This document is pending final legal review. The operational facts on this page — trial length, retention periods, what happens on non-payment — are read from the live configuration and are accurate. The legal wording has not yet been signed off by counsel and may change; account owners will be emailed before a material change takes effect.
CockatooMind is operated by SydWhite Windows & Doors Pty Ltd (ABN 24 699 819 700), trading as CockatooMind. 1 Australia Ave, Sydney Olympic Park NSW 2127.
Privacy policy
1. Who we are and what this covers
SydWhite Windows & Doors Pty Ltd (ABN 24 699 819 700), trading as CockatooMind operates cockatoomind.com, the CockatooMind subscription software for window and door fabricators: quoting, a public website for each business, an email inbox, an AI assistant and the apps that go with them.
We handle personal information in two different capacities, and the difference matters:
Where we are responsible — the businesses who subscribe, the staff they give accounts to, and people who visit our own product pages, sign up or contact us. We decide what we collect about them and why.
Where we act for a business — the people a subscribing business deals with through the software: its customers, people who send an enquiry or quote request through the business's website, people who email the business at an address we host or a mailbox it connects, people who open or accept one of its quotes, and anyone whose details its staff enter. The business is responsible for that information and decides what to collect; we store and process it to provide the software to that business, under our terms with it, and not for any purpose of our own. If you are one of those people, contact the business first. Every business website on the service links to a privacy notice from that business; this policy explains what the software does with the information.
This policy covers the product pages, the workspaces, the apps and the business websites served by the software. Other pages published on the same host by their own owners are covered by their own policies.
2. What we collect
From a subscribing business and its staff
| Information | Why we have it |
|---|---|
| Business name, ABN, business address | Identifying the account and billing. When an owner enters an ABN during set-up, it is checked against the Australian Business Register |
| Name, email address, mobile number of each user | Signing in, sending the emails the service depends on, support |
| Password | Stored only as a bcrypt hash on the business's own workspace, never in plain text and never in our central directory |
| Payment details | We never see or store card numbers. Payment is handled by Stripe; we give Stripe the owner's email, the business name and ABN, and hold only a Stripe customer identifier |
| Usage counts (quotes created, AI actions and AI words used, voice seconds, SMS sent, storage used) | Enforcing plan allowances and billing. These records hold counts, not the text of what was asked |
| What staff type or say to the AI assistant, and its answers | Providing the assistant. The text of workspace-assistant conversations is deleted after 30 days by default (each conversation's title, the start of its first message, is kept); conversations with the earlier quote assistant are kept while the workspace exists; voice recordings are not kept at all (sections 4 and 9) |
| The business's existing website and a sample quote, if the owner gives them during set-up | Filling in the workspace for them. A sample quote can contain a past customer's details; its text, or an image of its first page, is sent to the AI service (section 4) |
| IP address and browser user-agent of sign-ins and platform requests, stored as a keyed hash | Rate limiting, fraud prevention, and showing a user their own active sessions |
| Support correspondence | Answering it |
For a business, about the people it deals with
| Information | How it arrives |
|---|---|
| Names, addresses, email addresses, phone numbers and notes | Entered by the business's staff, or taken from an enquiry, email or accepted quote |
| Photographs of properties and window openings, hand-drawn sketches, plans and other documents; quote, project and invoice history | Uploaded by staff or sent by the customer |
| Website enquiries and quote requests: name, phone, email, suburb or street address, timing, the message, and any photos or plans | The forms on the business's website. The sender's IP address is kept only as a keyed hash, for spam limits |
| Quote views: when a quote link was opened, the IP address, browser and referring page | Opening a quote link. The IP address is stored in full unless the business turns on IP shortening (which shortens IPv4 addresses only). It is not sent to any geolocation service |
| Quote acceptance: name, drawn signature, email address, IP address, browser, date and time, and the version accepted | Accepting a quote online. Kept in full with the quote as the record of the agreement. Actions in the customer portal and online deposit payments also record the IP address and browser |
| Email: senders, recipients, subjects, message text and attachments | Mail sent to an address we host for the business, to the business's own domain, or copied from a mailbox it connects (section 6). The spam filter keeps word statistics for each business |
| SMS: phone numbers, message text, delivery receipts and replies | When a business turns SMS on |
| Survey answers and files shared through the customer portal | When a business uses those features |
| Deposit and invoice payment records | Card payments are taken on Stripe's own page under the business's own Stripe account; we hold the payment status and amounts |
We do not sell any of this, we do not use it to train AI models, and we do not use it for any purpose other than providing the software to the business. What an AI service may do with what it is sent is governed by that service's terms (section 4).
