Privacy Policy

Who we are

ReferralReady is operated by Seddon Digital (Australia). We comply with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and we participate in the Notifiable Data Breaches scheme. Contact: hilary@seddondigital.com.au.

What we collect

Your email address (that's your whole login — no passwords), the business profile you provide or approve, the presentations you create, and practice metrics (pace, timing, filler-word counts, transcripts and coaching feedback). Payment details are handled entirely by Stripe; we never see your card number.

Voice recordings are never stored

When you record a practice run, the audio is sent for transcription, analysed, and immediately discarded. We keep only the transcript and the measured metrics — and you can delete those any time from the app.

Where your data lives

Our database and application run in Sydney, Australia. Some processing partners (below) process data transiently outside Australia; this is disclosed under APP 8. Most are independently security-certified, and where we hold no certification we say exactly what the partner receives:

• •Vercel (app hosting, Sydney region) — ISO 27001, SOC 2
• •Neon (database, Sydney region) — ISO 27001, SOC 2
• •Stripe (payments) — ISO 27001, PCI-DSS Level 1
• •Anthropic (AI script drafting & coaching) — ISO 27001, SOC 2 Type II — API data is not used to train models
• •Deepgram (speech-to-text for practice feedback) — SOC 2
• •Postmark (transactional email) — SOC 2
• •Google Analytics (website usage measurement) — ISO 27001, SOC 2 — receives page views and device type, never your name, email or anything you write in the app
• •TidyCal (booking a one-to-one, on /book only) — United States — receives only the name, email and time you enter when booking a call, and nothing from your account

Your rights (APP 12 & 13)

From your account page you can view and edit your profile, delete individual presentations and practice sessions, download everything we hold about you as a file, and delete your account entirely. Account deletion removes your content immediately — including your public contact card, if you published one; billing records are retained for five years as Australian tax law requires, and the record of your marketing-email choices is retained as described below.

Marketing email

We only send marketing or product-update emails if you actively opt in (the box is unticked by default, in line with the Spam Act 2003). You can turn it off any time from your account, and every such email carries an unsubscribe link. Turning it off never affects the essential emails below.

We keep a record of each time you turn this on or off — the date, and whether it came from signup, your account page or an unsubscribe link. We hold it because the Spam Act requires us to be able to show that you consented, and it is included in your data download. It is kept if you delete your account, because its whole purpose is to answer a question raised after the fact; it holds no contact details.

Your public contact card

You can publish a contact card — a public web page at a web address you choose, holding what you put on it: your name, business, trade, and any phone number, email address or links you add. It is public. Anyone with the address can see it, search engines can index it, and once something has been public we cannot claw back copies other people or search engines have already taken.

Publishing is entirely your choice, nothing is published until you press Publish, and you can unpublish at any time from the card page. Two things are deliberately kept back unless you switch them on: the email address on your card is a separate field from the one you sign in with, so your account address is never published by accident; and your meeting day, time and venue are hidden by default, because publishing them tells anyone who finds the page where you are every week.

Published cards are also listed in our public member directory, which can be indexed by search engines. You can leave that listing while keeping your card, or keep the card out of search results altogether, from the same screen. Deleting your account deletes your card, removes it from the directory and frees its web address.

Analytics and cookies

We use Google Analytics to see which pages get used and how people find us, so we know what to improve. It sets cookies in your browser and tells us things like which pages were visited, roughly where in the world you are, and what sort of device you used. Your IP address is used to work out that rough location and is then discarded rather than stored. We don't send it your name, your email, or anything you've written in the app. You can block it with any ad blocker or your browser's privacy settings, and the app will work exactly the same.

Google is listed as a processing partner above, and processes this data outside Australia — disclosed under APP 8, like our other partners. Google's own privacy policy is at policies.google.com/privacy.

We also set one essential cookie to keep you signed in. That one isn't optional, because without it the app can't tell it's you.

What we don't do

We don't sell your data and we don't use it for advertising. The essential emails we always send are transactional: sign-in links, your scripts, billing reminders and support replies.

Questions or complaints

Email us first and we'll do our best to fix it. You can also contact the Office of the Australian Information Commissioner (oaic.gov.au).