Version 2.0 · Last updated 26 May 2026 · Drawn Mind Solutions Pty Ltd · ACN TBA · Brisbane, Australia
Read alongside our Terms of Service, Sub-processor list, and Data Processing Agreement template.
Drawn Mind Solutions Pty Ltd (“Drawn”, “we”) is bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). This policy is our APP 1.3 statement of how we manage personal information. It applies to every visitor, prospect, and customer of the Drawn platform.
Complaints process: if you believe Drawn has breached the APPs or this policy, email privacy@drawn.com.au with the subject line “Privacy complaint”. We will acknowledge your complaint within 5 business days, investigate, and provide a written response within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) on 1300 363 992.
Policy versioning: this is version 2.0, effective 26 May 2026. Prior versions are available on request from privacy@drawn.com.au.
Where lawful and practicable, you may deal with Drawn anonymously or under a pseudonym:
Drawn collects four classes of data:
Why we collect this (APP 3.2): each class above is reasonably necessary for Drawn to perform the service you have asked us for. We collect only the minimum needed.
Sensitive information (APP 3.3): Drawn does not solicit sensitive information (health, racial or ethnic origin, religious beliefs, sexual orientation, criminal record, biometrics). In practice, a connected voice agent may incidentally capture sensitive information when a caller discloses it. Where this happens we treat that information as sensitive under the APPs — same encryption, same isolation, never used for industry aggregation, and de-identified on the retention TTL. If you operate in a sensitive-data industry, you must obtain caller consent to recording and to Drawn’s processing as part of your own opening disclosure — Drawn does not collect that consent on your behalf.
Data from connected systems (APP 3.6): when you connect a third-party system (Retell, Twilio, a Supabase database), Drawn collects personal information about your customers from that system. You warrant that you have an APP 5- compliant collection notice in place authorising that onward disclosure to Drawn and our sub-processors, and you agree to update your own privacy policy to name Drawn and Anthropic as additional processors before activating the connector. The connector wizard records your written confirmation.
If Drawn receives personal information that we did not ask for — for example, a connected database returns a table we didn’t request, or a support email contains a customer list we have no need for — we will assess within a reasonable time whether we could have collected it lawfully under APP 3. If we could not, we destroy or de-identify it as soon as practicable. If we could, we treat it as if it had been solicited. The generic Supabase connector samples only the tables you nominate; tables outside that nomination are never read.
This is Drawn’s standing APP 5 collection notice. It applies every time Drawn collects personal information from you, your business, or from a connected system:
Primary purpose. Drawn uses your personal information to deliver the service you signed up for: answering and analysing your calls, learning facts about your business, generating briefings, and reshaping your dashboard to your habits.
Secondary use — industry aggregation (consent-based). Drawn can contribute anonymised, redacted patterns from your data to an industry-wide layer so other businesses in your category inherit useful defaults. This is a use related to but not the same as the primary purpose. We rely on your consent under APP 6.1(a):
Other disclosures (APP 6.2). We will only disclose your personal information beyond the sub-processors listed in §13 where: (a) you have consented; (b) a secondary purpose is directly related to the primary and you would reasonably expect it; (c) it is required or authorised by Australian law; or (d) a permitted general situation under s16A of the Act applies.
No selling. Drawn does not sell personal information.
Drawn sends two kinds of email:
Email privacy@drawn.com.au with “unsubscribe” in the subject line and we will remove you from all marketing within 5 business days. On request we will tell you the source of your contact details (APP 7.5).
Drawn hosts your data in Australia where possible. Your Supabase project sits in ap-southeast-2 (Sydney). Static-asset edge caches sit on Vercel’s global network; persistent customer data doesn’t flow through those caches.
Personal information leaves Australia in one circumstance: when Drawn sends a call transcript, uploaded document, chat message, or sampled connector row to Anthropic PBC’s inference API in the United States. The request body is in transit there for the seconds it takes to receive the response, then dropped. Anthropic’s contractual commitment is not to train on customer API inputs by default — verify directly at anthropic.com/legal.
Accountability under APP 8.1. Drawn remains accountable for Anthropic’s acts and practices in relation to your personal information as if Drawn had performed them ourselves. The steps we have taken: (a) using Anthropic’s Commercial Terms which include data-processing commitments materially equivalent to the APPs; (b) using only the API tier with the no-training default; (c) sending only the minimum text needed for each request; (d) not sending raw caller phone numbers; (e) maintaining the right to a written DPA on request.
No other overseas recipients. Supabase is configured AU-region; Vercel’s edge proxy touches request bodies in transit only (no persistent storage of customer content); Retell / Twilio data stays with that provider under your direct contract with them.
Drawn collects your ABN to verify that the account belongs to a real Australian business and for tax-invoice purposes. Drawn does not adopt your ABN as our own identifier for you (we use an internal account UUID instead) and does not disclose your ABN except to our payment processor and as required by Australian tax law. Drawn does not collect TFN, Medicare, driver-licence, or passport numbers.
Drawn takes reasonable steps to keep personal information accurate, up-to-date, complete, and relevant:
Drawn takes reasonable steps under APP 11.1 to protect personal information:
Destruction & de-identification (APP 11.2). When Drawn no longer needs personal information for any permitted purpose, we destroy or de-identify it per the retention schedule in §14. Disconnecting a connector additionally soft-deletes every fact extracted from that connector; the next retention cron sweeps them.
Notifiable Data Breaches (Part IIIC). If Drawn becomes aware of an eligible data breach — unauthorised access or disclosure of personal information likely to result in serious harm — we will: (a) contain it; (b) assess within 30 days whether the “serious harm” threshold is met; (c) notify the OAIC and every affected individual as soon as practicable, by email and in-dashboard banner, with the matters required by s26WK of the Act. We maintain a written incident- response runbook available on request as part of a customer DPA.
Drawn uses these third-party services to process your data. Each is contractually bound to handle the data only on Drawn’s instructions. A version-pinned list lives at /legal/sub-processors.
We will notify you at least 30 days before adding a new sub-processor that processes customer content. If you reasonably object on data-protection grounds, you may terminate this agreement and receive a pro-rata refund of pre-paid fees.
Retention TTLs are enforced by a nightly cron job. The cron’s code is reviewable; ask for the deployment log if you need it for an audit.
If you are a registered health practitioner (AHPRA-bound) or registered tax agent (TASA-bound), additional obligations apply to the data you hand Drawn. Drawn’s base posture supports both regimes — RLS isolation, retention TTLs, audit-trailed corrections, encryption at rest. For a written addendum mapping Drawn’s controls against your specific regulator, email privacy@drawn.com.au. We’ll send you the AHPRA / TASA / Privacy Act addendum and arrange a written DPA before you sign.
We’ll email you and post a notice in the dashboard at least 14 days before any material change to this policy takes effect. Non-material changes (typos, link fixes) we’ll just push. Each version is numbered and dated at the top of this page; superseded versions are retained on request so you can see exactly what changed and when.
Privacy questions, DPA requests, complaints: privacy@drawn.com.au. Anything else: hello@drawn.com.au.