Privacy Policy

1. Who we are

Spuutr is operated by an Australian privately owned startup. We provide AI agent team subscription services.

This policy explains how we collect, use, disclose, and protect your personal information when you use our website (spuutr.com) and services. It covers our obligations under:

• AU Australian Privacy Act 1988 (including the Australian Privacy Principles)
• GDPR EU General Data Protection Regulation (for users in the European Economic Area)
• CCPA California Consumer Privacy Act (for California residents)

2. What personal data we collect

2.1 Information you provide

• Waitlist signup: name, email address, and optionally company name — collected via our waitlist form
• Account registration: when you log in via Google, GitHub, or Microsoft OAuth, we collect your name, email address, and profile picture from the provider. We do not receive or store the OAuth tokens beyond the initial authentication handshake
• Environment keys: you may choose to store API keys (e.g., OpenAI, Anthropic) in your portal. These are encrypted at rest with AES-256-GCM and used only to connect your agent team to third-party AI providers
• Enquiries: when you contact us via the enquiry form, we collect your name, email, and message content
• Chatbot: conversation messages are stored temporarily to provide context-aware responses. Chat transcripts may be emailed to us for quality and support purposes

2.2 Information collected automatically

• Server logs: IP address, browser user-agent, page requested, and timestamp. These are retained briefly for operational security and debugging
• Session cookie: a strictly necessary HTTP-only session cookie is set when you log into your portal. No analytics or tracking cookies are used

2.3 What we do not collect

• We do not collect payment card details (payments will be handled via Stripe or Wise, and data goes direct to them)
• We do not use analytics scripts, tracking pixels, or fingerprinting
• We do not sell your data to third parties

3. How we use your data

4. Legal basis (GDPR)

If you are in the European Economic Area (EEA), our legal basis for processing your personal data depends on the specific activity:

• Consent — waitlist signup, chatbot interactions (you actively submit this data)
• Contractual necessity — providing portal access and operating your agent team
• Legitimate interests — server security, debugging, and service improvement (non-intrusive)

You may withdraw consent at any time by contacting us.

5. Who we share data with

We use third-party sub-processors to operate the service:

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

Model providers may change at any time. We regularly evaluate and switch between model providers to optimise cost, quality, and capability. The specific models listed above reflect our current stack and may be updated without notice. We also support Bring Your Own Key (BYOK) — you may supply your own API keys (e.g., OpenAI, Anthropic) via your portal. When BYOK is used, inference routes through your own provider accounts and we act solely as the orchestration layer. Data shared with those providers is governed by your direct agreement with them.

6. How we store and protect data

• Encryption at rest: API keys stored in your portal are encrypted with AES-256-GCM using a server-side key. The plaintext is never logged or exposed. If you use Bring Your Own Key (BYOK), your keys are encrypted with the same standard and used only for the specific provider you designate
• Encryption in transit: all connections to spuutr.com are served over HTTPS (TLS). API calls to sub-processors use TLS
• Access control: portal access requires authenticated login via OAuth. Environment keys are only accessible to the user who stored them
• Database: operational data is stored in SQLite databases on a virtual private server with restricted access
• Backups: configuration and limited operational data are backed up to private GitHub repositories

7. Data retention

• Waitlist data: retained until you request removal or until the waitlist is retired
• Account data: retained for the duration of your account, plus 90 days following account deletion for operational recovery purposes
• Chatbot conversations: retained for 90 days, then automatically summarised and purged
• Server logs: retained for 30 days, then rotated
• Environment keys: deleted immediately when you remove them in the portal, or within 30 days of account deletion

8. Your rights

8.1 All users

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate or incomplete data
• Deletion — request deletion of your personal data (subject to legal retention obligations)
• Objection — object to processing based on legitimate interests

8.2 GDPR (EEA users)

In addition to the above, EEA users have the right to:

• Data portability — receive your data in a structured, machine-readable format
• Restriction — restrict processing in certain circumstances
• Lodge a complaint — with your local data protection authority

8.3 CCPA (California residents)

Under the CCPA, California residents have the right to:

• Know — what personal information we collect, use, and disclose
• Delete — request deletion of personal information
• Opt-out — of the sale of personal information (we do not sell data, so this right is not currently triggered)
• Non-discrimination — we will not discriminate against you for exercising these rights

8.4 How to exercise your rights

Contact us at admin@spuutr.com. We will respond within 30 days (Australian Privacy Act) or within the timeframe required by applicable law. We may need to verify your identity before processing your request.

9. Cookies

We use a single strictly necessary cookie:

No analytics, tracking, advertising, or third-party cookies are used. Because we use only a strictly necessary cookie, no cookie consent banner is required under the ePrivacy Directive / Australian privacy law.

10. Children

Spuutr is not directed at individuals under 16 years of age. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at admin@spuutr.com.

11. Changes to this policy

We may update this privacy policy from time to time. Material changes will be communicated via our website or email. The "Last updated" date at the top of this page will always reflect the most recent revision.

12. Contact us