Legal

Privacy Policy

Effective 17 October 2026

This Privacy Policy is effective from 17 October 2026. It explains how Speedrun AI Labs Pty Ltd (ABN 38 695 878 356) (Speedrun AI Labs, we, us and our) collects, holds, uses and discloses personal information, and how you can contact us about it. Please read it together with our Terms of Use and the Legal page.

1. Who we are and what this policy covers

Speedrun AI Labs is an Australian artificial intelligence lab based in Sydney, New South Wales. We build, deploy and support two AI agents for businesses: Anton, a cyber security agent, and Joseph, a compliance agent for financial-services regulated businesses (together, the Agents). We also publish practitioner research papers and free open-source skills.

This policy covers personal information we handle in connection with:

• our website at speedrunlab.ai and www.speedrunlab.ai (the Website), including the contact form;
• enquiries, sales conversations and our relationships with the businesses we work with and the people who represent them;
• the installation, deployment, configuration, integration, staff training, support and maintenance of the Agents for businesses (the Services), which we supply under a separate written agreement with each business (the Services Agreement);
• our dealings with suppliers, contractors, advisers and, if applicable, people who apply to work with us; and
• our business operations generally.

Personal information has the meaning given in the Privacy Act 1988 (Cth) (the Privacy Act): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it is true and whether or not it is recorded in a material form. Sensitive information is a subset of personal information that includes information about a person’s health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and biometric information.

The Privacy Act and the Australian Privacy Principles (APPs) in Schedule 1 to it regulate how many Australian organisations handle personal information. The Privacy Act does not apply to some small businesses. Whether or not it applies to us at a given time, we have chosen to handle personal information in accordance with the APPs as a matter of good practice, and this policy is written to meet the requirements that the APPs set for a privacy policy. Where the Privacy Act applies to us, we comply with it as a matter of law. We also comply with other Australian laws that govern personal information in our business, including the Spam Act 2003 (Cth) and the privacy-related provisions of the Telecommunications Act 1997 (Cth) and the Competition and Consumer Act 2010 (Cth).

This policy does not cover the privacy practices of the businesses that deploy our Agents, or of any third party, including the third-party AI model providers and platforms described in sections 10 and 11. Their own privacy policies govern how they handle personal information.

2. How our agents are deployed, and who is responsible for the data

This section describes the most important thing to understand about our Agents and personal information. It applies to every deployment of Anton or Joseph and is reflected in each Services Agreement.

2.1 Our role: we build, deploy and support the tool

We design and build the Agents, install or deploy them for a business, configure them to that business’s context, integrate them with the systems the business chooses, train the business’s staff and provide ongoing support and maintenance. The Agents are productivity tools. They are not licensed professionals and they do not replace the judgement of the people who use them.

2.2 The deploying business decides what the agent does with data, and is responsible for it

Each business that deploys an Agent (a Deploying Business) decides what data the Agent can access, how that data is collected, used, stored, retained and disclosed, and who within the business may use the Agent and its outputs. The Deploying Business is responsible for the data its Agent accesses, generates and processes (Business Data), including any personal information in it. In particular, the Deploying Business is responsible for:

• its own privacy policy, collection notices and the consents it obtains from its customers, staff and other people whose personal information its Agent may handle;
• having a lawful basis for the Agent to collect, use and disclose personal information in the way the business has configured it;
• its obligations under the Privacy Act and the APPs where they apply to it, including the Notifiable Data Breaches scheme in relation to Business Data;
• the rules of its sector and its licences, including (for financial-services businesses) obligations under its Australian financial services licence or Australian credit licence, its obligations to the Australian Securities and Investments Commission (ASIC), the Australian Prudential Regulation Authority (APRA) and the Australian Transaction Reports and Analysis Centre (AUSTRAC), and any outsourcing, operational-risk or information-security standards that apply to it;
• its choice of hardware, hosting environment, integrations, data sources and third-party AI model providers, and its acceptance of their terms;
• the security of its own premises, networks, devices and systems, and the access controls it places around the Agent;
• deciding how the Agent’s outputs are used in its decisions, and ensuring that a suitably qualified person reviews outputs before they are acted on; and
• telling its own people, in the way its own law and policies require, that it uses an AI agent and what that means for them.

