Privacy notice

Who we are

Bustlo provides marketing software to local businesses in Australia. The legal entity, ABN and postal address will be listed here before launch. Until then, contact us through the contact form.

What we collect

From business owners and their staff

• Account details: name, email address and a securely hashed password.
• Business information you give us or confirm: name, address, hours, offers, prices and website address.
• Photos you upload, and the permissions you grant for how each may be used.
• Your campaign settings, approvals and the history of what ran.

From people who enquire through a campaign page

• Name, one contact method (email or phone) and the details of the enquiry, such as a date or group size and a short message.
• Whether you chose to hear from that business again. This is a separate, unticked box and is never assumed from an enquiry.

From people who join a business’s list

• Your email (and first name, if you give it), what you agreed to, where and when. The list belongs to that business: we keep it on its behalf, use it only to send that business’s emails, and delete it 30 days after the business leaves. Every email has a one-click unsubscribe link, and unsubscribing is permanent unless you join again.

From people who get a voucher

• Nothing about you is needed. Your browser keeps a random code so it gets one voucher per offer per day; we store only a scrambled (hashed) form of it, tied to that one offer, and never use it to follow you. Clearing your browser’s site data removes it.
• The voucher’s code, when it was given out, and when staff redeemed it.

From anyone using our website

• Details you send us through the pilot or contact form.
• Security and abuse-prevention data: a one-way hash of your IP address, a rough browser category and request logs. Cloudflare Turnstile may check your browser to block automated spam.
• A count of visits to each campaign page. We don’t put advertising trackers on campaign pages.

How we use it

• To run the service: build campaigns, host campaign pages and deliver enquiries to the business.
• To send account and service emails, such as sign-in links and new-enquiry alerts.
• To keep the service secure and stop spam and abuse.
• To understand which features are used, through a limited, pre-approved list of product events.

We don’t sell personal information. Enquiry details are encrypted when stored and are visible only to the business they were sent to (and to us where needed for support or security).

AI

To draft ad copy, we send a business’s confirmed facts, short photo descriptions and the owner’s instructions to our AI provider (Anthropic). We don’t send photos themselves, and we don’t send enquiry details from customers.

Who helps us run the service

We use these providers to store, process or deliver data on our behalf:

• Neon: database hosting
• Render: application servers
• Cloudflare: website hosting, file storage and spam protection
• Resend: email delivery
• Anthropic: AI copywriting
• PostHog: product analytics (limited events, once switched on)

Some of these providers may store or process data outside Australia. Before launch we’ll list the regions we’ve chosen for each. We won’t claim your data stays in Australia unless we’ve confirmed it.

How long we keep it

Our proposed defaults, still to be confirmed:

• Closed enquiries: 90 days.
• Routine logs: 30 days.
• Rejected uploads: 24 hours. Temporary rendering files: deleted as soon as a render finishes.
• Campaign history: while your account is active.
• Minimal billing and audit records: as long as the law requires.

If a business closes its account, we pause its activity, take down its campaign pages and queue its data for deletion.

Your choices

You can ask to see, correct or delete personal information we hold about you. If you enquired with a business, you can also ask that business directly. We only send marketing emails to people who have opted in. To make a request or a complaint, use the contact form. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner.