Privacy Policy

1. Who we are

David and Goliath AI Agency Pty Ltd (ABN 47 689 221 725, ACN 689 221 725), an Australian company, referred to here as D&G, we or us. We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we follow the Spam Act 2003 (Cth) for electronic marketing.

Our Privacy Officer is Joshua Morrow, Director. Contact jmorrow@davidandgoliath.ai, or hello@davidandgoliath.ai for general enquiries.

2. Who this policy is for

This policy covers four groups of people:

• Visitors to this website.
• People who request a resource, book a call or make an enquiry.
• Business contacts we approach by email, telephone or professional networks, either about our own services or on behalf of a client.
• Client personnel who take part in video we produce for that client.

3. What we collect

Business contact information. Full name, business email address, business telephone or mobile number, job title, employer name and domain, professional profile URL, and state or territory.

Records of our contact with you. Emails sent and replies, calls placed and their outcomes, and notes about the conversation. Calls we place are recorded and transcribed, and we tell you at the start of the call.

What you give us. The details you enter on a form when you request a resource or make an enquiry, and anything you choose to tell us in correspondence.

Research summaries. Short summaries about a person's professional role, prepared from public sources.

Video and audio. For client personnel who take part in filming, their image, voice and on camera statements.

Website data. Pages visited, time on site and referral source, through standard analytics.

We do not collect sensitive information such as health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or criminal history. We do not collect payment card details through this website, and we do not perform facial recognition or voice identification on video or audio.

4. Where we get it

Directly from you, from commercial business to business data providers we license, from public sources such as company websites and professional networks, and from our clients where they ask us to contact people on their behalf.

5. Why we use it

• To contact professionals about products and services relevant to their stated role.
• To prepare and send a resource you requested, and to follow up about it.
• To arrange and confirm meetings.
• To produce and publish video content for clients, with the agreement of the people featured.
• To improve our services, and to meet legal obligations.

6. Direct marketing, and how to stop it

Every marketing email we send carries an unsubscribe link, and we honour a request to stop on any channel, however you make it. Tell the caller, reply to the email, or write to jmorrow@davidandgoliath.ai.

When you ask us to stop, we keep the minimum record needed to make sure we do not contact you again. That record is kept indefinitely, deliberately, because deleting it would let your details re-enter our lists from another source.

7. Who we share it with

We do not sell personal information, and we do not disclose it for any third party's own marketing.

Our clients. Where we contact you on behalf of a client, or where you request a resource connected with a client engagement, we pass your details to that client so they can follow up. We tell you this at the point of collection.

Service providers. We use established providers to run our business: cloud storage and email, databases and hosting, outreach platforms for email, telephone and professional networks, business data providers, advertising platforms, and artificial intelligence services used as described in section 10. They handle information on our behalf and under our instructions. A current list of these providers is available on request from jmorrow@davidandgoliath.ai.

We also disclose information where the law requires it. Where a law enforcement agency or regulator asks for information, we check the request is valid and disclose only what is required.

8. Overseas disclosure

Some of our service providers hold information outside Australia, in the United States, Singapore, Japan, Germany, Estonia and India, and for our email platform also Canada, Ireland and Sweden. Our Director accesses information while travelling, including from Indonesia.

Under Australian Privacy Principle 8 we remain accountable for personal information disclosed to an overseas recipient, and we take reasonable steps to make sure it is handled consistently with the Australian Privacy Principles.

9. How long we keep it

• Business contact records and our contact history with you: 24 months from the last time we engaged with you.
• Call recordings and transcripts: 12 months.
• Research summaries: 12 months.
• Resource requests and enquiries: 24 months.
• Video of client personnel, and its transcripts: the engagement and 12 months after it ends.
• Records of a request not to be contacted: kept indefinitely, as explained in section 6.
• Contracts, invoices and financial records: seven years, as Australian tax law requires.

A request to delete your information is actioned ahead of these periods. Copies in backups are removed on that system's own cycle, no later than 90 days after we delete the live record.

10. Our use of artificial intelligence

We use third party AI services as tools inside our own workflow: to summarise public research about a professional role, to draft copy, to classify replies and video clips, to generate captions from speech, and to create artwork from text descriptions.

A person reviews everything before it is used, and clients approve anything published on their behalf. We do not use AI to make decisions about people. We do not train or fine tune AI models, and the providers we use do not train their models on the information we submit. Speech to text for video runs on our own computer rather than in a cloud service.

11. How we protect it

We keep the number of people and systems that touch personal information deliberately small. Access is limited to named people who need it, credentials are held in a business password manager with multi factor authentication, our computers use full disk encryption, data is encrypted in transit and at rest, and our databases deny access by default. Everyone who works with us is bound in writing to confidentiality obligations.

If a data breach happens, we contain it, assess it within 24 hours, and notify affected clients and, where the Notifiable Data Breaches scheme applies, the Office of the Australian Information Commissioner and the people affected.

12. Your rights, and how to complain

You can ask us what personal information we hold about you, ask us to correct it, ask us to delete it, or ask us to stop contacting you. Write to jmorrow@davidandgoliath.ai. We acknowledge requests within five business days and answer them within 30 days. We do not charge for this.

If you are unhappy with how we handle your information or your request, tell us first and we will try to put it right. You can also complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Cookies and analytics

This website uses cookies to improve your browsing experience and to measure traffic. You can control cookies through your browser settings. Blocking them will not stop you using the site.

14. Changes to this policy

We review this policy at least once a year, and whenever our services or providers change materially. The date at the top shows when it was last updated.