Privacy policy.

The AI Business Lab, ABN 67 191 350 573, is an Australian business based in Greater Sydney. We design AI strategy, build AI systems and advise on AI governance for organisations in Australia, New Zealand, Europe and the United States, in government and in private industry.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Small businesses under the turnover threshold aren’t automatically bound by the Act, and we’ve chosen to work to it anyway, because we ask our clients to hold themselves to standards they aren’t strictly forced to meet and it would be a strange thing to exempt ourselves from.

The distinction that matters here is between information about you personally, and material belonging to your organisation that we’re given access to so we can do the work. The second kind is governed by your engagement terms and a data handling agreement, not by this page alone.

We collect personal information when you book a session, send us an email, subscribe to a newsletter, or engage us for work. We don’t buy contact lists.

Where we research an organisation before approaching it, we use publicly available business information, and the personal information involved goes no further than a person’s name, role and business contact details.

This site runs only the cookies WordPress needs to function. We don’t run advertising or cross-site tracking cookies, and there’s no pixel here feeding anybody’s ad platform.

From 10 December 2026, APP 1.7 requires an organisation to disclose in its privacy policy where a computer program makes, or substantially assists in making, a decision that could significantly affect someone’s rights or interests, if personal information is involved. Here’s ours, early.

We don’t use automated decision-making to make decisions about individuals. We don’t score, rank, screen or assess people using AI. No decision affecting anybody’s rights or interests gets made by software here.

AI is very much part of how we work. It drafts, summarises, researches and builds. Every output that leaves this business has been read and approved by a person first, and the record of who approved what is kept as a matter of course rather than produced on request.

Where we build systems for clients, the same rule goes in at the architecture stage. Nothing irreversible happens without a named human saying yes.

We disclose personal information to the service providers that run this business. Between them they cover email and calendar, file storage, customer records, scheduling, website hosting and the newsletter. Each is used for the purpose it was engaged for and each is bound by its own obligations.

Some of those providers store data outside Australia, primarily in the United States. If you’d like the current list of providers and where they hold data, email us and we’ll send it, because it changes occasionally and a page like this goes stale.

We don’t sell personal information, and we don’t hand it to anybody for their own marketing.

Accounts, workspaces and credentials belong to whoever owns the organisation. When we work inside a client’s systems we’re invited in as ourselves, under accounts the client holds, and our access is removed at the end of the engagement.

Access is granted by permission rather than by sharing a password, so it can be withdrawn in a minute without changing anything else. Work is version controlled, which means changes are dated and attributed as they happen rather than reconstructed afterwards.

We keep engagement records for seven years, which matches our tax and business record-keeping obligations. Newsletter details are kept until you unsubscribe. Enquiries that don’t turn into work are cleared out after two years.

You can ask what personal information we hold about you, ask us to correct it, or ask us to delete it. Write to hello@theaibusinesslab.com and we’ll come back to you within thirty days. There’s no charge for any of that.

If you’re not happy with how we’ve handled your information or your complaint, you can take it to the Office of the Australian Information Commissioner at oaic.gov.au, and you don’t need our permission to do it.

If this policy changes, the version and the date at the top change with it, and anything material gets flagged to the newsletter list.