Privacy Policy

1. What we collect

• Account information: your name, email address, organisation and role.
• Sign-in information: the one-time codes we send (stored only in a hashed form), and your session.
• Billing information: the organisation's billing contact and ABN. Card details are collected and held by Stripe; we never receive the full card number.
• Your organisation's content: the conversations people have with the assistant, the changes they confirm or decline, and the organisation's settings. These may contain personal information about other people, such as colleagues, customers and the people in your mail.
• Microsoft 365 information: which Microsoft 365 account each person connects and when, and what the assistant reads from it when that person asks: mail, calendar entries and files they can already open. We use what the assistant reads only to answer that request and to prepare the changes the person asks for. We don't keep copies of the mail or files themselves, although the assistant's answers in a conversation may quote or summarise them. The credentials that let the service act for a person are kept securely and used only to act for that person, until they disconnect or leave the organisation.
• Usage and audit information: what you do in the service (the activity log, such as connections, settings changes and the changes people confirm), and the capture signals and watermark identifiers described in the Acceptable Use Policy (screenshot and snipping shortcuts, printing and large copies, with the page, time, IP address and browser).
• Technical information: IP addresses, browser and device details, and logs our infrastructure keeps to run and secure the service.
• Enquiries: what you send us when you contact us or apply for bulk pricing.
• Affiliate program: if you apply to be an affiliate, your name, email address, business, ABN, GST registration, website and what you tell us about who you'd refer; once you're approved, the bank account you give us for payment (stored encrypted) and your referral statements.

2. Why we collect and use it

• to provide the service: sign you in, run your organisation's workspace, answer and draft with the AI assistant, and make the changes people confirm in their Microsoft 365;
• to administer the trial and billing, and send service and billing emails (such as sign-in codes, trial reminders and invoices);
• to send trial owners and administrators two optional getting-started emails about using the service; each has an unsubscribe link, which stops these emails while essential account notices continue;
• to protect the service and enforce the Terms and Acceptable Use Policy, including through the audit log and watermark;
• to support you and respond to your enquiries;
• to run the affiliate program: review applications, work out which organisations were referred through an affiliate's link, and pay affiliates; and
• to meet our legal obligations.

We handle your organisation's content as its service provider, only to provide the service to it. We don't sell personal information, and we don't use your content to train AI models.

3. Who we disclose it to

We use these service providers, each only for the purpose shown:

• Cloudflare, Inc. hosts the service and its data (compute, storage, email delivery and routing) and runs the in-app AI assistant's models on Cloudflare Workers AI.
• Microsoft Corporation provides Microsoft 365. When a person connects their account, the service reads and changes information there under that person's permissions; it stays subject to your organisation's agreement with Microsoft.
• Stripe, Inc. and its affiliates process payments and issue invoices.
• Google LLC measures which of our ads lead to trial sign-ups and paying customers (see section 8).
• The providers of the AI models on Cloudflare Workers AI process the content of assistant requests through Cloudflare's platform to answer them.
• Anthropic, Microsoft or OpenAI, only if someone in your organisation connects the service to Claude, Microsoft 365 Copilot or OpenAI Codex. What they read through that connection goes to that provider under the terms of the account the person connects.

Within your organisation, each person sees their own conversations and connections; administrators can see the organisation's members, settings and activity. We may also disclose information where the law requires or permits, such as to respond to a lawful request or to protect our rights.

4. Overseas disclosure

Our service providers operate globally. Cloudflare processes data through its network, including outside Australia; we do not guarantee Australian-only processing or storage. Stripe and external assistant providers may process information in the United States and other countries. Microsoft processes your Microsoft 365 data under your organisation's agreement with it. We take reasonable steps, including through our provider agreements, to protect personal information consistently with the Australian Privacy Principles.

5. Security and retention

Each customer's workspace runs separately from others, access requires a signed identity for that organisation, and we restrict our own staff's access to what is needed to support the service. No system is completely secure, and we'll notify you and the Office of the Australian Information Commissioner of an eligible data breach as the Notifiable Data Breaches scheme requires.

We keep account and content data while your organisation's account is active. After a trial ends without billing or a subscription is cancelled, we keep it for 90 days and then delete it. We keep audit log entries, billing records and records we need for legal reasons for as long as those reasons require (for example, tax records for the period the law requires).

Private backups of the platform's account database and of each workspace's records are kept for up to 30 days. Deleting an organisation removes its workspace backups; historical platform database backups can retain its account and personal information for up to a further 30 days, until those backups expire. If an older backup is restored, deletion and purge are reapplied before access is reopened. Mail, calendar entries and files in your Microsoft 365 are never part of our backups.

6. Access and correction

You can see and update most of your account information in the service. You may ask us for access to, or correction of, personal information we hold about you through https://madecowork.com/contact (choose "Privacy"). We'll respond within 30 days. If the information is part of your organisation's content, we may refer you to your organisation, which controls it.

7. Complaints

If you have a concern about how we've handled your personal information, tell us through https://madecowork.com/contact (choose "Privacy"). We'll acknowledge it within 7 days and aim to resolve it within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

8. Website

The public madecowork.com website uses the Google tag to measure which of our ads lead to trial sign-ups. The tag loads from Google, which receives your IP address, browser details and the page you're on, and it sets first-party cookies on madecowork.com (such as _gcl_au, and _gcl_aw when you arrive from one of our ads) that hold an identifier and, where there is one, Google's click identifier. We set the tag so that your visits aren't used for ad personalisation or remarketing, and we don't send Google your name or email address.

Your browser also keeps, in its own storage on madecowork.com, how you first reached the site (the page, any campaign tags in the link and, if you came from one of our ads, Google's click identifier) for up to 90 days, and separately the most recent click identifier from one of our ads, with its campaign tags and when it was recorded. When you start a trial, we record these with it. If your organisation later becomes a paying customer, we tell Google Ads that the click led to a customer, using only a click identifier.

If you reach the site through an affiliate's link, your browser keeps that affiliate's code in its own storage on madecowork.com for up to 90 days, and we record it with a trial you start in that time, so we can pay the affiliate. We count clicks on each affiliate's link per day, without visitor identifiers or IP addresses. An affiliate sees that a referral exists and where it stands (on a trial, paying, bounty earned), but not your name or your organisation's.

You can stop or limit this by clearing or blocking cookies and site data for madecowork.com in your browser, by using a browser or extension that blocks the Google tag, or through your Google ad settings (myadcenter.google.com). Blocking only third-party cookies doesn't stop it, because these cookies are set on madecowork.com itself. The site works the same without them.

The service itself (your organisation's workspace) doesn't use advertising or analytics cookies. The sign-up and sign-in forms use Cloudflare Turnstile to tell people from bots, and signing in sets a session cookie that the service needs to work.

9. Changes and contact

We may update this policy and will post the new version here, with its date. For a change of substance we'll also email account owners. Contact: Made AI Pty Ltd, https://madecowork.com/contact.