Wombid helps Australian trade businesses get found in AI search. This policy explains, in plain English, what information we collect and what we do with it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
What we collect
- Free audit: your business name, trade, service area, website (optional) and email address. Our host supplies a network address with the request; we immediately convert it into separate keyed pseudonymous identifiers for the free-audit limit and lead record. We do not store the raw address in either audit key or the lead record.
- Newsletter: your email address.
- Paid plans: the above, plus your subscription details. Payments are processed by Stripe; we never see or store your card number.
- Review requests (Growth and Marketing Pro): when you ask us to send a review request, the customer first name and mobile number or email you enter. We use it once to send that request and to avoid re-contacting the same person within 30 days.
- Follow-up emails (optional): if you tick the follow-up box (or ask on the report page), we email you three short follow-ups about your audit over seven days. We keep the consent record (when and where you gave it, and the wording you saw) for approximately six years and one month after consent, then delete it automatically. That period is our documented compliance decision: Australian spam law puts the burden of proving consent on the sender, and this window covers the evidentiary and limitation periods that apply. Every follow-up has an unsubscribe link, and starting a paid plan stops them automatically.
- Measurement: we use Google Analytics to understand how the site is used, and standard campaign parameters (like which ad brought you here) when you arrive from advertising. Attribution records are kept for up to 90 days. We don't put your name, email or business details into analytics.
- Feedback and testimonials (optional): if you rate a report or offer a quote, we store it with your consent record. Testimonials are only ever published with your explicit permission, and you can withdraw one at any time using the link we give you.
- Industry association membership (optional): if you tell us you are a member of an industry association we partner with, we store the membership number you give us. It links to the date of your first audit, what you buy, and the running count we keep, month by month, of the reports and Fix Packs delivered to you. You choose whether to enter it. If you do not, nothing about you is reported to that association.
How we use it
- To run your audits and prepare your reports. Checking your visibility means asking the AI search engines about your trade and area, so your business name, trade and service area are included in those checks.
- On paid plans, after you confirm your website, we may fetch that homepage plus /robots.txt and /llms.txt (each request timed out at eight seconds) so we can tell you whether the AI business card and crawler file are live. We do not store the page body. The free audit never does this fetch.
- To email you your reports, packs and service updates, and to send the review-request texts you ask us to send.
- To manage your subscription and respond when you contact us. Payments are handled by Stripe; we never see or store your card details.
- We do not sell personal information. We never use your customers' details for marketing.
Where it lives: our service providers
We use a small set of trusted service providers for hosting, payments, email and text delivery, and for querying the AI search engines. Each one receives only what it needs to do its job. Some process data outside Australia; the main locations are listed below.
- Cloudflare (United States, global network): hosts the site and our systems, so it carries the traffic and data you submit, and applies security and rate limits.
- Stripe (United States, Australia): processes payments. It receives the name, email and card details you enter at checkout; we never see or store your card number.
- Resend (United States): delivers our emails, including campaign messages. It receives the recipient address and the message content.
- ClickSend (Australia): delivers review-request texts and campaign messages. It receives the recipient's mobile number and the message.
- OpenAI (United States): one of the AI search engines we query for audits. It receives your business name, trade and service area as part of the questions we ask.
- Anthropic (United States): another AI engine we query for audits, and the engine behind the website assistant. It receives your business name, trade and service area, and any messages you type to the assistant.
- Google (United States): the Gemini AI engine we query for audits (business name, trade and service area), and Google Analytics for site measurement (pseudonymous usage data only, never your name, email or business details).
- Perplexity (United States): another AI engine we query for audits. It receives your business name, trade and service area.
- DataForSEO (United States): supplies Google search, AI Overview and Maps results for your area. It receives search queries naming your trade and service area, and your business name so results can be matched.
We do not sell or share personal information with anyone for their own marketing.
Industry association partners
We partner with industry associations so their members can get a discount on Wombid. If you tell us you are a member of one of these associations by entering your membership number, we report the following to that association, once a quarter, so they can check the fee we owe them: your business name, your membership number, the date of your first audit with us, what you bought and when, how many reports and Fix Packs we delivered to you in the period, and the fee due to them on it. We also give them a total count of how many of their members ran a Wombid audit each month. That total is a number only, with no business named in it.
- Only if you tell us. This applies only to people who enter a membership number. If you never enter one, nothing about you is included in any association report.
- Only for checking the fee. Our agreement with the association allows them to use it for verifying and invoicing that fee, and for nothing else. They may not use it to market to you, pass it to anyone else, or keep it beyond what the agreement and its audit trail need.
- Only that association. We do not report a member of one association to any other, and we never report anyone who is not a member.
If you received a review request
If a trade business you have used sends its review requests through Wombid, here is what that means for you:
- What we receive: your first name and your mobile number or email address, entered by the business you dealt with. Nothing else.