2.3 We act only on the deploying business’s instructions

In relation to Business Data, we act only as a service provider acting on the instructions of the Deploying Business, as set out in the Services Agreement. We do not decide what Business Data is collected, why it is collected or what is done with it, and we do not use Business Data for our own purposes. Where an Agent runs on the Deploying Business’s own hardware or in its own environment, we do not store, transmit or have ongoing access to Business Data outside active support sessions, which are carried out with the Deploying Business’s permission as described in section 10. Where the Services Agreement provides for us to host or operate any part of a deployment, it sets out what we hold, where it is held, and the protections and access rules that apply. Where this policy and a Services Agreement deal with the same subject, the Services Agreement prevails as between us and that Deploying Business.

2.4 What we are responsible for

We are responsible for personal information we collect and hold for our own purposes: to run the Website, to respond to enquiries, to enter into and perform Services Agreements, to manage our relationships with the people who represent the businesses we work with, to deal with suppliers and advisers, and to run our business. The rest of this policy describes how we handle that information.

2.5 A note on the agents themselves

Each Agent is deployed and configured for a single Deploying Business. Anton is recommended to run on the Deploying Business’s own hardware on its premises where the business can accommodate that; it can also be set up in another way to suit the business, and depending on the configuration and the third-party services the business chooses, some data may leave the premises. Joseph can be deployed in a cloud environment or entirely inside the Deploying Business’s own environment, for the whole business or for a department. The deployment and hosting arrangement for each Agent, including whether any part of it is hosted or operated by us, is not fixed in advance: it depends on the Services Agreement and the discussion with each client, and the Services Agreement records the arrangement. In every case the Deploying Business decides what data the Agent can access and is responsible for it, and the recorded arrangement determines where Business Data is held and which third parties (if any) process it.

3. The kinds of personal information we collect

We collect only the personal information that is reasonably necessary for our functions and activities. The kinds of personal information we collect depend on how you deal with us.

3.1 Website visitors

When you visit the Website, our hosting provider’s servers automatically record technical information about each request, including your IP address, the type and version of your browser and operating system (your user agent), the pages and files requested, the date and time of the request, and the referring page if your browser sends one. We do not use advertising or analytics cookies and we do not build profiles of visitors. See section 9.

3.2 People who use the contact form or email us

When you send us a message through the contact form, we collect your name, your email address, the subject of your message if you give one, your telephone number if you give one, the content of your message and the date and time you submitted it (recorded in Sydney time). To block spam, the form runs a Cloudflare Turnstile check that receives your IP address and technical information about your browser; see section 9. Our own function logs record whether a submission was accepted or rejected and why, together with a masked form of your email address (the first few characters and the domain), not the full address. If you email us directly, we receive your email address, anything you include in the message and the technical information attached to the email.

3.3 Enquirers and prospective customers

If you enquire about our Agents on behalf of a business, we may collect your name, job title, employer, work contact details, the nature of your enquiry, information about your business’s needs, systems and regulatory context that you choose to share with us, notes of our conversations and meetings, and the history of our dealings with you.

3.4 Business customers and the people who represent them

When a business engages us, we collect personal information about the people who deal with us on its behalf: directors, officers and signatories; the people who sponsor and manage the engagement; the technical staff who work with us on installation, configuration and integration; the staff we train; and the people we deal with for billing. This includes names, roles, work contact details, records of training attendance, the access credentials the business issues to us for support (see section 10), communications about the engagement, and records of the support we provide. Where a business asks us to configure an Agent to send reports to named people, we hold those people’s names and work contact details as part of the configuration.

3.5 Support sessions

During a support session we may see personal information held in the Deploying Business’s systems. We do not collect or retain that information for our own purposes. Our record of a support session describes the work we did, not the content of the data we saw. See section 10.

3.6 Suppliers, contractors and advisers

We collect the names, contact details, bank account details, ABNs and other business information of the people and organisations that supply goods or services to us, and the content of our communications with them.

3.7 Job applicants

If you apply to work with us, we collect the information in your application and any supporting documents, including your name, contact details, work history, qualifications, referees and the results of any interviews or assessments. We may collect information about you from your referees and from publicly available professional sources, and we may be required to verify your right to work in Australia.

