Privacy policy
Last updated 2 October 2026
This explains what Systemly does with personal information — both yours as a customer, and the information about other people that you store in the platform.
1. Who we are
Systemly is operated by Lucas William Brown, trading as Systemly (ABN 41 165 831 752) (“Systemly”, “we”, “us”), and provides a customer relationship management and marketing platform. We are based in Perth, Western Australia, and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This policy covers the Systemly service at app.systemly.com.au and everything we do with information handled through it.
2. Two different roles
This distinction matters, so it comes first rather than buried in a schedule.
Your own information
When you sign up, we decide how your account information is handled. We are the controller of it, and this policy governs it.
Information you put into the platform
Your contacts, their messages, their bookings and their payment records belong to you. You decide what to collect and why; we process it on your instructions in order to run the service. We do not sell it, mine it, or use it to train machine-learning models. If you are an agency, the same relationship runs through you to each of your clients.
You are responsible for having a lawful basis to collect and store the information you put into Systemly, and for telling those people about it. The data processing agreement sets out the terms on which we process it for you.
3. What we collect
| Category | Examples | Why |
|---|---|---|
| Account | Name, email address, hashed password, timezone, avatar, and a phone number if you verify one | To create and secure your account, and to send verification codes |
| Agreement | Which version of the terms you accepted and when, and when you confirmed you meet the minimum age | To show what you agreed to |
| Organisation | Business name, branding, workspace names, team membership | To run your workspaces and decide who can see what |
| Customer records | Whatever you store: contacts, companies, notes, deals, messages, bookings | To provide the service to you |
| Connected accounts | Encrypted API keys and OAuth tokens for the providers you connect | To send email and SMS, publish posts and take payments on your behalf |
| Technical | IP address, browser type, session records, and a record of each change the AI assistant makes | Security, abuse prevention, and showing you who did what |
| Billing | Plan, invoices, and usage counts where applicable | To bill you correctly |
We do not use advertising trackers. When product analytics is enabled, PostHog measures page views and interactions and uses browser storage to recognise repeat visits. Session replay and heatmaps are limited to the public homepage; form inputs and page text are masked, and URL query strings are removed from analytics events. The cookie policy lists every cookie we set.
When something breaks, Sentry receives a report of the fault: the error, where in the code it happened, the page or task involved, and your browser type. We remove what you typed before the report is sent, including form contents, messages, passwords, access tokens, email addresses and phone numbers, and we do not send your IP address or record your screen.
4. Artificial intelligence
Systemly includes an AI assistant, and this is worth being specific about.
- The assistant only runs when you ask it to, or on a schedule you set up, using the AI AI usage included in your plan or an API key you supply from OpenAI, Anthropic, OpenRouter or Google.
- When it runs, the content of your request and whatever workspace data is needed to answer it is sent to that provider. Their terms then apply to that transmission.
- We do not train any model on your data. The providers we use for the included usage do not use API requests to train their models under their terms, and we do not opt in to sharing data for training.
- The assistant can only reach data the person using it is already allowed to reach, and every change it makes is recorded against that person.
- If you connect your own AI agent over the Model Context Protocol, that agent acts with the permissions of the API key you issued it, and you are responsible for what you connect.
5. Who else touches your data
We use a small number of service providers to run the platform. They only receive what they need, and they may not use it for their own purposes.
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, and storage for uploaded files and images | United States |
| Neon Inc. | Database hosting, where workspace records are stored | United States |
| Fly.io, Inc. | Background processing: automations, scheduled posts, message delivery and webhooks | United States |
| Resend (Plus Five Five, Inc.) | Sending account email, and email sent from domains we set up for you | United States |
| Twilio Inc. | Phone verification codes, and SMS on numbers we provision for you | United States |
| Stripe, Inc. and Stripe Payments Australia Pty Ltd | Subscription billing and AI credit purchases | United States / Australia |
| OpenRouter, Inc. | AI features on the included usage, routing each request to the model provider that serves itWhen AI features are used | United States |
| Functional Software, Inc. (Sentry) | Error reports, with typed content, contact details and IP addresses removedWhen error reporting is enabled | United States |
| PostHog, Inc. | Product analytics; heatmaps and masked session replay on the public homepage onlyWhen product analytics is enabled | United States |
The sub-processor list is kept current, and customers on the data processing agreement are told before a provider is added.
Data also goes to the services you connect yourself — Meta (Facebook and Instagram), TikTok, LinkedIn, X, Pinterest, Google (Calendar, YouTube and Gemini), Microsoft, Zoom, OpenAI, Anthropic, and Stripe, Twilio or Resend accounts of your own — when you use them. Your relationship with those services is direct, and their terms apply.
This means personal information may be disclosed to overseas recipients, principally in the United States.
We will also disclose information where the law requires it. We do not sell personal information to anyone, in any circumstances.
6. How we protect it
- Everything travels over TLS, and the application is served with a strict Content Security Policy.
- Passwords are hashed with bcrypt. We never store them in a readable form and cannot recover them.
- Provider credentials are encrypted before they are written to the database.
- Every query is scoped to a workspace resolved from a membership check on the server, so one customer’s data cannot be reached from another’s account.
- Access inside a workspace is limited by role and by per-person permissions that you control.
- Accounts can be protected with two-factor authentication from an authenticator app, with one-time recovery codes stored hashed.
No system is perfectly secure. If we become aware of a data breach that is likely to cause serious harm, we will notify affected customers and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.
7. How long we keep it
We keep your data for as long as your account is open. When you ask to close your account, we hold it for 30 days in case you change your mind. After that, your account is deleted, along with any organisation that only you own and everything in it. Records you created in a workspace someone else still uses stay with that workspace, no longer linked to you.
We keep records longer where the law requires it — tax and financial records, for example, are generally kept for five to seven years. Deleted data can remain in database backups until those backups expire on their rolling cycle; we do not restore it from them except to recover the service.
You can download your account data at any time from your account settings, export contacts as CSV, and, on plans that include them, use the REST API and outbound webhooks.
8. Your rights
You may ask us to:
- give you a copy of the personal information we hold about you;
- correct it if it is wrong;
- delete it, where we are not required to keep it;
- stop using it for a particular purpose; or
- provide it in a portable, machine-readable form.
Write to us at privacy@systemly.com.au and we will respond within 30 days. If someone whose data you store in Systemly contacts us directly, we will refer them to you, because that information is yours to control.
If you are not satisfied with how we have handled a privacy matter, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
9. Children
Systemly is a business tool. You must be at least 13 to create an account, and anyone under 18 needs a parent or guardian’s permission. Where local law sets a higher age for consenting to the handling of personal information, that age applies. We do not knowingly collect information from anyone younger. If you believe a child has provided us with personal information, contact us and we will delete it.
10. Visitors in the European Union and United Kingdom
If the GDPR or UK GDPR applies to you, we rely on these legal bases: performing our contract with you for your account and billing; our legitimate interests in securing and improving the service and preventing abuse; your consent for optional analytics where the law requires it; and legal obligation where we must keep records.
Transfers outside your region rely on the standard contractual clauses in our providers’ data processing terms. You have the rights in section 8, and also the right to object to processing based on legitimate interests and to complain to your local data protection authority.
11. Changes to this policy
If we change this policy in a way that materially affects you, we will tell you by email or in the application before it takes effect. The date at the top always reflects the current version.
12. Contact
Privacy enquiries: privacy@systemly.com.au
Everything else: support@systemly.com.au