Privacy policy

1. Who we are

Gen4 Wu Labs (operated by Eduardo San Martin Wu, sole trader, ABN 99 378 595 436) builds AI agents, custom software and training for hospitality businesses, based on the Gold Coast, Queensland. Contact us about privacy at info@gen4wulabs.com.au.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

2. Two kinds of information

• Information about you. People who contact us, our clients and their staff we deal with, and suppliers.
• Information we handle for clients. When we build or run a tool for a venue, we may handle details of that venue’s guests and staff. We do this only on the client’s instructions, under a written agreement, and only to provide the service. The client remains responsible for telling its guests and staff how their information is used.

3. What we collect

• Contact details: name, business name, role, email, phone number.
• What you tell us: venue details, enquiries, consult notes, feedback.
• Billing details for invoices. Card payments go through our payment provider; we do not see or store card numbers.
• For client work: guest enquiries and booking details, reviews, staff rosters, supplier invoices and recipes. This can include dietary or allergy notes, which are health information. We handle these only with consent, only when the tool needs them, and we flag them for a person to deal with.

You can contact us without giving your name where that is practical, for example with a general question.

Our contact form asks for your venue name, venue type, suburb and email, and what takes the most time in your week if you choose to say. We use these only to reply and book your consult. Our website host, Netlify, stores what you send.

Our website does not use analytics or advertising cookies. Fonts load from Google Fonts, which receives your IP address when the page loads.

4. How we collect it

Mostly from you directly: by email, phone, a consult or a form. For client work, from the client’s own systems, through access the client grants and can remove. Sometimes from public sources, such as public online reviews of a venue.

5. Why we use it

• To answer enquiries and run consults, audits, builds, care and training.
• To send invoices and keep business and tax records.
• To meet our legal obligations.
• To improve our services, using information with personal details removed where possible.

We do not sell personal information. We only send marketing emails with your consent, and every one has a way to unsubscribe.

6. AI and automated decisions

Our tools use AI models to read messages and draft replies, quotes and reports. A person approves anything important before it is sent, posted or booked. We do not make decisions that significantly affect a person by automated means alone.

We use AI providers on business terms that do not use your data to train their models, and we remove personal details that a task does not need.

7. Who we share it with

Only what each one needs to do its job:

• AI model providers: Anthropic (Claude) and OpenAI, depending on which a client tool is built with.
• Website and app hosting: Netlify.
• Email, calendar and file storage: Google (Gmail).
• Accounting and payments: the providers we use to send invoices and take payments.
• Our professional advisers, such as an accountant or lawyer.
• Government or law enforcement, when the law requires it.

8. Information sent overseas

Some of these providers store or process information outside Australia, mainly in the United States. We choose Australian data regions where a provider offers them, and we take reasonable steps to make sure overseas providers protect information in line with the Australian Privacy Principles.

9. How we protect and keep it

When we build something for a client, we set it up so that:

• Client data stays in accounts the client owns wherever possible.
• Data is encrypted in transit, and at rest where the service supports it.
• Access is only for the people who need it, with two-step sign-in where the service offers it.
• There are backups, and a record of what was sent and who approved it.

We keep personal information only as long as we need it. Client work data is deleted or returned within 30 days after an engagement ends, unless the law requires us to keep it. Tax and business records are kept for five years, as the law requires.

10. Data breaches

If we suspect a data breach, we act straight away to contain it and assess it within 30 days. If it is likely to cause serious harm, we notify the people affected and the OAIC under the Notifiable Data Breaches scheme. If it involves a client’s data, we tell the client within 72 hours so they can meet their own obligations.

11. Access and correction

You can ask for the personal information we hold about you, or ask us to correct or delete it, by emailing info@gen4wulabs.com.au. We respond within 30 days. There is no charge to make a request. If we refuse, we will tell you why in writing.

12. Complaints

If you think we have mishandled your information, contact us first at info@gen4wulabs.com.au. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Changes to this policy

We will update this policy when our practices change, and the date at the top will show the latest version.