Privacy Policy

1. What We Collect

APP 3 -- Collection of personal information

We collect the following personal information:

Through our contact form:

• Name
• Email address
• Phone number (if you choose to provide it)
• Service interest (which of our services you're enquiring about)
• Your message

Through our website (automatically):

• Page views, device type, browser type, and approximate location (city-level)
• Referral source (how you found our website)
• Cookie data (see Section 7)

We only collect personal information that is reasonably necessary for our business functions -- responding to your enquiry and improving our website.

What this means: We only collect what we need to respond to your message and make our site better. Nothing more.

2. How We Use Your Information

APP 6 -- Use or disclosure of personal information

We use your personal information for the following purposes:

• Responding to enquiries: We use your name, email, and message to reply to your contact form submission.
• Service delivery: If you become a client, we use your contact details to manage your project and communicate about deliverables.
• Website improvement: We use analytics data to understand how visitors use our site so we can make it more useful.
• Service-related communications: If you opt in, we may send you updates relevant to your project or service interest. You can opt out at any time.

We will not use your personal information for any purpose other than those listed above without your consent.

What this means: We use your information to answer your message and make our site better. That's it. No spam, no selling your data, no surprises.

3. Who We Share It With

APP 6 + APP 8 -- Use, disclosure, and cross-border disclosure

We share your personal information with the following third-party services, solely for the purpose of operating our website and delivering our services:

We do not sell your personal information. We do not share it with advertisers, data brokers, or any party not listed above.

These third-party services process your data on our behalf under their own privacy policies and data processing agreements. They do not use your data for their own purposes.

Cross-border disclosure: As noted above, some of our service providers operate outside Australia. By using our website and submitting your personal information, you consent to the transfer of your data to these countries for the purposes described.

What this means: A few trusted services help us run the website. They process your data on our behalf -- they don't use it for anything else. We never sell your information.

4. How We Protect Your Data

APP 11 -- Security of personal information

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, and disclosure.

Our security measures include:

• Encryption: All data transmitted between your browser and our website is encrypted via HTTPS (TLS).
• Access controls: Only authorised personnel have access to personal information, and only for the purposes described in this policy.
• Third-party security: We select service providers that maintain appropriate security standards and data processing agreements.
• Regular review: We review our security practices regularly and update them as needed.

When personal information is no longer needed for the purposes for which it was collected, we take reasonable steps to destroy or de-identify it.

What this means: Your data is encrypted and only accessible to authorised people. We don't keep it longer than we need to.

5. Your Rights

APP 12 + APP 13 -- Access to, and correction of, personal information

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you.
• Request correction of any personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Request deletion of your personal information (where we are not required by law to retain it).

To exercise any of these rights, email us at hello@compound-co.com.au or use our contact form. We will respond within 30 days.

If you're not satisfied: If you believe we have breached the Australian Privacy Principles, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au

We encourage you to contact us first so we can try to resolve your concern directly.

What this means: You can ask to see, change, or delete your data anytime. Email us at hello@compound-co.com.au. If we can't sort it out, you can complain to the OAIC -- Australia's privacy regulator.

6. Automated Decision-Making

We do not currently use automated decision-making processes that significantly affect you. No algorithms score your enquiry, filter your message, or determine what services we offer you. Every enquiry is read and responded to by a person.

If this changes in the future, we will update this policy and notify you in accordance with APP 1.7 transparency obligations (effective December 2026).

What this means: A human reads your message and replies. No bots making decisions about you.

7. Cookies

Our website uses cookies to improve your browsing experience and help us understand how visitors use the site.

Types of cookies we use:

• Essential cookies: Required for the website to function (e.g., form submission handling). These cannot be disabled.
• Analytics cookies: Used by Google Analytics to collect anonymous usage data (pages visited, time on site, device type). You can opt out via Google's opt-out tool.

How to manage cookies: You can disable cookies in your browser settings. Note that disabling essential cookies may affect the functionality of our website.

What this means: We use cookies to make the site work and to understand how people use it. You can turn off analytics cookies in your browser settings if you prefer.

8. Google User Data

Google API Services User Data Policy

Compound Nexus, the app Compound Co runs for its marketing clients, connects to Google Ads and, when a business chooses to, to that business's Google Calendar. Google shows the app as Compound Co.

