Privacy policy

This Privacy Policy explains how Rory (the “Service”), operated by Folkware (ABN 69 340 390 198) (“Rory”, “we”), handles personal information. It applies to everyone who uses the Service.

Alpha software — important notice

Rory is currently in alpha. Data handling practices described in this policy are implemented on a best-efforts basis. During the alpha period data loss or unexpected behaviour may occur; Folkware (ABN 69 340 390 198) is not responsible for such events.

1. What we collect

We collect the following categories of information:

1. Account information: name, email address, role, workspace and tenant identifiers, authentication tokens.
2. Connected mailbox content: messages, attachments and metadata from Gmail or Microsoft 365 inboxes you connect, including sender, recipient, subject, body, and threading.
3. Connected project content: jobs, tasks, contacts, schedules, time entries, quotes, purchase orders and similar records from AroFlo, Buildxact, Google Sheets and other systems you connect.
4. Supplier order content: orders, invoices, quotes and pricing returned by supplier portals you enable.
5. Usage information: actions you take in the Service, drafts you approve or reject, feature usage, and aggregate performance metrics.
6. Device and log data: IP address, device type, browser, language, timestamps and error logs needed to operate and secure the Service.

2. Why we use it

We use personal information to:

1. operate the Service — classify items, generate drafts, surface what needs your attention;
2. authenticate you and protect your account;
3. provide customer support and respond to your requests;
4. improve the Service through aggregate analytics and quality reviews;
5. send you operational notifications and, with your consent, product updates;
6. comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use Customer Data to train general-purpose AI models for third parties.

3. Legal basis

Where applicable law requires a legal basis, we rely on:

1. Performance of a contract — to provide the Service you signed up for;
2. Legitimate interests — to secure, maintain and improve the Service;
3. Consent — for optional features such as marketing emails;
4. Legal obligation — where laws require us to retain or disclose information.

4. Sub-processors

We use trusted third-party providers to deliver the Service. Each is bound by contractual data protection terms. The current list includes:

1. Amazon Web Services — hosting, queues, secrets management (Sydney, Australia).
2. Anthropic — large language model inference for drafts and conversation.
3. OpenAI — embeddings and email classification.
4. Amazon Web Services — identity and authentication (Amazon Cognito), hosting, storage and email delivery.
5. Bento — transactional email delivery, including free-tool reminder emails (United States).
6. Google — Gmail and Google Sheets API access (only when you connect them).
7. Microsoft — Outlook / Microsoft 365 API access (only when you connect it).
8. AroFlo, Buildxact and supplier providers — only when you connect them.

We update this list from time to time. The current list is always available in the Service under Settings › Legal.

5. Where data is stored

Customer Data is hosted in AWS Sydney (ap-southeast-2). LLM inference may be processed by providers in the United States, and email we send is delivered through Bento in the United States. By using the Service you consent to that cross-border processing for the purposes described above.

6. How long we keep it

1. Account information: for the life of your account, plus a reasonable period after deletion to satisfy legal and audit obligations.
2. Mailbox and project content: while your connection is active. Disconnecting a source removes future ingestion; previously ingested content is retained until you delete it or the workspace.
3. Logs and security records: typically 30–90 days, longer where required to investigate incidents.
4. Free tools documents: deleted 90 days after the last change (see section 10).
5. Backups: rolling backups for up to 35 days.

7. Your rights

You can:

1. access the personal information we hold about you;
2. correct or update your information;
3. request deletion of your account and associated data, subject to lawful retention obligations;
4. export Customer Data in a machine-readable format on request;
5. object to or restrict certain processing;
6. withdraw consent for optional processing at any time;
7. complain to a supervisory authority — in Australia, the Office of the Australian Information Commissioner (oaic.gov.au).

To exercise any right, email kosta@getrory.com.au. We will respond within 30 days.

8. Security

We use TLS in transit, encryption at rest, scoped credentials, audit logging, and least-privilege access controls. No system is perfectly secure; if we become aware of a breach affecting your information we will notify you in line with applicable law.

9. Children

The Service is not directed to children under 16 and we do not knowingly collect personal information from them.