Automatically
Application logs (request paths, response codes, timings, hashed IP addresses) for security and diagnosis. The web server's own access log records full IP addresses.
Our pages set only the cookies needed for signing in and for cross-site request protection — no advertising or tracking cookies. On the product pages that is a cross-site request protection seed named sydtech_cs (one day) and, once you sign in, a session cookie scoped to your own workspace. Cookies set by unrelated plugins on the same host are stripped from the product pages' responses.
Cloudflare, which carries all traffic to the service (section 5), may add its own scripts and headers to pages: a visitor-count script (Cloudflare Web Analytics), a script that protects email addresses from harvesting, browser network-error reports, and its own security cookies. Quote pages shown to a business's customers load fonts from Google Fonts, so the viewer's browser contacts Google.
3. How we use it
To provide the software, including the AI features and automated messages described in section 4; to bill for it; to keep it secure and available; to support you; to tell you about changes to the service, your subscription or a security incident. We may also email the owner of a workspace about new features or plans; every such email carries an unsubscribe link, and opting out never affects the operational messages above. Nothing else. We never send our own marketing to a business's customers.
4. AI and automated processing
Which AI services are used
DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.), which says it processes and stores data in the People's Republic of China, is the default AI service for every AI feature, and the only one used by the quote-editing features (AI Fill, AI check, AI quote edits, size from a photo), the Sales Desk, follow-up suggestions and survey summaries.
The workspace assistant, the Inbox AI and set-up may instead run on: Anthropic, PBC (Claude), United States; with DeepSeek as the fallback when the first choice is unavailable.
An AI service keeps and uses what it is sent according to its own terms. DeepSeek's privacy policy lists improving its models among the uses of what users send it. That is why mail copied from a connected Gmail, Microsoft 365 or IMAP mailbox is never shown to the AI while any model it would use is DeepSeek (section 6).
What is sent, and when
When a person asks. When staff fill or check a quote with AI, estimate a size from a photograph, ask the assistant a question, summarise, translate or draft a reply to an email, or set up a new workspace from the owner's existing website (up to 12 pages) and a sample quote, the relevant text is sent to the AI service — which can include a customer's name, email, phone number and site address, the quote, an email thread, and for size estimates the photograph itself. A photograph of a window is usually a photograph of somebody's home. Once a person starts the assistant on a task it may carry on in the background, reading the quotes, customers, calendar and emails it needs for that task.
Automatically, without a person asking.
- Website enquiries (Sales Desk). Where a business's plan includes the Sales Desk and its AI is switched on, each new enquiry or quote request from its website can be sent to DeepSeek shortly after it arrives: the name, phone number, email, address, suburb, timing, the windows and doors listed, the message and the names of attached files. The AI pulls out the details, lists the questions still to ask, suggests a next step and drafts a reply. Its output is shown to the business's staff as a suggestion. Nothing is sent to the person who made the enquiry. (Separately from the AI, every enquiry is added to the business's customer list and, for a quote request, a draft quote, straight away.) At most 30 enquiries a day per business are analysed this way, and none while the form is under unusual load.
- Follow-up suggestions and survey summaries. Where a business's AI configuration allows it, quotes are analysed when saved and once a day to suggest follow-ups (the customer's name and address fields are left out, but the staff notes sent with them may mention them), and a customer's survey answers are summarised for the business when submitted.