3.8 Social media, GitHub and other platforms

If you interact with us on LinkedIn or GitHub, or on another platform we use, we may collect your public profile information and the content of your interaction. Those platforms handle your information under their own privacy policies, which we do not control.

3.9 Sensitive information

We do not ask for sensitive information and we do not need it to deal with you. If you choose to include sensitive information in a message to us, or we see it in the course of a support session, we handle it in accordance with this policy and the APPs, we use it only for the purpose for which it was given, and we will not collect or keep it unless that is necessary. We do not adopt, use or disclose government-related identifiers such as tax file numbers, Medicare numbers or driver licence numbers as our own identifiers.

4. How we collect personal information

We collect personal information:

• directly from you, when you use the contact form, email us, book or attend a call or meeting, speak with us by telephone, attend training, sign a Services Agreement, pay an invoice, apply for a role, or otherwise deal with us;
• automatically, when you visit the Website, as described in sections 3.1 and 9;
• from the business you represent, when it gives us your details as a contact for an enquiry, an engagement, training or support;
• from third parties, including referrers who introduce you to us, publicly available sources such as professional networking sites and company registers, and, for job applicants, referees and verification services; and
• in the course of providing the Services, where personal information in a Deploying Business’s systems becomes visible to us during a support session.

Where it is reasonable and practicable, we collect personal information about you only from you. If we collect it from someone else, we take reasonable steps to make sure you are aware of the matters in this policy. If we receive personal information we did not ask for and could not have collected under the APPs, we will destroy or de-identify it as soon as practicable if it is lawful and reasonable to do so.

5. Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for the purposes for which it was collected and for related purposes you would reasonably expect. Those purposes are:

• to respond to your enquiry and to talk with you about our Agents, our research and our work;
• to assess whether we can help a business, to prepare proposals and to enter into Services Agreements;
• to perform Services Agreements, including installing, deploying, configuring and integrating an Agent, training staff, providing support and maintenance, and configuring reports to the people the business names;
• to manage our relationship with you and the business you represent, including scheduling, correspondence, invoicing, payment and record keeping;
• to send you information about our Agents, research, events and other matters we think may interest you, where the law allows (see section 6);
• to operate, secure and improve the Website, including detecting and blocking spam, bots and abuse of the contact form;
• to protect our rights, property and safety and those of our customers and others, including investigating and responding to security incidents, fraud and misuse;
• to deal with suppliers, contractors and advisers;
• to consider and process job applications;
• to comply with our legal obligations, including tax, corporations, record-keeping and anti-money-laundering laws where they apply, and to respond to lawful requests from regulators, courts and law enforcement;
• to establish, exercise or defend legal claims, and to obtain professional advice; and
• any other purpose you consent to, or that is required or authorised by or under Australian law.

We do not sell personal information. We do not use personal information collected through the Website or in our business to train or improve any AI model, and we do not use Business Data for that purpose either (see section 10).

6. Direct marketing

We may send you information about our Agents, research papers, skills, events and services by email or other electronic means if you have enquired about or used our services, or you have otherwise asked us or consented to receive it, and you would reasonably expect us to contact you. We may contact representatives of businesses at their work addresses about matters relevant to their role, where that is permitted by the Spam Act 2003 (Cth) and the APPs.

Every commercial electronic message we send identifies us as the sender, includes our contact details and includes a simple way to opt out, for example an unsubscribe link or a reply to the sender. You can opt out at any time by using that mechanism or by emailing info@speedrunlab.ai, and we will give effect to your request promptly and at no charge. If you have opted out, we will not send you further marketing, although we may still send you messages that are necessary to deal with you or the business you represent, such as responses to your enquiries, service notices and invoices.

We do not buy marketing lists, we do not sell or rent our contact lists, and we do not disclose your personal information to other organisations for their marketing. We do not use sensitive information for direct marketing. If you ask, we will tell you where we obtained your personal information for direct marketing, if we are able to.

