1. About this policy

This Privacy Policy explains how Will Fernandes (bywill.ai) (“bywill.ai”, “I”, “we”, “us” or “our”) collects, holds, uses and discloses personal information. bywill.ai is a Brisbane, Queensland based consultancy providing business and marketing strategy, creative and digital direction, practical AI and automation, and education services.

We are committed to handling personal information responsibly and in line with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs) contained in it. To the extent the Privacy Act may not strictly apply to a business of our size, we nonetheless choose to follow the APPs as our standard of practice.

This policy applies to our website at bywill.ai (including the Journal), and to personal information we collect when you deal with us in connection with our services. By using the website, you acknowledge that your information will be handled as described in this policy.

2. Information we collect

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable. The kinds of personal information we may collect include:

• Enquiry form answers – if you complete the Business Diagnostic, the answers and contact details described in section 4.
• Information you choose to give us – such as your name, business or organisation name, role, contact details and the content of any message, enquiry, feedback or file you send us.
• Client and engagement information – if you or your organisation engage us, details needed to scope, deliver, invoice and administer the work, including billing details and records of our communications.
• Event and workshop information – if you attend a workshop, presentation or training session, registration and attendance details and any feedback you provide.
• Technical and usage information – when you visit the website, information such as your IP address, browser and device type, operating system, referring page, pages viewed, date and time of visit and approximate location derived from your IP address. This is collected through server logs, and our hosting provider’s performance monitoring (see Cookies).

We do not intentionally collect sensitive information (such as health information, racial or ethnic origin, political opinions or religious beliefs). Please do not send us sensitive information. If you do, we will only hold it where it is reasonably necessary and you have consented, or where otherwise permitted by law.

3. How we collect it

We collect personal information directly from you wherever reasonable and practicable – for example when you contact us, engage our services, attend an event or interact with us on professional networks. We also collect technical information automatically when you browse the website (see Cookies).

Occasionally we may receive personal information about you from third parties, such as your employer or colleague who engages us, a person who refers you to us, or publicly available sources such as professional profiles. If we receive unsolicited personal information that we could not have collected under the APPs, we will destroy or de-identify it where lawful and reasonable to do so.

4. Enquiry form

Our website has a Business Diagnostic form so you can tell us about your business and what you need. If you complete it, we collect:

• Contact details – your name and email address, and optionally your phone number, company or website and the best time to contact you.
• About your business – your industry, team size, the tools you use, where time is lost, your goals, your current level of AI use, the services you are interested in, your timeline and an indicative budget range.
• Anything else you write in the optional free-text boxes.
• Technical information needed to protect the form from spam and abuse, such as a timestamp and a one-way (hashed) version of your IP address used for rate limiting. The hashed IP is kept for no more than an hour.

Purpose. We use this information to understand your needs, respond to your enquiry, prepare for a discovery call and, if you go ahead, scope and quote the work. The “diagnostic snapshot” shown at the end (an indicative readiness level and a few observations) is generated automatically in your browser from your answers, using simple rules. It is included with your submission so Will can see what you saw, but it is a starting point for conversation only and is not used to make decisions about you.

How it is delivered. When you submit the form, your answers are sent over an encrypted (HTTPS) connection to our website server, which emails them to Will’s business inbox using our hosting provider’s mail service. The form does not store your answers in a database. If the email cannot be sent, a copy of that submission is kept temporarily in a private, non-public folder on our hosting account so it is not lost, and is deleted once it has been dealt with. While you are filling in the form, your progress is saved in your browser’s session storage (on your device only) so you do not lose your answers if you reload the page; it is cleared when you submit or close the browser tab.

Retention. Enquiries that do not lead to an engagement are deleted within 24 months. If you become a client, your enquiry forms part of the engagement records described in Retention.

Providing information through the form is voluntary, but we need your name and email address to reply. You must tick the consent box to submit the form. You can ask us to delete your enquiry at any time.

5. How we use it

We collect, hold and use personal information for the primary purpose for which it was provided and for related purposes you would reasonably expect, including to:

• respond to your enquiries and communicate with you;
• scope, provide, manage and improve our services, workshops and content;
• prepare proposals, agreements and invoices, and manage payments and accounts;
• operate, secure, maintain and improve the website, including understanding how it is used;
• send you information you have asked to receive;
• meet our legal, tax, insurance and regulatory obligations; and
• establish, exercise or defend legal claims.

We do not sell personal information. We will only use or disclose your personal information for another purpose with your consent or where permitted or required by law.

6. Disclosure

We may disclose personal information to:

• service providers who help us run the business and website, such as web hosting, email and productivity, file storage, accounting, invoicing and payment providers;
• collaborators or subcontractors engaged to help deliver a project, where you or your organisation have agreed to their involvement;
• professional advisers such as accountants, lawyers and insurers;
• government authorities, regulators or law enforcement where required or authorised by law; and
• any other person with your consent.