Automation that is not AI
- Spam filtering and sorting of email run on our own server: fixed rules, plus a statistical filter for each business trained only by its own staff marking messages as spam or not spam. A message can be filed as spam or into a category without a person seeing it first; staff can move it back. Rules a business writes can file, archive or forward mail automatically.
- Website forms are screened for automated abuse with a hidden field, a timing check, rate limits and, on the service's own addresses, Cloudflare Turnstile. A submission judged to be automated is discarded without notice.
- Automatic messages to a business's customers: a reminder about two days before a sent quote expires (on unless the business turns it off), and follow-up emails or SMS only if the business turns them on. Each of those emails carries an unsubscribe link. No email written by the AI is ever sent without a person approving it.
Decisions
The software does not decide anything about a person on its own that has a legal or similarly significant effect on them. AI output — a drafted reply, an extracted detail, a suggested size or price — is a suggestion that staff check; prices, quotes and replies are decided and sent by people. AI features are included or excluded by plan, and a business that does not want them can ask us to switch them off for its whole workspace.
Voice input
The assistant's microphone is optional: typing works everywhere. If the workspace uses the browser's own speech input, the browser's maker (for example Google in Chrome, Apple in Safari) handles the audio under that person's browser settings. If it uses a server engine, a recording of up to two minutes is sent to the main engine — Groq, Inc. (United States) or Cloudflare, Inc. Workers AI (the United States or another country in Cloudflare's network) — and, if that fails, the same recording to the other, to be turned into text; the text comes back into the message box and is never sent by itself. We do not keep the recording: it is sent once and deleted. A recording can pick up anything said near the microphone. The microphone button and the recording indicator say where the voice goes.
5. Who else handles it (service providers)
We use these companies to provide the service. Each receives only what its part needs; how each may use what it receives is governed by its own terms with us.
| Provider | What they handle | Where |
|---|---|---|
| CockatooMind’s own servers in Sydney, Australia (no third-party hosting provider) | All application data and files | Australia |
| Cloudflare, Inc. | All traffic: routing, TLS, security filtering and caching; DNS and custom web addresses; the Turnstile bot check (which receives the visitor's IP address) on sign-up, on sign-in after failed attempts, and on business website forms; visitor counts; and, if the voice engine is used, voice recordings (Workers AI) | Global network; requests are handled at the nearest point of presence and may be processed in other countries, including the United States |
| Defiant, Inc. (Wordfence) | Web application firewall and malware scanning on our servers. The IP addresses of blocked or suspicious requests are shared with the Wordfence threat feed | United States |
| Stripe Payments Australia Pty Ltd | Subscription payments (owner email, business name, ABN). A business that takes deposits online uses its own Stripe account, and Stripe receives the payer's email and the quote reference | Australia / United States |
| Microsoft Corporation (Azure Communication Services) | Sending the email a business sends to its customers from its workspace (quotes, replies, receipts): addresses, content and attachments. Open and click tracking is switched off | Australia |
| Amazon Web Services (Amazon SES and S3) | Receiving email sent to the addresses we host for businesses: each message is stored briefly in Amazon S3 before it is copied into the workspace, and deleted there after 30 days | Australia (Sydney) |
| Apple Inc. (iCloud Mail) | Sending the service's own email — sign-up links, account and billing notices, alerts to staff (which can include the sender and subject of a new message) — and a business's customer email when the service above is unavailable. The provider sees the addresses and content of those messages in the ordinary course of delivering them | See the provider's own data-location statement |
| Google LLC (Gmail) and Microsoft Corporation (Microsoft 365) | Only for a business that connects its own mailbox (section 6) | The mailbox provider's own locations |
| Mobile Message Pty Ltd | SMS, when a business turns it on: phone numbers and message text | Australia |
| Browserless | Making quote PDFs: the whole quote page is sent — including the customer's name and address, the site address, photographs and, once accepted, the signature — and the PDF is returned; what Browserless keeps is governed by its own terms. A local engine on our own server is used when the service is unavailable | United States (San Francisco) by default; London or Amsterdam if that region is unavailable |
| DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) | AI features. The text of AI requests, photographs for size estimates, and website enquiries for the Sales Desk (section 4) | People's Republic of China |
| Anthropic, PBC (Claude) | AI features. The workspace assistant, the Inbox AI and set-up, where configured to use it (section 4) | United States |
| Groq, Inc. | Voice input only. If the workspace uses voice input on Groq: the recording of what a person says to the assistant, turned into text and returned; we do not keep the recording | United States |
| Cloudflare, Inc. (Workers AI) | Voice input only. If the workspace uses voice input on Cloudflare Workers AI: the recording of what a person says to the assistant, turned into text and returned; we do not keep the recording | Outside Australia — the United States or another country in Cloudflare's network |
| Web push services (Google, Mozilla, Microsoft, Apple) | Only when a staff member turns on new-mail notifications: an encrypted notice carrying the sender's name or address and the subject, never the message | The browser maker's own network |
| Australian Business Register (Australian Government) | An ABN an owner enters during set-up, to look up the registered business details | Australia |
A business that connects a mailbox by IMAP, or that has its own email or website provider, also uses that provider; we only exchange its mail with it.