7. Who we disclose personal information to

We disclose personal information only where it is necessary for the purposes in section 5, where you consent, or where the law requires or allows. We disclose personal information to:

• service providers who help us run the Website and our business, including our website host (currently Vercel), the provider of the spam check on our contact form (currently Cloudflare Turnstile), the provider that delivers contact form messages to our inbox (currently Resend), and the providers of our email, calendar, video-conferencing, document storage, accounting, invoicing, payment and customer relationship tools. We disclose to each provider only what it needs to perform its service for us, and we require providers to protect the information and use it only for that purpose;
• professional advisers, including our lawyers, accountants, auditors and insurers, under duties of confidentiality;
• banks and payment providers, to make and receive payments;
• the business you represent, for example to confirm who attended training or who holds a support role;
• regulators, courts, law enforcement and government bodies, where we are required or authorised to do so by law, by a court or tribunal order, or where we reasonably believe disclosure is necessary to prevent or report unlawful activity or a serious threat to a person’s life, health or safety;
• a purchaser or prospective purchaser of our business or its assets, and their advisers, under confidentiality obligations, in connection with a sale, merger or restructure; and
• anyone else you authorise us to disclose it to.

We do not disclose Business Data to anyone for our own purposes. Where the Services Agreement provides for us to host or operate any part of a deployment, any hosting or infrastructure provider we use for that purpose is identified in the Services Agreement. Where an Agent discloses Business Data to a third party, for example a third-party AI model provider or an integrated system, it does so because the Deploying Business has configured it to, and the Deploying Business is the discloser.

8. Overseas disclosure

Some of our service providers store or process information outside Australia. In particular, Vercel, Cloudflare and Resend operate in the United States and may process information in the United States and in other countries where they or their sub-processors have infrastructure. Some of the other tools we use for email, documents, meetings and accounting may also store information in the United States or elsewhere. We will update this policy if the countries that are likely to be involved change materially.

Before we disclose personal information to an overseas recipient, we take reasonable steps to make sure the recipient handles it in a way that is consistent with the APPs, for example by choosing reputable providers that publish their security and privacy practices and by relying on their contractual commitments to us. Where we do not take those steps, we will tell you before the disclosure and ask for your consent, or the disclosure will be one that the Privacy Act permits.

Where an Agent sends Business Data to a third-party AI model provider or another service outside Australia, that is a disclosure by the Deploying Business under its own configuration and its own arrangements with that provider. The Deploying Business is responsible for deciding whether that overseas disclosure is permitted under the laws and standards that apply to it. If the Services Agreement provides for us to host or operate any part of a deployment, the Services Agreement identifies where that part is hosted, including any location outside Australia.

9. Cookies, logs and similar technologies

No advertising or analytics cookies. The Website does not use advertising, tracking or analytics cookies, and we do not use third-party trackers or social media pixels. We do not need to show you a cookie banner because we do not set cookies for those purposes.

Self-hosted fonts. The typefaces on the Website are served from our own domain, so your browser does not request them from a third-party font service.

Cloudflare Turnstile. When you open the contact form, Cloudflare Turnstile runs in your browser to tell people from bots without a puzzle. As part of that check Cloudflare receives your IP address and technical information about your browser and device, and it may use browser storage or similar technology to complete the check. Cloudflare’s privacy policy describes how it handles that information. If you do not want Turnstile to run, do not use the contact form; you can email us instead.

Server logs. Our hosting provider records technical information about each request to the Website, as described in section 3.1, in logs that it keeps for a limited period for security, performance and troubleshooting. Our contact form handler writes short log lines that record whether a submission was accepted or rejected, the reason for a rejection, and a masked form of the sender’s email address. We use these logs to keep the Website and the contact form working and secure, and to investigate abuse.

Links to other sites. The Website links to third-party sites, including GitHub, SSRN, LinkedIn and news publishers. Those sites may set their own cookies and collect information under their own policies when you visit them.

10. Agent data: what we do and do not do

This section describes in more detail how we handle Business Data when we supply the Services. It supplements section 2 and is subject to the Services Agreement with each Deploying Business.

