Privacy Policy

In this policy, business days are Monday to Friday, excluding Victorian public holidays. Other periods are calendar days, except the five-working-day period the law sets for marketing unsubscribe requests.

Who we are

Pilot Systems is the registered business name of Declan Thomas Cawthorn, sole trader, ABN 19 717 753 395. We are based in Melbourne, Victoria, and build websites and set up admin systems for trade businesses across Australia.

This policy explains how we handle personal information: on our website, in our business outreach, with our clients, and inside the systems we build or set up for clients. We comply with the privacy laws that apply to us. The commitments in this policy apply whether or not a particular privacy law applies to a particular activity.

The short version

• We collect what you give us, what businesses publish about themselves, and basic technical information that keeps our website running.
• We use an AI assistant, Claude, to help run Pilot Systems, including reading and answering our business email. It doesn’t handle our clients’ customers’ information.
• When we work for a client, we work inside the client’s own accounts and leave its customers’ information there. We never contact our clients’ customers.
• Our website doesn’t use advertising trackers or analytics cookies.
• We don’t sell personal information. You can ask us to stop contacting you, or to see or correct what we hold, at any time.

Information we collect

We don’t ask for health information or other sensitive information. Please don’t send it, or passwords or payment-card details, through our forms. If we receive information we don’t need, we decide whether we may lawfully keep it and otherwise delete or de-identify it.

We don’t collect or store payment-card details. Clients pay us by bank transfer. We keep the bank-transfer references and payment records needed to match payments to invoices and process refunds.

How we collect information

We collect information directly when you contact us, book a call, sign a Proposal or send us project materials. We also receive information from our clients and their authorised representatives, from systems they authorise us to set up or support, and from the hosting, email, security and analytics services that run our Website and the websites we host for clients.

For our business outreach, we collect business contact details from public sources: a business’s own website, and listings and pages the business publishes, such as online business directories and social media business pages. We only use an email address or phone number to contact a business if the business itself makes it public.

You can make a general enquiry without giving your name where that’s practical, for example by phoning us. Our forms need the fields marked “Required”. Without enough information we may not be able to respond or provide a service.

Why we use information

We use personal information to:

• respond to enquiries and arrange calls;
• prepare the instant estimate you ask for, and email you the link to book a call;
• prepare mock-ups and Proposals, sign contracts and deliver agreed services;
• set up, test and look after the websites and admin systems our clients ask for;
• contact businesses that might want our services, or might refer clients to us, follow up, call them, and keep a record so we never contact anyone who has asked us to stop;
• invoice, match payments and keep required business records;
• provide support and care plans, including renewal reminders and cancellations;
• publish our social media posts and respond to comments and messages;
• protect our Website, our clients’ websites and our systems against misuse;
• understand overall Website use and improve the Website;
• handle complaints and meet legal obligations.

We only use information for another purpose where the law permits or requires it, or with appropriate permission. We don’t sell personal information, and we don’t receive any payment or benefit for giving anyone’s personal information to another business.

Business outreach and calls

We contact trade businesses that might want our services, and businesses that might refer clients to us (such as bookkeepers and accountants), using the email address or phone number the business publishes. Our emails are about our services and relevant to the business. A trade business that doesn’t reply may get one follow-up email. We may also call, during permitted calling hours (weekdays 9am to 8pm and Saturdays 9am to 5pm, never Sundays or national public holidays), from a number that shows caller ID, after checking the number against the Do Not Call Register. We may visit a business that might refer clients to us. Each email identifies Pilot Systems, includes our ABN and contact details, and tells you how to stop them. On calls, we say who we are first.

Homepage mock-ups. If you agree to a chat, we may make a mock-up of a new homepage for your business, from what your business publishes about itself. We label it as a mock-up and show it to you on screen during our chat. Any file or link we keep is private (it isn’t public or findable in search engines), and we don’t show it to anyone else or use it in our marketing. We delete it 30 days after our chat, unless you become a client.

To stop our outreach, reply “no thanks” (or anything that says stop) to any of our emails, tell us on a call, or contact us using the details below. We add your business and all its addresses and numbers to our do-not-contact list the day we receive your request, or the next business day if it arrives on a weekend or public holiday, and always within five working days. We check that list before every email, call or visit. On that list we keep only what we need to make sure we don’t contact you again: your business name and the addresses and numbers to avoid. Your other outreach records are deleted within 12 months of our last contact (see “Storage, security and retention”), or sooner if you ask us to delete them.

Our outreach emails and replies are written and sent by AI (see “AI and automated decisions”). Our calls are made by Declan. Being contacted by us doesn’t add you to any email list.

Our email list

We don’t currently send email newsletters or other marketing emails to a list. If we start one, you’ll only be added if you ask, by ticking an optional, unticked box; agreeing to our Terms of Use isn’t agreeing to marketing. We’ll update this policy before it starts.

Replies to your enquiry and necessary service messages, such as invoices, care plan reminders and cancellation confirmations, are separate from marketing. We don’t send marketing by text message.