6. Connected mailboxes (Gmail, Microsoft 365 and IMAP)
A workspace can choose to connect an existing mailbox, so that its email appears in the workspace Inbox and replies can be sent from it. Nothing is connected unless a person does it themselves — for Gmail and Microsoft 365 on Google's or Microsoft's own sign-in page, where we never see the mailbox password; for other providers by entering an app password, which is stored encrypted.
What we access, and why
| Permission | What it is used for |
|---|---|
| Your email address and staying connected (Google: openid, email; Microsoft: User.Read, offline_access) | Knowing which mailbox was connected, and refusing a mailbox another workspace has already connected |
| Read your email (Google: gmail.readonly; Microsoft: Mail.ReadWrite) | Copying the last 30 days of mail when you connect — for Gmail every label except drafts, spam and trash (at most 500 messages); for Microsoft 365 and IMAP the inbox and sent folders — then new messages as they arrive, into your workspace Inbox, so you can read them next to your quotes and customers. The Microsoft permission also allows changes; we only read |
| Send email as you (Google: gmail.send; Microsoft: Mail.Send) | Sending the emails you write, or approve, in the workspace — replies, quotes and follow-ups — from your own address, so they appear in your Sent folder |
We do not change, label, archive or delete anything in your mailbox. The one thing we add is, for an IMAP mailbox, a copy of each message you send from the workspace in your Sent folder. We do not send anything you have not written or approved, except the automatic messages your workspace is set to send — such as the quote-expiry reminder, which is on unless you turn it off — and forwarding rules you set up.
How it is stored and protected
Copied messages are stored in your workspace's own database tables and file directory in Australia, like the rest of your workspace. The sign-in tokens Google or Microsoft give us, and IMAP passwords, are encrypted with a key held outside the database and are only ever sent back to the provider they came from. Mailbox traffic is encrypted in transit.
Who can see it
The people in your workspace who have Inbox access. We do not sell it, we do not use it for advertising, and we do not use it to build profiles or to train or improve any AI or machine-learning model — ours or anyone else's. Our staff do not read it: we look at messages from a connected mailbox only with your explicit permission for a specific support request, where it is necessary for security (for example investigating abuse), or where the law requires it.
Messages from a connected mailbox are given to the AI only when a person asks it to work with them, and only if every AI service it would use is one whose terms forbid using what it is sent for training. While any of those services is DeepSeek, the AI is not shown those messages at all. This protection applies to connected mailboxes only: email received at an address we host and website enquiries can be read by the AI as described in section 4.
CockatooMind's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Disconnecting and deleting
Disconnect the mailbox at any time on the Email setup page: syncing stops at once and the stored tokens or password are deleted; for Gmail we also tell Google to withdraw our access, and for Microsoft 365 you can withdraw it in your Microsoft account. You can also withdraw access from your Google account (myaccount.google.com/permissions); the workspace then shows the mailbox as needing to be signed in again and stops syncing. Messages already copied stay in your Inbox until you delete them, or until the workspace is deleted on the schedule in section 9; ask us and we will delete every message copied from a connected mailbox.