10.1 Where the data lives

Business Data lives in the environment recorded in the Services Agreement: the Deploying Business’s own hardware on its premises, a cloud environment, or another configuration agreed with the business. Whether any part of a deployment is hosted or operated by us depends on the Services Agreement and the discussion with each client. Where an Agent runs on the Deploying Business’s own hardware or inside its own environment, Business Data stays under the Deploying Business’s control and we do not hold a copy. Where the Services Agreement provides for us to host or operate any part of a deployment, the Services Agreement sets out what we hold, where it is held, who may access it, and the protections and access rules that apply; the Deploying Business still decides what data the Agent can access and remains responsible for it.

10.2 Our access to Business Data

Where an Agent runs on the Deploying Business’s own hardware or in its own environment, we do not store, transmit or have ongoing access to Business Data, and our access is limited to active support sessions and to any specific access the Services Agreement describes. Where the Services Agreement provides for us to host or operate any part of a deployment, our access is limited to what the Services Agreement sets out. If a particular deployment requires us to receive technical operating information from the Agent in order to maintain it (for example, version or error information), the Services Agreement will say what is sent and why, and that information will not include Business Data.

10.3 Support sessions

Where an Agent runs in the Deploying Business’s environment, we provide support through secure remote access or supervised sessions, at the Deploying Business’s request and with its permission. The Deploying Business controls when a session starts and ends and what we can see. We ask Deploying Businesses to issue us named, least-privilege accounts for support rather than sharing a staff member’s personal credentials, and to revoke access when it is no longer needed. During a session we may see personal information in the business’s systems. We do not copy, extract or retain it, and our record of the session describes the work done rather than the content we saw. We keep the record for the period described in section 13.

10.4 No training on your data

We do not use Business Data, or any other client data, to train, fine-tune or improve any AI model. Our methodology improves through our own work and research, not through the data of the businesses we serve.

10.5 What the agent does with data is set by the deploying business

What an Agent reads, writes, stores and sends is determined by how the Deploying Business has asked us to configure it and by the integrations the Deploying Business has chosen. For example, Anton reviews the code and infrastructure the Deploying Business points it at and reports to the people the business names; Joseph monitors the obligations and sources the Deploying Business selects and reports changes to the people accountable within the business. In each case the Deploying Business decides the scope, the data sources, the recipients of reports and the retention of the Agent’s outputs.

10.6 Outputs belong to the deploying business

The outputs an Agent generates for a Deploying Business belong to that business. Outputs can be incorrect or incomplete, and their quality depends on the quality, completeness and currency of the data, systems and instructions the Deploying Business gives the Agent. Outputs must be reviewed by a suitably qualified person before they are acted on. The Deploying Business decides how outputs are used and whether they are retained.

10.7 When a services agreement ends

When a Services Agreement ends, the Deploying Business keeps its hardware and its Business Data. We deactivate our proprietary skills and configurations, revoke any remote access we hold, delete any credentials the business issued to us and, where we have hosted or operated any part of the deployment, return or delete the Business Data we hold as the Services Agreement provides. We retain only the records of the engagement we need for our own legal, accounting and record-keeping purposes, as described in section 13.

10.8 What we ask of deploying businesses

Because the Deploying Business controls Business Data, we rely on it to configure the Agent lawfully, to give the Agent access only to the data it needs, to tell its own people what it is doing with an AI agent, to obtain any consents its law requires, to secure its environment, and to review outputs before acting on them. We also rely on it to assess, before deployment, whether an Agent and the chosen deployment model are suitable for the sensitivity of the data involved. Highly sensitive data may call for a deployment that keeps everything inside the Deploying Business’s own environment, and we will say so during scoping. Where Business Data lives on the Deploying Business’s hardware or in its environment, backing up and recovering it are the Deploying Business’s responsibility; where we host or operate any part of a deployment, the Services Agreement sets out who is responsible for backups. We provide guidance on these matters during deployment and training. The Deploying Business remains responsible for its own decisions.

11. Third-party AI model providers and other platforms

Our Agents rely on open-source components and on third-party platforms, large-language-model providers and application programming interfaces (APIs). The Deploying Business chooses the providers its Agent uses, and in most deployments the Agent accesses those providers through the Deploying Business’s own API keys or accounts. That means the Deploying Business has a direct commercial relationship with each provider and is bound by that provider’s terms, privacy policy, data-processing terms and acceptable use policy. Those terms govern how the provider handles any Business Data the Agent sends to it, including whether the provider retains it, where it processes it and whether it uses it to improve its own services. Some providers offer settings or agreements that limit retention or exclude training, and we recommend that Deploying Businesses use them where available. Where a deployment is configured to use models hosted inside the Deploying Business’s own environment, the Agent does not send Business Data to an external model provider; the Services Agreement records which configuration applies.