- Why: to deliver that business's single request for your honest review, and to enforce our no-repeat rule, so the same business cannot ask you again within 30 days.
- Retention: delivery and de-duplication records are kept for at most 90 days, then deleted. We never use your details for marketing, never sell them, and never contact you for any other reason.
- Opting out: reply STOP to any Wombid review-request text, use the opt-out link in any Wombid review-request email, or email hello@wombid.com.au. Whichever you use, we permanently block review requests to you from every business using Wombid, not just the one that contacted you.
The full review-request policy, including what we refuse, is on the review requests page.
Win-Back Campaigns (one-off campaign service)
If your business orders a Win-Back Campaign, here is exactly what we handle:
- Your customer records: the names, mobile numbers or email addresses, and job and quote history (dates, job types and quoted amounts) of the past customers in your campaign, taken from your connected ServiceM8 account or a list you supply. We use them for one purpose only: to work out who qualifies for your campaign, draft each message for your approval, send the messages you approve, and report the results to you. Never for our own marketing, never for anyone else's, never sold.
- Approval records: your campaign approval (when you gave it and the exact messages you approved) is kept for approximately six years and one month, then deleted automatically. That is the same documented compliance window as our other consent records: Australian spam law puts the burden of proving authorisation on the sender, and this window covers the evidentiary and limitation periods that apply.
- Delivery records: what was sent, to whom and when, kept for at most 120 days so caps and no-repeat rules can be enforced and problems investigated, then deleted.
- Opt-outs: kept permanently, because that is the only way to honour them permanently.
- Deletion: once your campaign and its results report are done, only the records above remain. If you disconnect your ServiceM8 account or ask us to delete your customer data, we delete it promptly, and any unsent messages are cancelled immediately.
If you received a campaign message, it means a trade business you have dealt with in the last two years asked us to send it. We received your first name, your mobile number or email address, and the job or quote you had with that business. Nothing else, and never for any other purpose. Reply STOP to any text, use the opt-out link in any email, or email hello@wombid.com.au: any of these permanently stops campaign messages to you from every business using Wombid.
ServiceM8 connection (optional, Growth and Marketing Pro)
If you connect your ServiceM8 account to Wombid, here is exactly what we handle:
- Your ServiceM8 account identifier (the Vendor record's ID), used only to match incoming job events to your Wombid subscription.
- Job identifiers and job status, used only to check a job is Completed before any review request.
- The job's customer contact (first name and mobile number or email address), used once to send that review request and to make sure we never contact the same person twice within 30 days.
- Job communication history and ServiceM8 feedback records (SMS and email already sent on a job, plus ServiceM8's own feedback objects; ServiceM8 names those reads read_sms, read_email and read_feedback), read only to see whether ServiceM8 is already asking that customer for a review so Wombid does not send a second one. That read is send-dedupe only. We do not use that history for marketing, profiling, to change your ServiceM8 settings, or for anything else.
- Access tokens ServiceM8 issues us, stored encrypted. Disconnecting deletes them and any queued requests immediately, so no further request can be sent; the account link is then removed and we keep retrying until that removal is confirmed.
- Delivery and de-duplication records (what was sent, to whom, when), kept for at most 90 days so limits and no-repeat rules can be enforced and problems investigated, then deleted. Records of a send whose delivery we could not confirm are held for review and are also deleted by the same 90-day maximum.
Review-request texts are delivered by ClickSend and emails by Resend; each receives only the message and its recipient. We never use your customers' details for marketing, never sell them, and your customers are only ever contacted through the same capped, deduplicated review flow described above (at most 25 requests a day per business, never the same person twice in 30 days). Disconnect any time from the link in your activation email; your credentials and queued requests are deleted immediately, and the account link removal is confirmed automatically.
Your choices
- Every marketing email has a one-click unsubscribe.
- You can cancel a paid plan anytime; monthly plans bill month to month, and annual plans are prepaid for 12 months.
- You can ask us to access, correct or delete your information: email hello@wombid.com.au and we'll action it promptly.
Retention
Pseudonymous free-audit limit identifiers are kept for up to 30 days. Audit lead records are kept for 180 days. If you identify as an industry association member, we also keep your member number, business name and first-contact date for as long as the association partnership requires rebate reporting. Raw-address key names created before pseudonymisation are not read, copied or refreshed; they expire under their original maximum 30-day limit-key or 180-day lead-key retention. Subscriber records are kept while your plan is active and for 180 days after it ends, then deleted.
If you enter an industry association membership number, we keep that number, your business name, the date of your first audit and the monthly count of reports and Fix Packs delivered to you, for as long as we report to that association, and afterwards for the period our records of what we paid them have to be kept. That record is deliberately kept longer than the 180 days above, because the quarterly reports and the fees calculated from them have to reconcile after the fact.
Contact
Questions or complaints: hello@wombid.com.au. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).