Konnex Privacy Policy

1. Who we are

Konnex ("we", "us", "our") is Konnex Labs (ABN 76 617 521 508), based in New South Wales, Australia. We operate konnexlabs.com. Konnex provides evidence-backed intelligence on residential trades: what exists, where, and how it changes over time.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It covers:

• people who visit our website;
• people who use Ask Konnex;
• people who used our former products (section 6); and
• people whose information appears in the business data we hold, such as sole traders.

Privacy contact: support@konnexlabs.com.

2. Information we collect when you visit our website

Server and hosting data. Our website pages and website functions are hosted by Vercel. When you load a page, Vercel receives your IP address and standard request headers, including your browser's User-Agent. When a page or feature calls our API, the API records the address of the request (the URL, including any query string) and your browser's User-Agent. Our reverse proxy on the API server keeps access logs that include your IP address, User-Agent and the address requested. We use these logs to run, secure and fix the service. Our API request records are deleted after 90 days. Other server logs are kept only as long as we need them for these purposes or as required by law, and we are putting shorter limits in place for them.

Analytics. We use Google Tag Manager to load Google Analytics. Neither loads, and nothing is sent to Google from our pages, unless you choose "Accept All" in our cookie banner. If you accept, Google Analytics uses cookies and collects information such as the pages you visit, how you reached us, your device and browser type, your interactions with the page, and your IP address. Google processes this information under its own privacy policy (policies.google.com/privacy).

Fonts and other resources. Our pages use fonts and other files hosted by us. Apart from Google Tag Manager and Google Analytics (after you accept), our main website pages do not load third-party scripts, maps or fonts. Some pages contain ordinary links to other sites; those sites receive your information only if you follow the link.

We do not use advertising or remarketing tags. We do not sell personal information about website visitors.

3. Cookies

You can change your choice at any time using the "Cookie settings" link in the footer of every page. You can also block or delete cookies in your browser settings.

If you choose "Accept All" and send our contact form, Google Analytics records that a form was sent and the option you chose to describe yourself. It does not record your name, email address, organisation or message.

4. Ask Konnex

Ask Konnex is a question-and-answer tool on our website. If you use it:

• Access. You do not need an account. Like any page on our website, our hosting provider (Vercel) sees your IP address when you use it (see section 2).
• We send your question, the earlier messages in that conversation, and the aggregate data results that Ask Konnex looks up to our AI model provider, Anthropic (the Claude model), so it can generate an answer. We do not include your email address or IP address in what we send to Anthropic. However, anything you type into your question is sent.
• We keep a record of your question (up to 500 characters), the database query generated to answer it, and technical usage figures such as token counts and cost. The record does not contain your name, a user ID, your IP address or a session identifier. We use it to run, check and improve Ask Konnex. We delete these records after 30 days.
• Please do not enter personal information about yourself or anyone else in a question.

5. Emails and contact

If you email us or use the contact form on our website, we collect your name, your email address, your organisation and the option you choose to describe yourself (if you give them), and your message. We use these details only to reply to you and deal with your enquiry. We don't add you to a mailing list or use them for marketing, and we don't send automatic emails to the address you enter.

Contact form messages are delivered to our support inbox by Resend, our email service. Resend keeps a copy for up to 30 days. We keep enquiries in our support inbox for 24 months after our last exchange with you and then delete them, unless we need them longer for an ongoing conversation or business relationship, or the law requires it.

To stop spam, the form limits how many messages can be sent from one connection in a short time. To do this we use a one-way coded version of your IP address. It is held only briefly in the memory of the server handling your request and is never stored or logged.

We do not currently offer an email subscribe list. If you subscribed to emails from us in the past, Resend may still hold your email address and name. Contact us to access or delete them.

6. If you used our former products

We no longer offer Konnex Explorer, Konnex Connect or the Konnex Data API. If you used one of our former products, we may still hold your account and transaction records. Contact us to access or delete them (see section 10). These records may include:

• your email address, account and sign-in data, and API key records and usage (held in Supabase);
• your credit balance, credit transactions and contact-reveal history (held in Supabase);
• your payment records (held by Stripe);
• records of searches made in those products, which may include the text you typed, the location searched and, in some cases, an approximate or device-provided latitude and longitude; and
• records of requests made to our API while those products were offered.

7. Business data we hold

We gather information about trade businesses from public sources and licensed data providers. These include:

• public registers such as the Australian Business Register, NSW Fair Trading licence data and the Australian Bureau of Statistics;
• business listings and search results from Google, obtained through business-listing and search-data services; and
• businesses' own websites.

This information is about businesses. Many trade businesses are run by sole traders, though, so details such as a name, licence number, phone number, email address or address can be personal information about an individual. We handle it under the APPs.

How we use it. We use this information to produce aggregate statistics, such as counts of businesses, licences and website trust signals, and search demand by trade, area and date. Our public pages show aggregate figures, not lists of individual businesses.

Service providers. To process this information we use service providers. These include Anthropic, to classify business and review text, and email verification services, to check whether business email addresses are valid. To find and check these details, we send business names (which can include a sole trader's own name), licence numbers, ABNs and business email addresses to the services and public registers above, and only for that check.

If you are a sole trader or business owner, you can ask what we hold about you and ask us to correct it (see section 10).

8. Who we share information with

We share personal information only with the service providers listed in this policy, for the purposes described here, or where the law requires it. Our service providers are:

9. Overseas disclosure

We disclose personal information to the overseas service providers listed in section 8, for the purposes described in this policy. Some of these providers store or process information outside Australia, including in the United States and Europe. Google processes analytics data on its own global infrastructure, which may include countries outside Australia. Some of the business-data services in section 8 (business-listing and search-data services, email verification services, and WorkClear for licence verification) are located outside Australia, for example in the United States. They receive only the business information described in section 7 that each check needs, for example a business email address for email verification. Resend, which delivers our contact form messages, and Namecheap Private Email, which hosts our support inbox, store messages in the United States.

10. Access, correction and complaints

You can ask for access to the personal information we hold about you, or ask us to correct or delete it, by emailing support@konnexlabs.com. We will respond within 30 days. We may need to confirm your identity first.

If you have a privacy complaint, contact us first and we will try to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

11. Security and retention

We take reasonable steps to protect personal information. All traffic to our website is encrypted with HTTPS, and access to our database is restricted to approved (allow-listed) systems. No system is completely secure.

We keep personal information only as long as we need it for the purposes in this policy or as required by law. Some records have set limits: API request records and site-search records are deleted after 90 days, Ask Konnex question records after 30 days, and contact enquiries 24 months after our last exchange with you (see section 5).

12. Children

Our website and Ask Konnex are intended for adults and businesses. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy. We will post the new version on this page with a new "Last updated" date.