Google Ads. For the Google Ads accounts Compound Co manages, Nexus reads cost, click and conversion figures to report what the ads returned. It sends booked visits and won jobs, with the job's value, back to the same account as conversions so Google can measure the ads.

Google Calendar. A business can connect its Google Calendar in the app. It then gives Nexus three permissions, each used for one job:

• “View your availability in your calendars” (calendar.freebusy): Nexus checks when the business is busy before it offers a visit time, so no visit is booked over something else.
• “See the list of Google calendars you're subscribed to” (calendar.calendarlist.readonly): the business picks which calendar holds its visits and which calendars count as busy.
• “See, create, change, and delete events on Google calendars you own” (calendar.events.owned): Nexus adds an event for each booked visit, moves or deletes it when the visit is moved or cancelled in the app, and follows those events so a change the business makes in Google updates the booking. It only works with the events it created.

Each visit event holds the details of the booking: the enquirer's name, phone number and address, the job, a short summary of what they wrote, and a link to the enquiry in the app. These details are written into the business's own Google Calendar, which the business controls.

What is stored. A Google access credential, sealed in an encrypted vault; the connected account's email address; the ids of the chosen calendars and of the events Nexus created; and the chosen clear time around busy events. All of it is stored in Australia, in the Sydney region.

What is not stored. Calendar contents and busy times are read when a visit time is offered and are not kept. No Google user data is sent to AI models, and calendar data is never used for advertising.

Sharing. Compound Co does not sell Google user data and does not share it. It is shown only to Compound Co staff and to the business it belongs to.

Retention. Calendar data is kept while the calendar is connected. When a business disconnects in the app, the credential is deleted and Compound Co asks Google to revoke the access. Visit events already in the calendar stay there, and the business can delete them in Google. Google Ads figures are kept with the business's reports while it is a Compound Co client.

Deletion. To have your Google user data deleted, email hello@compound-co.com.au. A business can also disconnect its calendar in the app at any time, or remove the access in its Google Account under Security, Your connections to third-party apps & services.

Compound Co's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What this means: Nexus checks your Google Calendar for busy times and adds the visits it books. It keeps nothing else from your calendar, and you can disconnect at any time.

9. Xero Data

A business that is a Compound Co marketing client can connect its Xero account to Compound Nexus in the app. Nexus then reads that business's invoices, credit notes, quotes and contacts from Xero.

Why. Nexus matches each invoice to the enquiry it came from, by the customer's phone number, email or name. A matched invoice marks the job as won, records the job's value, and marks the job as done once the final invoice is paid.

What is stored. For each invoice that matches an enquiry: its Xero id, number, date, status and amounts, and the enquiry it belongs to. When the business confirms a match by name, Nexus also keeps the Xero contact's id so later invoices to that customer match. Invoice line text and Xero contact details are not stored. The Xero access credential is sealed in an encrypted vault. All of it is stored in Australia, in the Sydney region.

Invoice line text. To tell a deposit or progress invoice from a final invoice, Nexus sends an invoice's line text to Anthropic, the AI provider it uses, which processes it outside Australia and returns the type. Nexus does not keep the text.

Job values. A job's value from Xero goes to the business's own Google Ads and Meta ad accounts as the value of that enquiry, so the ads can measure which enquiries became jobs.

Nothing is written to Xero. Nexus only reads.

The business agrees to this when it connects Xero in the app.

Retention. The Xero credential is kept until the business disconnects Xero; then it is deleted and Nexus stops reading. Invoice records and the job values taken from them stay with the business's reports while it is a Compound Co client.

Disconnecting. In the app under Settings, Xero, Disconnect Xero. The business can also remove Compound Co from its connected apps in Xero.

Deletion. To have Xero data deleted, email hello@compound-co.com.au.

What this means: Nexus reads your Xero invoices to mark won jobs and their amounts, writes nothing to Xero, and stops reading when you disconnect.

10. Changes to This Policy

We may update this privacy policy from time to time. When we make significant changes, we will:

• Update the "Last updated" date at the top of this page.
• Post a notice on our website if the changes are material.

The latest version of this policy is always available at compound-co.com.au/privacy.

What this means: If we change something important, we'll update this page and let you know.

11. Contact Us

If you have any questions about this privacy policy or how we handle your personal information, contact us:

• Email: hello@compound-co.com.au
• Contact form: compound-co.com.au/contact

For our full terms of service, see our Terms of Service.