Privacy Policy

Last updated: 3 August 2026 · Wombid Pty Ltd (ABN 63 699 035 320)

Wombid helps Australian trade businesses get found in AI search. This policy explains, in plain English, what information we collect and what we do with it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

What we collect

• Free audit: your business name, trade, service area, website (optional) and email address. Our host supplies a network address with the request; we immediately convert it into separate keyed pseudonymous identifiers for the free-audit limit and lead record. We do not store the raw address in either audit key or the lead record.
• Newsletter: your email address.
• Paid plans: the above, plus your subscription details. Payments are processed by Stripe; we never see or store your card number.
• Review requests (Growth plan): when you ask us to send a review request, the customer first name and mobile number or email you enter. We use it once to send that request and to avoid re-contacting the same person within 30 days.
• Follow-up emails (optional): if you tick the follow-up box (or ask on the report page), we email you three short follow-ups about your audit over seven days. We keep the consent record (when and where you gave it, and the wording you saw) for approximately six years and one month after consent, then delete it automatically. That period is our documented compliance decision: Australian spam law puts the burden of proving consent on the sender, and this window covers the evidentiary and limitation periods that apply. Every follow-up has an unsubscribe link, and starting a paid plan stops them automatically.
• Measurement: we use Google Analytics to understand how the site is used, and standard campaign parameters (like which ad brought you here) when you arrive from advertising. Attribution records are kept for up to 90 days. We don't put your name, email or business details into analytics.
• Feedback and testimonials (optional): if you rate a report or offer a quote, we store it with your consent record. Testimonials are only ever published with your explicit permission, and you can withdraw one at any time using the link we give you.

How we use it

• To run your audits and prepare your reports. Checking your visibility means asking the AI search engines about your trade and area, so your business name, trade and service area are included in those checks.
• To email you your reports, packs and service updates, and to send the review-request texts you ask us to send.
• To manage your subscription and respond when you contact us. Payments are handled by Stripe; we never see or store your card details.
• We do not sell personal information. We never use your customers' details for marketing.

Where it lives: our service providers

We use a small set of trusted service providers for hosting, payments, email and text delivery, and for querying the AI search engines. Each one receives only what it needs to do its job. Some process data outside Australia; the main locations are listed below.

• Cloudflare (United States, global network): hosts the site and our systems, so it carries the traffic and data you submit, and applies security and rate limits.
• Stripe (United States, Australia): processes payments. It receives the name, email and card details you enter at checkout; we never see or store your card number.
• Resend (United States): delivers our emails, including campaign messages. It receives the recipient address and the message content.
• ClickSend (Australia): delivers review-request texts and campaign messages. It receives the recipient's mobile number and the message.
• OpenAI (United States): one of the AI search engines we query for audits. It receives your business name, trade and service area as part of the questions we ask.
• Anthropic (United States): another AI engine we query for audits, and the engine behind the website assistant. It receives your business name, trade and service area, and any messages you type to the assistant.
• Google (United States): the Gemini AI engine we query for audits (business name, trade and service area), and Google Analytics for site measurement (pseudonymous usage data only, never your name, email or business details).
• Perplexity (United States): another AI engine we query for audits. It receives your business name, trade and service area.
• DataForSEO (United States): supplies Google search, AI Overview and Maps results for your area. It receives search queries naming your trade and service area, and your business name so results can be matched.

We do not sell or share personal information with anyone for their own marketing.

If you received a review request

If a trade business you have used sends its review requests through Wombid, here is what that means for you:

• What we receive: your first name and your mobile number or email address, entered by the business you dealt with. Nothing else.
• Why: to deliver that business's single request for your honest review, and to enforce our no-repeat rule, so the same business cannot ask you again within 30 days.
• Retention: delivery and de-duplication records are kept for at most 90 days, then deleted. We never use your details for marketing, never sell them, and never contact you for any other reason.
• Opting out: reply STOP to any Wombid review-request text, use the opt-out link in any Wombid review-request email, or email hello@wombid.com.au. Whichever you use, we permanently block review requests to you from every business using Wombid, not just the one that contacted you.

Win-Back Campaigns (one-off campaign service)

If your business orders a Win-Back Campaign, here is exactly what we handle:

• Your customer records: the names, mobile numbers or email addresses, and job and quote history (dates, job types and quoted amounts) of the past customers in your campaign, taken from your connected ServiceM8 account or a list you supply. We use them for one purpose only: to work out who qualifies for your campaign, draft each message for your approval, send the messages you approve, and report the results to you. Never for our own marketing, never for anyone else's, never sold.
• Approval records: your campaign approval (when you gave it and the exact messages you approved) is kept for approximately six years and one month, then deleted automatically. That is the same documented compliance window as our other consent records: Australian spam law puts the burden of proving authorisation on the sender, and this window covers the evidentiary and limitation periods that apply.
• Delivery records: what was sent, to whom and when, kept for at most 90 days so caps and no-repeat rules can be enforced and problems investigated, then deleted.
• Opt-outs: kept permanently, because that is the only way to honour them permanently.
• Deletion: once your campaign and its results report are done, only the records above remain. If you disconnect your ServiceM8 account or ask us to delete your customer data, we delete it promptly, and any unsent messages are cancelled immediately.

If you received a campaign message, it means a trade business you have dealt with in the last two years asked us to send it. We received your first name, your mobile number or email address, and the job or quote you had with that business. Nothing else, and never for any other purpose. Reply STOP to any text, use the opt-out link in any email, or email hello@wombid.com.au: any of these permanently stops campaign messages to you from every business using Wombid.

ServiceM8 connection (optional, Growth plan)

If you connect your ServiceM8 account to Wombid, here is exactly what we handle:

• Your ServiceM8 account identifier (the Vendor record's ID), used only to match incoming job events to your Wombid subscription.
• Job identifiers and job status, used only to check a job is Completed before any review request.
• The job's customer contact (first name and mobile number or email address), used once to send that review request and to make sure we never contact the same person twice within 30 days.
• Access tokens ServiceM8 issues us, stored encrypted. Disconnecting deletes them and any queued requests immediately, so no further request can be sent; the account link is then removed and we keep retrying until that removal is confirmed.
• Delivery and de-duplication records (what was sent, to whom, when), kept for at most 90 days so limits and no-repeat rules can be enforced and problems investigated, then deleted. Records of a send whose delivery we could not confirm are held for review and are also deleted by the same 90-day maximum.

Review-request texts are delivered by ClickSend and emails by Resend; each receives only the message and its recipient. We never use your customers' details for marketing, never sell them, and your customers are only ever contacted through the same capped, deduplicated review flow described above (at most 25 requests a day per business, never the same person twice in 30 days). Disconnect any time from the link in your activation email; your credentials and queued requests are deleted immediately, and the account link removal is confirmed automatically.

Your choices

• Every marketing email has a one-click unsubscribe.
• You can cancel a paid plan anytime; monthly plans bill month to month, and annual plans are prepaid for 12 months.
• You can ask us to access, correct or delete your information: email hello@wombid.com.au and we'll action it promptly.

Retention

Pseudonymous free-audit limit identifiers are kept for up to 30 days, and free-audit lead details are kept for up to 180 days. Raw-address key names created before pseudonymisation are not read, copied or refreshed; they expire under their original maximum 30-day limit-key or 180-day lead-key retention. Subscriber records are kept while your plan is active and for a reasonable period afterwards for accounting purposes.

Contact

Questions or complaints: hello@wombid.com.au. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).