Website Privacy Policy

This Privacy Policy applies to all personal information collected by Tehsil Pty Ltd (we, us or our) via the website located at greatnature.ai (Website).

1. What information do we collect?

The kind of Personal Information that we collect from you will depend on how you use our Website. The Personal Information which we collect and hold about you may include:

Name
Email address
Location
Terms & Privacy consent
Business & professional name, ABN, description
Contact: phone, email, website, booking/contact URLs, business address, suburb, postcode
Social links (Facebook, Instagram, LinkedIn)
Professional details: professions, services, qualifications, certificates, accreditations, society memberships & registration numbers, workcover/worksafe registrations
Team & support members: each person’s name, bio, qualifications, certificates, photo, LinkedIn
Uploaded files: logo, service catalogue, referral form
Consent status/source/timestamp; admin notes
IP address, for rate-limiting and analytics
Information you enter when generating an action plan, which may include descriptions of a workplace incident, injury or safety concern

2. Types of information

The Privacy Act 1988 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information. Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy. Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Where you use our action-plan feature, the information you enter may include health or injury information, which is Sensitive Information. We collect and use such Sensitive Information only:

for the primary purpose for which it was obtained;
for a secondary purpose that is directly related to the primary purpose; and
with your consent or where required or authorised by law.

3. How we collect your Personal Information

We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way.
We may also collect cookies from your computer which enable us to tell when you use the Website and also to help customise your Website experience. As a general rule, however, it is not possible to identify you personally from our use of cookies.
We generally don’t collect Sensitive Information, but when we do, we will comply with the preceding paragraph.
Where reasonable and practicable we collect your Personal Information from you only. However, sometimes we may be given information from a third party, in cases like this we will take steps to make you aware of the information that was provided by a third party.

4. Purpose of collection

We collect Personal Information to provide you with the best service experience possible on the Website and keep in touch with you about developments in our business.

We disclose your Personal Information only to the service providers who help us operate the platform, and only to the extent needed to provide our services. We do not sell your Personal Information. Your Personal Information may also be exposed from time to time to maintenance and support personnel acting in the normal course of their duties.

Service provider	Information shared	Purpose
DigitalOcean	All information you provide, as stored	Website hosting and database (Sydney, Australia)
Stripe	Name, email, payment details	Processing subscription payments (see Section 7)
Resend	Name and email	Account emails (verification, password reset, notifications)
Anthropic (Claude) via Amazon Web Services	Information you enter when generating an action plan	Generating your workplace health-and-safety action plan (data held in Sydney, Australia)
PostHog (self-hosted by us)	Usage activity, device/browser information, IP address	Understanding how the platform is used

Each provider is bound to use your information only to provide services to us. We may also disclose Personal Information where required by law.

By using our Website, you consent to the receipt of direct marketing material. We will only use your Personal Information for this purpose if we have collected such information direct from you, and if it is material of a type which you would reasonably expect to receive from us. We do not use sensitive Personal Information in direct marketing activity. Our direct marketing material will include a simple means by which you can request not to receive further communications of this nature, such as an unsubscribe button link.

5. Security, Access and correction

We store your Personal Information in a way that reasonably protects it from unauthorised access, misuse, modification or disclosure. When we no longer require your Personal Information for the purpose for which we obtained it, we will take reasonable steps to destroy and anonymise or de-identify it. Most of the Personal Information that is stored in our client files and records will be kept for a maximum of 3 years to fulfill our record keeping obligations.

The Australian Privacy Principles:

permit you to obtain access to the Personal Information we hold about you in certain circumstances (Australian Privacy Principle 12); and
allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13).

Where you would like to obtain such access, please contact us in writing on the contact details set out at the bottom of this privacy policy. We maintain invoice record data for a maximum of 7 years to fulfill our taxation governance record keeping obligations.

6. Complaint procedure

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as on the contact details set out at the bottom of this policy. All complaints will be considered by Tehsil Pty Ltd and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

7. Third Party Processing

We store and process your Personal Information in Australia (Sydney), including our hosting, database and AI processing. For payment processing, when you enter payment details, these are processed by Stripe, which may handle and store that information on infrastructure located outside Australia, including in the United States. By providing payment details, you consent to this disclosure. Stripe is bound to protect your information and use it only to process payments on our behalf.

8. How to contact us about privacy

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us through: [email protected].