Privacy Policy

nirmāṇa is a business name of Aakash Mehta, a sole trader (ABN 32 805 295 159) based in Sydney, Australia ("Nirmana", "we", "us"). We also hold ABN 17 355 446 904. We design and build websites, software, automation and AI systems for businesses.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and this policy explains how.

We handle personal information in two different roles:

• As a business in our own right — when you visit our website, contact us, become a client, or work with us. This policy fully applies.
• As a service provider for our clients — when we build, host or run a website, app, email service or automation for a client, and that system holds information about the client's own customers. In that role we act on the client's instructions. Section 9 explains how this works, and the client's own privacy policy also applies.

We don't intentionally collect sensitive information (such as health, racial or political information) about you. If a client project requires it, we only handle it under a written agreement with that client and with the safeguards that information needs.

We never collect your full card details — payments are processed by Stripe, and we see only a summary (e.g. card type and last four digits).

Mostly directly from you — through our contact form, by email or phone, in meetings, and when you sign an agreement with us. Some technical data is collected automatically as you use our website (see section 10). We may receive your details from someone who refers you to us, or from public sources such as your business website or the ABN Lookup.

If you'd rather not give us certain information, we may not be able to answer your enquiry or deliver the work.

• To reply to your enquiry and give you a quote
• To deliver, host, support and maintain the work you engage us for
• To invoice you, take payment and keep business and tax records
• To keep our systems and our clients' systems secure, and to detect misuse
• To improve our website and services, using aggregate information
• To send you service messages and, if you agree, occasional updates (see section 11)
• To meet our legal obligations and to protect our legal rights

We don't use your information for any other purpose unless you would reasonably expect it, you agree, or the law permits it.

We never sell or rent personal information. We share it only with trusted providers who help us run the business, under contracts that require them to protect it:

We may also disclose information to our professional advisers (such as our accountant or lawyer), to a buyer if the business is sold, or where the law requires it.

Some providers in section 6 store or process information outside Australia — mainly in the United States, and in Japan for email delivery. Before using an overseas provider, we take reasonable steps to make sure it protects information in a way consistent with the APPs, through its contract terms and security commitments.

For client work we host in our own accounts, we use the Australian (Sydney) region by default wherever the provider offers one.

We use AI tools, including large language models, to help draft content, write code and power the automations we build. We do not use your personal information to train AI models, and we choose providers whose business terms say they don't train on our data.

Decisions about you. Nirmana does not make decisions about individuals solely by computer program. We don't use automated tools to make decisions that could significantly affect your rights or interests — such as whether to take you on as a client or what to charge you. A person makes those decisions.

In systems we build for clients. Some automations we build use software to sort, summarise or route information (for example, triaging enquiries). The client decides how those systems are used and is responsible for any decisions they make with them. If you're a client's customer and want to know how a decision about you was made, please contact that business.

When we host or run a system for a client, the personal information in it belongs to the client. We:

• use it only to provide, support and secure that client's service, as our agreement allows
• don't look at it except where needed to build, fix or support the service
• keep each client's data separated from other clients'
• tell the client without undue delay if we become aware of a data breach affecting it
• return or delete it when the engagement ends, as agreed with the client

If you're a customer of one of our clients and want to access, correct or ask about your information, please contact that business first — we'll help them respond.

Our website doesn't set advertising or tracking cookies, and we don't use tracking pixels or cross-site tracking. Our hosting provider records aggregate visitor statistics — pages viewed, country, device type, referring site — and technical error reports that help us fix problems. Neither is used to identify you. Our fonts are served by Google Fonts, which means your browser sends your IP address to Google when a page loads.

You can block or delete cookies in your browser settings; the site will still work.

We only send marketing emails if you've asked for them or we already work together. Every message has an easy way to unsubscribe, and we comply with the Spam Act 2003 (Cth). Service messages about your project or account aren't marketing and will still be sent.

You can browse our website and ask general questions without telling us who you are. To give you a quote or do work for you, we'll need your name and contact details.

We store information with the providers listed in section 6 and protect it with the measures described on our Security page, including encryption, multi-factor sign-in and least-privilege access.

We keep information only as long as we need it:

• Enquiries that don't become work — up to 2 years from our last contact
• Client records, contracts and invoices — 7 years after the engagement ends, to meet tax and legal requirements
• Client systems we host — for the life of the engagement, then returned or deleted as agreed

When we no longer need information, we delete it or de-identify it.

If we become aware of a data breach that is likely to cause serious harm, we will contain it, assess it promptly, and notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. For client systems, we notify the client so they can meet their own obligations.

You can ask to see the personal information we hold about you, or ask us to correct it. Email enquiries@nirmana.com.au. We'll verify your identity, respond within 30 days, and won't charge you to make the request. If we refuse, we'll tell you why in writing and how to complain.

If you think we've mishandled your information, email enquiries@nirmana.com.au with the subject "Privacy complaint". We'll acknowledge it within 5 business days and aim to resolve it within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au · 1300 363 992.

Our services are for businesses. We don't knowingly collect information from anyone under 18 through our website.

We'll update this policy when our practices or the law change, and post the new version here with its effective date. Material changes affecting clients will also be emailed to them.

Aakash Mehta, Privacy Officer · nirmāṇa
enquiries@nirmana.com.au · +61 493 417 623
[Postal address]