Privacy notice · 12 October 2026 · Analytics update 15 October 2026

Privacy

This notice explains how NAVE handles website enquiries, direct email and fit-call information. It uses Australian Privacy Principles 5 and 11 as a best-practice baseline. It does not state that NAVE is legally bound by the Privacy Act or exempt from it. That legal position has not been determined. The optional website analytics section describes current website measurement.

1. Who is responsible

The website uses the brand NAVE, ABN 70 748 581 215. Thomas Specht is the response owner and privacy contact at Thomas@nave-ai.com.au. There is no backup response owner at launch.

2. What the enquiry form collects

The form collects your name, business email, company, optional phone, enquiry type, one high-level message, and a separate optional marketing choice. It also uses a random retry key and a keyed, short-lived source-IP fingerprint for duplicate and abuse protection. Raw source IP addresses are not stored in NAVE's enquiry database or application logs.

Do not send passwords, access keys, sensitive personal information, or confidential client or employee records through a general enquiry.

3. Why NAVE uses enquiry information

• To assess and respond to your enquiry.
• To provide a truthful acknowledgement after the email provider accepts both the owner notification and visitor acknowledgement.
• To prevent abuse, suppress duplicate submissions and investigate delivery failures.
• To move only necessary information into a separately governed client record if the enquiry becomes an active client matter.

Submitting an enquiry does not create a booking, quote, contract, service commitment or marketing subscription. Thomas aims to provide a first response within 2 business days.

4. Providers, disclosures and overseas processing

The form uses Cloudflare Workers to receive and validate the submission and Cloudflare D1 to store the enquiry temporarily. Resend processes the owner notification and visitor acknowledgement emails. NAVE discloses the minimum necessary information to these providers so they can provide those services.

Cloudflare is a global provider and says it may transfer and access personal information internationally. The D1 database has an Oceania location hint, but Cloudflare states that a location hint is not a data-residency guarantee. Resend states that its primary processing takes place in the United States. Information is therefore likely to be processed outside Australia.

5. Fit calls and direct email

The 30-minute fit-call route uses managed Cal.com, Google Calendar and Google Meet. Those providers receive the details needed to schedule and operate the call under their own terms and privacy notices. Fit-call outcomes remain separate from form enquiries. NAVE may record a non-identifying operational outcome manually, but personal details must not be written to the git vault.

If you email Thomas directly, your email provider and NAVE's email provider process the message. The 90-day D1 deletion schedule described below applies to the website enquiry database, not automatically to independent mailbox, calendar, accounting or client records.

6. Security

The form limits fields, rejects unexpected data, uses HTTPS, strict browser-origin checks, server-side validation, rate limiting, idempotency controls and provider keys held only as Cloudflare secrets. NAVE does not intentionally write enquiry content or raw IP addresses to application logs. Access is limited to the response owner and authorised service providers.

No internet transmission or storage system can be guaranteed completely secure. If a security incident affects enquiry information, NAVE will assess it and respond under the obligations that apply.

7. Retention and deletion

NAVE retains D1 enquiry records for up to 90 days. A scheduled cleanup deletes a record after its purge date unless the enquiry becomes an active client matter. If that happens, only information necessary for the matter moves into the separately governed client record and follows that record's retention requirements.

Short-lived abuse-prevention fingerprints are scheduled for deletion after 48 hours. Provider and infrastructure records may follow the provider's own retention settings.

8. Marketing remains separate

An enquiry does not subscribe anyone to marketing. The optional unticked choice is recorded with the enquiry only; this release contains no marketing-list subscription or promotional-send workflow. Any future marketing process requires separate review, consent records, sender identification and a functional unsubscribe route.

9. Access, correction, deletion and complaints

To ask what enquiry information NAVE holds about you, request correction or deletion, or make a privacy complaint, email Thomas Specht at Thomas@nave-ai.com.au. NAVE will verify the request before disclosing or changing information and explain if information must be retained for a legal, accounting, dispute or security reason.

10. Best-practice reference points

NAVE uses the following official guidance as a best-practice baseline:

• OAIC small-business privacy guidance, including that most small businesses are not covered by the Privacy Act but some are.
• OAIC APP 5 guidance on notifying people about personal-information collection.
• OAIC APP 11 guidance on security and destroying or de-identifying information that is no longer needed.
• ACMA Spam Act guidance on consent, sender identification and unsubscribe facilities for commercial messages.

11. Review and version

Enquiry privacy version: enquiry-privacy-2026-10-11-v1. NAVE reviews this notice whenever the fields, purposes, providers, overseas processing, retention, security controls, response process or legal position changes.