AI and automated decisions

Our AI assistant. We use Claude, an AI assistant made by Anthropic, to help run Pilot Systems: software development, drafting, research, our business outreach, our social media posts, handling our email and keeping our books. For outreach, Claude finds businesses on public websites and listings, writes and sends our first emails and follow-ups, reads the replies, answers people who are interested with times for a call, adds opt-outs to our do-not-contact list, and keeps our call list. Claude also reads the email that reaches our business mailbox, including enquiries, instant estimate requests and call bookings, so we can follow up and prepare for calls. It answers enquiries and routine questions from the information we publish, sends a short acknowledgement when Declan needs to reply himself, and keeps a short log of each email in our customer database. Claude sends these emails itself, signed in Declan’s name, without Declan checking each one first, following rules Declan sets. Complaints, privacy or legal questions, and anything outside our published packages and prices go to Declan. You can ask to deal with Declan directly at any time, and if you ask whether you’re talking to a person, we’ll tell you plainly.

Claude also writes our social media posts and may publish them through Buffer (see “Service providers and where information is handled”) on our X account, our Facebook Page and Declan’s LinkedIn profile, where they appear in Declan’s name, without Declan checking each one first. Claude doesn’t read or reply to comments or messages on our social accounts; Declan handles them himself.

Claude also helps keep our books in Zoho Books (see “Service providers and where information is handled”). It reads our clients’ billing details (names, business and contact details), our invoices and the payments we receive, the transactions we import from our bank statement (such as the payer’s name and the amount), and our own expenses. It adds clients’ billing details, prepares draft invoices and expense records, and works out which payment matches which invoice. It doesn’t send an invoice or reminder, record a payment, or void or delete anything unless Declan says yes to that step. Scheduled invoices and reminders that Declan sets up in Zoho Books (such as care plan and domain renewal invoices, and a reminder when an invoice is overdue) are sent by Zoho Books itself.

Claude runs on Declan’s own Anthropic account, under Anthropic’s consumer terms, not through the settings described below for our estimate. We have turned off the setting that lets Anthropic use these conversations to improve its models. Anthropic keeps conversations under its own rules: as Anthropic describes them, a deleted conversation is removed from its back-end systems within 30 days, conversations flagged by its safety systems may be kept for up to 2 years, and feedback we send it for up to 5 years. These periods can be longer than the ones in this policy.

Our instant estimate. When you use our instant estimate, we use automated tools, including AI models accessed through Vercel’s AI Gateway, to suggest a package from our published prices and write a few short notes about your situation. The AI gets your trade, suburb and team size, what’s slowing you down, anything else you add, and what our quick look at your homepage found; it doesn’t get your name or contact details. AI requests are sent with settings that stop the providers keeping your information or using it to train their models. The estimate is a starting point, not a quote or an offer: Declan reviews every Proposal and price before anything is agreed.

Our clients’ customers’ information never goes into AI tools, unless that client has approved it in its Proposal. Claude doesn’t read our clients’ emails past the sender and subject line, and files our clients share with us are opened by Declan, not by Claude. The systems we set up for clients don’t use AI on their customers’ information and don’t record calls. Before introducing any AI feature that would handle a client’s customers’ personal information, we’ll tell that client, get its approval and update this policy.

Decisions made by computer programs. Some decisions are made by computer programs without Declan checking each one first:

• Claude decides whether an email to our business mailbox gets a reply straight away or is held for Declan, and what that reply says;
• Claude decides which businesses fit our rules for outreach, and sends our outreach emails and follow-ups;
• our instant estimate suggests a package from your answers;
• our spam check decides whether a form submission looks automated.

To do this they use the kinds of information described in this policy: what you send us, our records of our contact with you, what a business publishes about itself, and technical information about form submissions. None of them decides a price, a contract, or whether we’ll work with you: Declan makes those decisions. If you think an automated step has got something wrong, tell us and Declan will look at it.

Service providers and where information is handled

We use the providers below. Some information is handled outside Australia. A provider’s head office isn’t necessarily where all processing, support access or backups happen.

We also give phone numbers to the Do Not Call Register’s operator to check them before outreach calls. We may disclose information to professional advisers (such as our accountant, solicitor or insurer) where needed and where the law permits or requires it. We don’t use subcontractors without our client’s written agreement.

Our clients’ own providers aren’t listed here. When we set up admin systems for a client, the software and services involved (such as its job, accounting, payment, messaging or missed-call text service) are the client’s own, under its own contracts. Each client’s Proposal lists them, with where they handle information.

When we choose and use providers, we consider what information they need, their terms and their security. Where laws on sending information overseas apply to us, we take the steps those laws require.

Cookies, analytics and spam protection

Our Website doesn’t use advertising trackers, social media pixels or analytics cookies, and it doesn’t load fonts, videos, maps or scripts from other companies’ servers, apart from Cloudflare’s spam check on our forms (see below).

We use Vercel Web Analytics for combined visit and page statistics. It doesn’t use cookies. To tell visits apart, it uses a code created from your request that Vercel discards after 24 hours, so it can’t follow you across days or other websites. We also count, without identifying you, when someone taps our phone number or email address, or sends an enquiry. We don’t send names, email addresses, enquiry content or other identifying details in analytics events or web addresses.

