This policy explains how 23Labs handles personal information when you visit www.23labs.co, contact us, or work with us.

1. Who we are

23Labs ("we", "us", "our") is a software and automation studio based in Melbourne, Australia. We work with businesses across Australia and New Zealand, mostly remotely.

We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you are in New Zealand, we also aim to respect the information privacy principles in the New Zealand Privacy Act 2020.

You can contact us about privacy at any time at hello@23labs.co.

2. What we collect

We only collect what we need to respond to you, run our website and deliver our services.

When you use our contact form, we collect:

  • your name (required)
  • your work email address (required)
  • your company name (optional)
  • your phone number (optional)
  • what you are trying to improve (required). The message needs to be more than a few words before the form will send.

The form also includes a hidden field that is not shown on the page. It is there to catch automated spam. If that field is filled in, we discard the submission and do not email it. We do not keep it as information about you.

When you first interact with the form, we note the time. We use that only to reject submissions that arrive too quickly. The time is not included in the enquiry email, and we do not store it after the request.

To limit repeated submissions, the site briefly uses your IP address. That count is held in the server's memory for the limit only. It is not included in the enquiry email and it is not used for analytics.

When you email us directly, we collect the contact details you send and whatever you choose to tell us.

When you are a prospect or client, you may share information about your business, your team, your processes and the systems you use. This can include names, work contact details and job titles of your staff, and sometimes access to business systems or sample data so we can scope or deliver a project. We only ask for what the work needs.

When you browse our website, we collect usage information through Google Analytics, using Google's default setup. That can include:

  • pages you visit, how long you stay, and how you got to our site (for example, from a search engine)
  • general device and browser information, approximate location at city or region level, and your IP address, which Google processes to provide the service
  • certain actions, such as a contact form that sends successfully, or a click on our email address. Those events do not include your name, email address or message.

We do not use this to identify you personally, and we do not combine it with the details you type into the contact form.

Our own code does not keep a record of every page you view. The platform that hosts the site may keep ordinary technical request logs, such as an IP address and the page requested, so the site can stay available.

You do not have to contact us. You can browse the site without giving us personal information. The contact form will not send unless it has your name, a work email address and a message. If you email us instead, you choose what to include. If we do not have a way to reply, we may not be able to help.

We do not knowingly collect sensitive information, such as health information, through our website. Please do not include it in the contact form. If you send us information we did not ask for and do not need, we will delete it or de-identify it where it is lawful and reasonable to do so.

3. How we use your information

We use personal information to:

  • reply to your enquiry and talk about your project
  • prepare proposals, quotes and scoping work
  • deliver, support and invoice for our services
  • run, secure and improve our website, including understanding which pages are useful
  • meet our legal, tax and accounting obligations.

We may send business-to-business marketing and follow-up emails. Every marketing email includes a way to unsubscribe, and we honour unsubscribe requests promptly.

We do not sell your personal information, and we do not share it with others for their own marketing.

4. Who we share it with

We use service providers to run the website and to operate the business. They handle information for those purposes.

  • Vercel (Vercel Inc.) hosts the website, including the contact form.
  • Resend (Resend, Inc.) emails the contact form submission to our inbox. That email contains the form fields above. It does not include your IP address.
  • Zoho Mail hosts our business email, hello@23labs.co.
  • Google Analytics (Google LLC) provides website usage statistics.
  • HubSpot and Instantly are used for customer relationship management, lead management and sales outreach.
  • We use cloud-based project and document management tools.

We may also share personal information:

  • with professional advisers, such as our accountant or lawyers, where needed
  • with subcontractors, where necessary to deliver a client project, limited to the information they need and subject to confidentiality obligations
  • when the law requires or allows it, for example to respond to a valid legal request, or to protect someone's safety or our legal rights
  • if the business is sold or restructured, with the new owner, who would need to keep handling it in line with this policy.

5. Overseas disclosure

Some of these providers store or process information outside Australia and New Zealand. Vercel, Resend and Google are based in the United States, and they may process data in the United States and in other countries where they or their infrastructure providers operate.

Zoho Mail hosts our business email and may store or process that information outside Australia and New Zealand.

HubSpot, Instantly, and the cloud-based project and document management tools we use may store or process information outside Australia and New Zealand, including in the United States.

We choose established providers. Overseas privacy laws may not be the same as Australian law. By using our website or sending us an enquiry, you acknowledge that your information may be handled overseas in this way.

If you are in New Zealand, your information is handled by 23Labs from Australia and by the providers named above, who may store it outside Australia and New Zealand.

6. Cookies and analytics

Cookies are small files that a website stores in your browser.

This website does not set its own advertising cookies, and we do not use social media tracking pixels. Links to our LinkedIn and Instagram pages are ordinary links. Those sites apply their own privacy policies once you visit them. Our fonts are delivered with the website, so loading a page does not contact a separate font service.

We use Google Analytics 4 to understand how people use the site. With the default setup, Google Analytics sets first-party cookies, usually named _ga and _ga_<ID>, which last up to two years. They help tell new visits from returning ones. Google's privacy policy explains how it handles this data: policies.google.com/privacy. You can also read how Google uses information from sites that use its services: policies.google.com/technologies/partner-sites.

You can stop Google Analytics in several ways:

  • install Google's opt-out browser add-on: tools.google.com/dlpage/gaoptout
  • block or delete cookies in your browser settings
  • use a browser or extension that blocks analytics scripts.

The website still works if you do any of these.

7. How we keep information secure

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include:

  • encrypted (HTTPS) connections for the website
  • spam and abuse protection on the contact form

No system is completely secure. If a data breach is likely to cause serious harm, we will act quickly to contain it and will notify affected people and regulators where the law requires.

8. How long we keep it

We keep personal information only as long as needed for the purposes described, or as required by law, including tax and accounting record-keeping, and then delete or de-identify it.

9. Client projects

When we build software or automation for a client, we may handle information about that client's own customers or staff. In that case we handle it for the client. How that is managed for a particular project is a matter for the agreement with that client.

If you are a client's customer and have a question about your information, please contact that business first. We are happy to help them respond.

10. Accessing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. Email hello@23labs.co. We may need to confirm who you are first. We will acknowledge your request promptly, and we aim to respond within 20 working days. If a complex request needs reasonably longer, we will tell you. There is no charge to make a request, and we will only charge for providing access if we have told you about the cost first and it is reasonable. If we cannot give you access or make a correction, we will explain why, unless it would be unlawful or unreasonable to do so.

11. Questions and complaints

If you have a concern about how we have handled your personal information, please email hello@23labs.co with the details. We will acknowledge complaints promptly and aim to respond within 20 working days, and will let you know if we need more time for complex matters.

If you are not satisfied with our response, you can contact:

  • Australia: the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, phone 1300 363 992
  • New Zealand: the Office of the Privacy Commissioner, www.privacy.org.nz, phone 0800 803 909

12. Changes to this policy

We may update this policy from time to time, for example if we start using a new service. We will publish the latest version on this page.

13. Contact us

23Labs
Email: hello@23labs.co
Melbourne, Victoria, Australia
Website: www.23labs.co