Privacy Policy

1. Who we are

Karst builds intelligent operating systems for businesses that want real commercial outcomes, not reports. We combine commercial intelligence, operator expertise and disciplined AI execution to close the gap between operational reality and commercial potential.

This policy explains how we handle any information you share with us along the way.

You can contact us at any time at info@hellokarst.com regarding this policy or any privacy matter.

2. What information we collect

We only collect information you choose to provide to us. Specifically:

Through our AI intake form

• Annual revenue range (selection)
• Number of staff (selection)
• Your business website URL
• Your role (e.g. CEO, Founder, Operator)
• A description of your current business situation or problem

If you request a callback

• Your name
• Your email address

Automatically collected

• Standard web analytics (page views, device type, approximate location, referrer)
• Standard server logs from our infrastructure providers

We do not collect phone numbers, postal addresses, payment information, government identifiers, or sensitive information as defined under the Privacy Act.

3. How we use your information

We use the information you provide to:

• Generate a tailored AI analysis of your business situation
• Respond to your enquiry and arrange a discovery consultation
• Improve the relevance and quality of our advisory services
• Comply with our legal and regulatory obligations

We do not use your information for unsolicited marketing, and we do not sell your personal information to any third party.

4. How your data is processed

When you submit the intake form, your responses are sent securely to our backend, which performs two actions:

1. AI analysis. Your business details (revenue range, staff count, website, role and described problem) are sent to our AI provider to generate a response. Your name and email are not included in this step.
2. Email to our team. If you request a callback, your full submission (including name and email) is delivered as an email to our internal team via our email delivery provider.

We do not maintain a database of intake submissions. The persistent record of your enquiry exists only in our team's email inbox.

5. Third parties we use

We rely on a small number of trusted third-party service providers to operate our website and respond to enquiries:

Each of these providers operates under their own privacy policy and may store data outside Australia, including in the United States. Where data is transferred overseas, we take reasonable steps to ensure it is handled in a manner consistent with the APPs.

When you click through to Calendly to book a consultation, any information you enter on Calendly's platform is governed by Calendly's own privacy policy.

6. Cookies and analytics

Our website does not set its own marketing cookies. Third-party services we use (such as Google Analytics and Calendly) may set cookies in your browser to support their functionality and to provide us with aggregated, anonymised usage data.

You can control or disable cookies at any time through your browser settings.

7. Data retention

We do not store intake submissions in a database. Records of enquiries exist as emails in our inbox and are retained for as long as reasonably necessary to respond to you and maintain a record of our business communications.

Standard server and analytics logs held by our infrastructure providers are retained according to their own retention policies (typically between 7 and 90 days for operational logs).

8. How we protect your information

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These steps include:

• HTTPS encryption across the entire website
• Use of reputable, security-audited infrastructure providers
• Server-side handling of all sensitive operations
• Restricted internal access to enquiry emails

No method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Your rights

Under the Privacy Act, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion of your personal information, subject to legal obligations
• Withdraw consent for further processing of your information
• Lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC)

To exercise any of these rights, please email info@hellokarst.com. We will respond within a reasonable timeframe, typically 30 days.

10. Children's privacy

Our services are intended for business decision-makers and are not directed to children under 16. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our website after changes are posted constitutes acceptance of the revised policy.

12. Contact us

For any privacy-related questions, requests or complaints, please contact us at:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.