflow cannot classify confidently go to a named person in the client's team

See our AI Use Policy for details.

8. Storage, security and data location

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Measures include:

• Access controls — only authorised PulseForge staff and contractors with a legitimate need can access client data
• Delegated access to client systems, limited to the engagement and removed at handover
• Encryption in transit (TLS) for data moving between systems
• Secure password and authentication practices, including multi-factor authentication where supported
• Regular reviews of tool configuration, integrations and access permissions

Data location. Data processed by workflows we build stays in the client's own Microsoft 365 tenant and business apps, in the locations set by those services. Our own tools (listed in Section 6) may store data outside Australia.

We do not claim that all data is stored in Australia. We document where data is processed for each engagement and can discuss compliance requirements during the assessment.

9. Cookies and analytics

Our website uses cookies and third-party analytics services to understand how visitors interact with the site. Specifically:

• Google Analytics 4 (GA4) — measures aggregate traffic, traffic sources, page views and conversion events (e.g. form submissions). IP addresses are anonymised. Google's privacy practices are available at policies.google.com/privacy.
• Microsoft Clarity — records anonymised session replays and aggregated heatmaps so we can see where the site is confusing or broken. Sensitive form fields (name, email, phone) are automatically masked. Microsoft's privacy practices are available at privacy.microsoft.com.

Google Analytics and Microsoft Clarity set cookies when you visit, including Microsoft/Bing identifiers set by Clarity (for example MUID and CLID). We don't use advertising or remarketing pixels. If we add advertising scripts in future, we will update this policy and provide opt-out controls where required by law.

You can disable cookies in your browser settings, install browser extensions that block analytics scripts, or use the Google Analytics opt-out add-on. Disabling cookies may affect some site functionality.

10. Retention

We retain personal information for as long as needed to provide our services and meet legal, accounting and tax obligations. Typical retention:

• Website form and Website Review request data — kept for 24 months unless you ask us to delete it earlier
• Client engagement records — retained for the duration of our engagement plus 7 years for tax and contract record obligations
• Test data and copies of client data — deleted or returned at the end of the engagement, unless the client asks otherwise in writing
• Data in a client's own systems — retained under the client's own settings and policies
• Marketing communications — until you unsubscribe

11. Your rights — access, correction, deletion

Under the Privacy Act 1988 and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or out-of-date information
• Request deletion of your personal information, subject to legal retention obligations
• Withdraw consent for marketing communications at any time
• Make a complaint about how we handle your information

To exercise these rights, email hello@pulseforge.com.au. We aim to respond within 30 days. If you are unhappy with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

12. Children's privacy

Our services are not directed at children under 16. We do not knowingly collect information from children. If you believe a child's information has been collected, contact us and we will delete it.

13. Cross-border transfers

Some of the tools we use (listed in Section 6) are operated by overseas providers and may store or process data outside Australia, mainly in the United States (Netlify, Google, Resend) and, for Microsoft services, in Australia or the United States. By using our services, you acknowledge that personal information may be transferred to and processed in countries with different data protection laws. We take reasonable steps to ensure overseas recipients handle your information consistent with the Australian Privacy Principles.

14. Updates to this policy

We may update this Privacy Policy from time to time. Material changes will be notified by email to active clients and posted on this page with a new "Effective" date. Changes apply from the new effective date shown.

15. Contact us

For privacy questions, access requests, corrections, deletions, or complaints:

PulseForge Pty Ltd
Office 4453, Ground Floor
470 St Kilda Road
Melbourne VIC 3004, Australia
Registered postal address — no customer visits. Meetings by appointment only.
Phone: (03) 4422 2232
Email: hello@pulseforge.com.au
ABN 14 698 027 913

This policy does not constitute legal advice. It is provided as a clear summary of our practices. For specific legal questions about Australian privacy obligations, consult a qualified legal professional.