Where we use third-party service providers, we take reasonable steps to ensure they handle personal information in a way that is consistent with the APPs.

AI tools

Because our work includes practical AI, we may use AI tools and services in delivering our services. We do not enter your personal information or confidential client information into third-party AI tools unless it is reasonably necessary for the work, you or your organisation have agreed, and we are satisfied the tool’s terms and settings provide appropriate protection (for example, that inputs are not used to train public models where that option is available).

7. Overseas disclosure

Some of our service providers store or process data outside Australia. In particular, our website hosting provider (GoDaddy) and many email, cloud storage, productivity, analytics and AI service providers operate infrastructure in the United States and may also use servers in other countries, including in Europe and Asia. As a result, personal information may be disclosed to, stored in or accessed from those countries.

Before disclosing personal information overseas, we take reasonable steps in the circumstances to ensure the overseas recipient does not breach the APPs in relation to that information, except where an exception under the Privacy Act applies (for example, where you consent after being informed that we will not take those steps).

8. Cookies and similar technologies

Cookies are small text files stored on your device by your browser. Similar technologies include local and session storage, pixels and scripts. We keep their use to a minimum, so the website does not show a cookie banner. This section explains what is used and how you can control it.

What	Purpose	How long
Diagnostic progress (bywill-dx-v1 in your browser’s session storage)	Saves your answers while you complete the Business Diagnostic, so they are not lost if you reload the page. It stays on your device and is not a cookie or sent to us until you choose to submit.	Cleared when you submit the form or close the tab
Hosting performance monitoring (set by our hosting provider, GoDaddy)	Our hosting provider automatically adds a performance-monitoring script to pages served from its platform. It may set cookies and collect technical information (such as page load timing, browser and device details, IP address and pages visited) to measure and improve website performance and hosting services. GoDaddy handles this information under its own privacy notice.	Set by GoDaddy

We do not use advertising, analytics or cross-site tracking cookies. If we add analytics in future, we will update this policy first. Embedded content and links to other websites (for example, LinkedIn or X) may set their own cookies when you visit or interact with them; those are governed by that third party’s policies.

Controlling cookies

You can block or delete cookies and site storage in your browser settings, usually under “Privacy”, “Cookies” or “Site data”. Most browsers also let you block third-party cookies, browse privately so storage is cleared when you close the window, or turn on “Do Not Track” and tracking protection. The website will still work if you block cookies. If you block session storage, the diagnostic will not remember your progress if you reload the page.

9. Storage and security

We hold personal information electronically using reputable cloud-based services and take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls, multi-factor authentication where available, encrypted connections (HTTPS) and limiting access to those who need it.

No method of transmission over the internet or electronic storage is completely secure. If we become aware of a data breach that is likely to result in serious harm to you, we will act promptly to contain and assess it and, where required by the Notifiable Data Breaches scheme, notify you and the Office of the Australian Information Commissioner (OAIC).

10. Retention

We keep personal information only for as long as it is needed for the purposes described in this policy, or as required by law. For example, business and financial records are generally kept for at least five years to meet Australian tax record-keeping obligations, and records of client engagements may be kept for up to seven years in case of a claim or dispute. General enquiries that do not lead to an engagement are typically deleted within 24 months. When personal information is no longer needed, we take reasonable steps to destroy or de-identify it.

11. Access and correction

You may ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Please make your request using the contact details in section 16. We may need to verify your identity before acting on a request.

We will respond within a reasonable period, generally within 30 days. We do not charge for making a request or correcting information, but may charge a reasonable fee for the cost of providing access where permitted. If we refuse access or correction, we will tell you why in writing (unless it would be unreasonable to do so) and how you can complain. If we decline to correct information, you may ask us to associate a statement with it noting that you believe it is inaccurate.

12. Anonymity and pseudonyms

You may browse the website without identifying yourself, and you may use a pseudonym when making a general enquiry. However, we will usually need your name and contact details to respond to you in detail or to provide services.

13. Direct marketing

We will only send you marketing communications (such as updates about services or new Journal articles) where you have asked to receive them or where otherwise permitted by the Privacy Act and the Spam Act 2003 (Cth). Every marketing email will include a simple way to unsubscribe, and you can opt out at any time.

14. Complaints

If you have a concern or complaint about how we have handled your personal information, please contact us first using the details in section 16 and give us a reasonable opportunity to respond. We will acknowledge your complaint promptly, investigate it and aim to give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

15. Changes to this policy

We may update this policy from time to time, for example if we change how we collect information or add new website features. The updated version will be published on this page with a new “last updated” date. Where changes are significant, we will take reasonable steps to let you know.

16. Contact

For privacy questions, access or correction requests, or complaints, please contact:

Will Fernandes (bywill.ai)
Brisbane, Queensland, Australia
Use the Business Diagnostic form on our homepage and write “Privacy request” in the final “Anything else” box. We will reply by your preferred contact method.