We do not control those providers, we are not a party to the Deploying Business’s agreements with them, and we do not receive Business Data from them. The Deploying Business is responsible for choosing providers that are suitable for the data involved and for its regulatory obligations, and for monitoring changes to their terms. Where an Agent integrates with other systems the Deploying Business uses, such as customer relationship, accounting, email, calendar, messaging or file-storage systems, those systems are the Deploying Business’s own, and the data stays within the Deploying Business’s arrangements with those vendors.

12. How we protect personal information

We take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification and disclosure. Those steps are proportionate to the sensitivity of the information and the harm that could result, and they include:

• using reputable providers for hosting, email and business tools, and configuring them securely;
• serving the Website over HTTPS with security headers, and running the contact form through server-side checks that reject invalid, automated and abusive submissions before any message is sent;
• keeping the personal information we hold to a minimum, including masking email addresses in our own logs;
• controlling access to our systems and accounts, including multi-factor authentication where available, and limiting access to the people who need it;
• using secure, permissioned remote access for support, and never retaining Business Data from support sessions;
• keeping software up to date and applying the security practices we recommend to the businesses we work with; and
• training the people who work with us on their privacy and security obligations.

No method of transmission over the internet or of electronic storage is completely secure. We cannot guarantee the security of information you send to us over the internet, and you do so at your own risk. Please do not send us passwords, access keys, card numbers or other secrets through the contact form or by email; if we need to exchange credentials with a Deploying Business we will agree a secure method.

13. Retention and destruction

We keep personal information only for as long as it is needed for the purposes for which it was collected, for a related purpose, or as required by law, and then we take reasonable steps to destroy it or to de-identify it. As a guide:

• Contact form messages and enquiries are kept while we respond to and follow up your enquiry and for a reasonable period afterwards in case you contact us again or the enquiry leads to an engagement. If it does not, we delete or de-identify the record once it is no longer needed.
• Engagement records, including Services Agreements, correspondence, invoices, payment records and records of training and support, are kept for the life of the engagement and for at least seven years afterwards, because Australian corporations and tax laws require us to keep financial and business records for that period.
• Access credentials a Deploying Business issues to us are deleted when the engagement or the relevant support arrangement ends, and sooner on request.
• Website server logs are kept by our hosting provider for a limited period that it sets, and our contact form handler’s log lines are kept for a similarly short period.
• Job applications are kept for the recruitment process and for a reasonable period afterwards, so that we can consider you for later roles if you agree and respond to any questions about the process, and are then deleted.
• Marketing contact details are kept until you opt out or the information becomes stale, after which we delete or suppress them.

We may keep information for longer where we reasonably need it to resolve a dispute, to comply with a legal obligation, to respond to a regulator or because it is part of a record we are required to keep. When we destroy information, we do so securely.

14. Data breaches

14.1 Our own data

If personal information we hold is lost, or accessed or disclosed without authorisation, we will act promptly to contain the incident, assess it and reduce the risk of harm. Where the Privacy Act applies to us and the incident is an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act (that is, a reasonable person would conclude that the incident is likely to result in serious harm to one or more individuals and we have not been able to prevent that risk with remedial action), we will notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals as the scheme requires. Whether or not the scheme applies to us, if we believe an incident is likely to cause you serious harm we will tell you what happened, what information was involved and what you can do about it.

14.2 Business Data

The Deploying Business controls Business Data, and it is the Deploying Business that must assess an incident affecting Business Data and decide whether, how and to whom to notify under the Privacy Act, its sector rules and its own policies. If we become aware of a security incident involving Business Data that arises from our systems, our access or our conduct, we will notify the Deploying Business without undue delay, give it the information we have, and cooperate with its assessment, containment and notification. Where both we and a Deploying Business hold the same personal information and an eligible data breach occurs, the Privacy Act allows one of us to notify on behalf of both; the Services Agreement describes how we will coordinate.