7. Business websites and their forms
Each subscribing business can publish a website on the service. Its contact form, its quote request form and the dialog for accepting a quote each say who is collecting the information and link to that business's privacy notice, and every page of its website links that notice. What a visitor sends goes to that business's workspace — its Inbox, its customer list and, for a quote request, a draft quote for its staff to check — and is handled as described above. There is no automatic reply to the visitor.
8. Overseas disclosure — read this one
The database and uploaded files are stored at rest in Australia. Information is sent outside Australia in these cases:
- People's Republic of China — DeepSeek, for AI features and the automatic analysis of website enquiries (section 4).
- United States — Anthropic, Groq, Stripe, Wordfence, Browserless, Google, as described in section 5.
- Cloudflare's global network — all traffic passes through it, so information in transit may be processed in other countries; and, for voice input on Workers AI, recordings.
- Other countries — Browserless's London or Amsterdam regions when San Francisco is unavailable; the mailbox, email, web push and AI-gateway providers named in section 5 in their own locations.
Email a business sends to its customers goes through Microsoft Azure Communication Services, configured to keep its data in Australia.
A recipient outside Australia may not be bound by Australian privacy law, and you may not be able to seek redress under it for how that recipient handles the information. A business that does not want AI processing at all can ask us to switch it off for its whole workspace.
9. How long we keep it
| Data | Retention |
|---|---|
| A live workspace's data, including its customers, quotes, quote views, acceptance records and email | For as long as the subscription runs, unless the business deletes it sooner. Email moved to the trash is deleted after 30 days |
| After the workspace is closed | 90 days if the account ever paid; 30 days if it never did. It can be restored in full during that window |
| Final export after deletion | 12 months (paid) / 30 days (never paid). Deleting it after that period is currently a manual step on our side |
| Incoming email held at Amazon S3 before it reaches the workspace | 30 days |
| The text of conversations with the workspace assistant | 30 days by default (a business can set 1 to 365 days); each conversation's title is kept. Conversations with the earlier quote assistant are kept while the workspace exists |
| Voice recordings | Not kept: deleted as soon as they are turned into text |
| Platform application logs | 30 days |
| A workspace's own logs; the web server's access log | 30 days where our clean-up schedule is switched on; the web server's access log has no fixed period yet |
| App diagnostic uploads | 30 days |
| Administrative audit log | 2 years |
| Workspace address reservation after deletion | 12 months, so a quote link in someone's inbox can never be taken over by a different business |
| Billing records | 7 years, as Australian tax law requires |
What an AI service, Stripe or another provider keeps of what it was sent is governed by that provider's own terms.
10. Security
Data is encrypted in transit. Passwords are bcrypt hashes. Access tokens are stored hashed, expire, and can be revoked per device. The service credentials we hold for the platform are encrypted at rest with a key held outside the database; a business's own payment-provider keys are stored in its workspace settings. Each business's data lives in its own database tables, its own file directory and its own cookie scope. Our staff cannot read a business's quotes casually: doing so requires a deliberate support session that is recorded in our audit log, and the workspace owner is emailed when one is opened.
No system is perfectly secure, and we would rather say so than imply otherwise.
11. If something goes wrong
We aim to assess any suspected data breach within 72 hours, and in any case within the 30 days the law allows. Where a breach is likely to result in serious harm, we notify the Office of the Australian Information Commissioner and the affected individuals as the Notifiable Data Breaches scheme requires. Where the affected information belongs to a business's customers, we notify the business first and coordinate with them, because they hold the relationship.
12. Access, correction and complaints
You may ask for a copy of the personal information we hold about you, ask us to correct it, or complain about how we have handled it. If the information is held for a business (section 1), ask that business first; we will help it respond. A business can export its entire workspace at any time from the console — a complete, portable archive, not a summary — and can delete the workspace itself.
Contact [email protected]. We respond within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
13. Changes
We will post any change here and, where it materially affects you, email account owners before it takes effect.