We use Cloudflare Turnstile to tell genuine form submissions apart from automated abuse. It processes technical signals about your request and browser, and may use a short-lived technical cookie needed for the spam check. It isn’t used for advertising.

Our forms keep a temporary copy of what you type in your browser tab (session storage), so it isn’t lost if the page reloads. It stays on your device and is deleted when you send the form or close the tab.

If you turn on “Reduce motion” at the bottom of our pages, your browser remembers that setting (in its local storage) so it stays on when you come back. It stays on your device, isn’t sent to us, and is removed when you turn the switch off.

Our business outreach emails are sent from our ordinary mailbox and don’t contain open or click tracking.

Information we handle for clients

Our clients are responsible for their own lawful collection of information, their messaging instructions and their own privacy notices. We handle their customers’ information only for the agreed setup, testing, delivery and support, on our client’s behalf and instructions, and we remain responsible for our own handling.

Websites we host. While we look after a client’s website, its enquiry form sends each enquiry to the client and an instant reply, in wording the client approves, to the person who sent it. If a client’s website takes photos with a quote request, the photos go to our client with the enquiry, and we’ll update this policy before any client website keeps them anywhere else. We don’t use these enquiries for our own purposes. Each website we build has its own privacy notice, prepared from our template and approved by our client; that notice, not this policy, explains how our client handles its customers’ information. Where a client’s website shows its Google reviews, it shows them as Google supplies them, by a fixed rule (such as the most recent), with a link to all its reviews on Google.

Working in our clients’ accounts. When we set up admin systems for a client (for example invoicing, quoting, enquiry handling, missed-call text-back or service reminders), we work inside the client’s own accounts with the software it chooses. We use our own login as an invited user, never our client’s passwords. We can see the customer information in those accounts, and we leave it there: we don’t copy it into our own systems, email it, or put it into AI tools.

Moving information in. If a client asks us to move information into its software (such as a customer list, price list, unpaid invoices or old quotes), the client shares the files from its own storage, such as its own Google Drive or OneDrive. We don’t accept these files by email or text. Declan opens them himself, uses them only for that import, and deletes our working copies the same day the import is checked.

Ongoing care. If a client chooses our Admin Care plan, we keep access to the accounts it lists while the plan continues, check that its systems are working, and save a quarterly export of its records to the client’s own storage. We keep no copy. We ask clients not to send us their customers’ details by email or text; if they do, we use them only to answer the request and then delete them. When the work or the plan ends, we remove our access and confirm it to our client.

We never contact our clients’ customers. Messages to our clients’ customers (such as invoice reminders, replies to enquiries and service reminders) are sent by our client’s business, from its own accounts, in wording our client approves, and reminders go only to customers who have agreed to them. We only send test messages to ourselves. We don’t record calls.

If you are a customer of one of our clients, contacting that business first may help it find your records. You can also contact us about our own handling of your information. We won’t refuse a request just because a client is involved.

Storage, security and retention

Enquiries sent through our contact form are delivered by email. We don’t copy the enquiry into a separate database, but our customer database keeps a short log entry for it, and Anthropic keeps Claude’s conversations about it (see “AI and automated decisions”). Instant estimate requests, call bookings, records of the emails we send and our outreach records are stored in our customer database (Supabase, Sydney), which only we can access. A working copy of our call list is kept on a private page on Anthropic’s service, and in call lists we send to ourselves. Copies and technical records can also exist in email-sending records, hosting logs, mailbox backups and synced devices.

We take reasonable steps to protect information, including encrypted connections, limited access, our own logins for client accounts, secure handling of logins, and two-step login (multi-factor authentication) on our business accounts.

We keep information only while we need it for a lawful business purpose or as required by law, then take reasonable steps to delete or de-identify it.

No system is completely secure. If we suspect a security incident, we investigate, take steps to contain any harm, and promptly tell any client whose information is involved. We notify affected people and regulators when the law requires it, and consider warning affected people even when it doesn’t.

Access and correction

You can ask to see, or correct, personal information we hold about you, by email or phone. We may take reasonable steps to confirm your identity without collecting more information than we need. We’ll respond within 30 calendar days. If we can’t give access or make a correction, we’ll explain why, where the law allows, and tell you how to complain.

Questions and complaints

Contact declan@pilotsystems.com.au or 0457 471 392. We’ll acknowledge complaints within five business days and aim to resolve them within 30 calendar days. If we need longer, we’ll explain why and keep you updated.

If you’re not satisfied, you may contact the Office of the Australian Information Commissioner (oaic.gov.au) where it has jurisdiction, or another appropriate regulator. We can tell you which external complaint route applies.

Changes to this policy

We may update this policy when our practices or legal obligations change. Each version shows its effective date. Where required, we’ll give further notice or ask for consent. An update doesn’t authorise a new use of information already collected, or change an existing service contract.

Contact

Declan Thomas Cawthorn trading as Pilot Systems
ABN 19 717 753 395
Email: declan@pilotsystems.com.au
Phone: 0457 471 392
Melbourne, Victoria, Australia

Back to top