10. Free tools in ChatGPT and Claude

“Rory Tools” is a free app for ChatGPT and Claude with three tools: extra check, chase plan and drawing changes. The chase plan is also a form on getrory.com.au. Together with the pages and PDFs they create on plugins.getrory.com.au and the reminder emails you can ask for, these are the “free tools”. You don’t need a Rory account to use them. This section explains how we handle information in the free tools. The rest of this policy also applies to them, except where this section says otherwise.

1. Your conversation stays with your AI provider. ChatGPT or Claude reads what you write and writes the verdicts, reasons and messages. Your conversation is between you and the provider you chose — OpenAI for ChatGPT, Anthropic for Claude — and their terms and privacy policy govern it, including what they do with the results our tools send back. For the free tools they are not our sub-processors, and we don’t run an AI model of our own.
2. What we receive. We receive only what the assistant sends to one of our tools, or what you type into the chase plan form — not your conversation. Depending on the tool, this can include the text of a request, email or site note; the scope wording you gave; a verdict and reason; amounts, dates and notice periods; your state; your business name; your client’s name; the job name or site address; invoice, claim or quote references; and messages, notices or letters the assistant drafted. We don’t receive your name, email address or account details from OpenAI or Anthropic.
3. Drawings. For drawing changes we download the two PDF drawings, either from a temporary link ChatGPT gives us for a file you uploaded or from a web link you provided. We render and compare them and store images of the changed areas and sheet overviews. We don’t keep the PDFs or the links.
4. Technical information. We record which host a request came from (ChatGPT, Claude or our website). When ChatGPT sends an anonymous user identifier, we use it in memory to apply rate limits and store only a one-way hash of it with your documents, to understand repeat use. We use your IP address in memory, for a short time, to limit how many requests can be made and to prevent abuse; we don’t store it with your documents. Our application logs record which tool was used and whether it worked, not what you sent. Our hosting may keep short-lived security logs, including IP addresses, as set out in section 6.
5. How we use it. Only to produce the result you asked for (business-day dates, your extras log and its totals, the chase plan, PDFs, the drawing comparison and your page), to send the reminders you ask for, to count which tools are used and where people come from, and to keep the free tools working and secure. We don’t sell it, we don’t use it to train AI models, and we don’t add you to a marketing list.
6. Pages and who can see them. Each result has its own page with a long, random link on plugins.getrory.com.au. Anyone who has the link can open the page and everything on it — including names, addresses, amounts, quoted text and drawing images — and download its PDFs. There is no password. We don’t publish or list these links, and we ask search engines not to index the pages. Share a link only with people you want to see it. We never send anything to your client; whoever you send a message, notice, letter or log to sees what you send them.
7. Reminder emails. On a chase plan page you can ask us to email you when each step is due. We send one email to confirm the address and send nothing else unless you confirm; unconfirmed addresses are deleted after 7 days. Each reminder has a link to stop them. When you stop reminders, we delete your address. We use the address only for that plan’s reminders. Reminder emails are delivered by Bento, our email provider in the United States, which processes your address and the email content to deliver them.
8. Attribution. Links from the free tools and their pages to getrory.com.au and getfooting.com.au carry parameters saying which tool and which host (ChatGPT, Claude or the web) the visit came from, and may include a short one-way code derived from the document — never the page link itself. We use these to count which tools bring people to our websites.
9. How long we keep it. Extras logs, chase plans and drawing comparisons, with their images and reminder addresses, are deleted automatically 90 days after the last change (adding to an extras log is a change). Each page shows the date it will be deleted. Deleted documents can remain in encrypted database backups for up to 35 days until those are overwritten; we don’t restore documents from them. To have a document deleted sooner, email us its link.
10. Where it’s stored. Free tools data is stored in AWS Sydney (ap-southeast-2). Reminder emails pass through Bento in the United States. What you share in ChatGPT or Claude, including our tools’ results, is handled by OpenAI or Anthropic under their terms, which may involve processing outside Australia.
11. Information about other people. Free tool results often include information about other people, such as your client’s name, address or what they wrote. Include only what you need, and only where you’re allowed to share it with us.
12. Your rights. Section 7 applies. Because the free tools don’t ask who you are, we may need a page link or the email address you used for reminders to find your information.

11. Changes

We may update this Privacy Policy. Material changes will be surfaced in the Service and you may be asked to re-accept.

12. Contact

Privacy questions, requests and complaints: kosta@getrory.com.au.