15. Access and correction

You may ask us for access to the personal information we hold about you, and you may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, email info@speedrunlab.ai. We will need to verify your identity before we give access or make a correction, and we may ask you to clarify what you are looking for.

We will respond within a reasonable period, and in any event within 30 days. We do not charge for making a request. If giving access would involve significant work, we may charge a reasonable amount that reflects our costs, and we will tell you before we incur them. There are some situations in which the Privacy Act allows or requires us to refuse access or correction, for example where giving access would unreasonably affect someone else’s privacy, would prejudice legal proceedings or would be unlawful. If we refuse, we will tell you why in writing, unless it would be unreasonable to do so, and we will tell you how you can complain. If we refuse to correct information, you may ask us to attach a statement to it saying that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading, and we will take reasonable steps to do so.

If your request concerns personal information that an Agent handles for a Deploying Business, we will direct you to that business, because it controls the information and is responsible for responding to requests about it. Where the Deploying Business asks for our help to respond to your request, we will provide it under the Services Agreement.

16. Anonymity and pseudonymity

You may read the Website and our research papers, and download our open-source skills from GitHub, without identifying yourself. You may contact us anonymously or using a pseudonym if you wish, for example to report a security vulnerability. However, if you do not give us your name or a way to reach you, we may not be able to respond, to enter into an agreement with you or to provide the Services. Where the law requires us to deal with an identified individual, or it is impracticable for us to deal with you anonymously or by pseudonym, we will tell you.

17. Children

The Website and our Services are directed to businesses and to adults. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, please contact us and we will delete it.

18. Automated decision-making

We do not use personal information in computer programs to make decisions that could reasonably be expected to significantly affect your rights or interests, and we do not use the Website or our Agents to profile individuals. Our Agents produce information for people in a Deploying Business to review and act on. Whether a Deploying Business uses an Agent’s outputs in a decision that affects an individual, and how it tells people about that, is a matter for the Deploying Business, its own privacy policy and the law that applies to it. We will update this section if our practices change.

19. If you are outside Australia

This policy is governed by Australian law. We supply our Services to businesses in Australia. If you read this policy from the United Kingdom, the European Economic Area or another place whose data-protection law uses the terms controller and processor, you may find it helpful to know that, in relation to Business Data, the Deploying Business will ordinarily be the controller and we will act as its processor on its documented instructions, and that in relation to the information described in section 2.4 we act as a controller. Those laws, where they apply, operate alongside and do not displace the arrangement described in this policy. If you believe such a law gives you rights in relation to information we hold, please contact us and we will consider your request.

20. Complaints

If you are concerned about how we have handled your personal information, or you believe we have breached the APPs or this policy, please contact us first at info@speedrunlab.ai with the word Privacy in the subject line and tell us what happened. We will acknowledge your complaint promptly, investigate it, and respond in writing, normally within 30 days. If we need more time we will tell you why and when you can expect a response. We take complaints seriously and we will tell you what we have done or propose to do to put things right.

If you are not satisfied with our response, or you prefer not to raise the matter with us, you may complain to the Office of the Australian Information Commissioner. The OAIC can be contacted through its website at oaic.gov.au, by telephone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001. The OAIC generally expects you to have complained to us first and given us a reasonable time to respond.

If your complaint concerns the way a Deploying Business or its Agent has handled your personal information, you should raise it with that business, which controls the information and is responsible for responding. We will cooperate with the business as the Services Agreement requires.

21. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our Services, our service providers or the law. The effective date at the top of the page shows when it last changed. If a change is material, for example a change in the kinds of information we collect or the purposes we use it for, we will take reasonable steps to bring it to the attention of the people it affects, which may include a notice on the Website or an email to the businesses we work with. The current version of this policy applies to all personal information we hold.

22. How to contact us

Speedrun AI Labs Pty Ltd (ABN 38 695 878 356), Cronulla, New South Wales 2230, Australia. Email: info@speedrunlab.ai. Please use this address for privacy questions, access and correction requests, opt-out requests and complaints. If you would like to speak with someone, email us and we will arrange a time.