Privacy Policy

In this Privacy Policy, 'us', 'we' and 'our' means Hey Sully Pty Ltd, an Australian company. It applies to this website, to the Sully mobile and web apps, and to everything we do with personal information in running our business.

We are committed to respecting your privacy. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we hold ourselves to that standard as a matter of practice regardless of whether our size obliges us to.

Personal information means information or an opinion about an individual who is reasonably identifiable. That includes obvious things like your name and email address, and less obvious things — a face or a voice in footage from a walk can be personal information too.

By providing personal information to us, you consent to us collecting, using and disclosing it as described in this policy. We may change this policy from time to time by publishing the change on this page, and the effective date above will tell you when we last did.

We may collect the following kinds of personal information:

• Contact and identity details — your name, work email address, phone number, job title and the firm you work for.
• Account details — the workspace you belong to, your role in it, your profile picture, and the tokens your identity provider issues when you sign in with a work account.
• The content of your walks — video, photos, audio, the words you say while capturing, transcripts, translations, notes, timestamps, and the location and site details attached to a capture.
• The outputs we produce from that content — summaries, action items, subtitles and dubbed audio.
• Connection details — the Microsoft or Google account you authorise us to deliver finished walks into, and where in it you want them to land.
• Billing details — your plan, your billing contact and your payment history. Card details go directly to our payment provider; we never hold them.
• Technical information — IP address, device and browser type, pages viewed, and standard server log data.
• Correspondence — what you write to us when you email us, request a demo, ask for support, or apply for a job.

We do not seek out sensitive information, and we ask that you do not send it to us unless it is genuinely necessary. Health information, criminal records and similar categories carry stricter obligations, and a site walk rarely needs them.

We collect most personal information directly from you: when you email us, when you create an account or are added to a workspace, when you capture or upload a walk, when you connect a destination, and when you pay us.

Some information arrives from third parties. Your workspace administrator or employer may add you to a workspace and give us your name and work email. Your identity provider — usually Microsoft — tells us who you are when you sign in. Recruiters and referees may give us information when you apply for a role with us.

We also collect some information automatically. Our servers log requests, and our websites use cookies as described below. If you allow analytics cookies, our analytics provider also records how you move through the web app — the pages you open and where you click — so we can see where the product is confusing or broken. Anything you type, the imagery from your walks and your summary text are masked out of those recordings before they leave your browser.

Sully is bought and run by firms, so much of what we hold about you may have been provided by your employer rather than by you. If you would like to know what we hold, the section on access and correction below applies either way.

We collect, hold, use and disclose personal information in order to:

• Give you access to Sully, and process the walks you capture — transcribing the audio, reasoning over the visuals, and drafting a summary and action items.
• Deliver finished walks to the destinations you have connected, and to the people you share them with.
• Keep your account secure, verify who is signing in, and detect and prevent misuse.
• Support you when something goes wrong, and send you service, security and administrative messages.
• Bill you, and keep the records tax and corporate law require us to keep.
• Operate, protect and improve the product, including diagnosing faults and understanding which parts of Sully are actually used.
• Send you product updates and other information you have asked for, or that we think is relevant to your work. You can opt out at any time.
• Consider your application if you apply for a job with us.
• Comply with our legal obligations, resolve disputes and enforce our agreements.

The footage, audio and notes you capture belong to your firm, not to us. We hold them to run the service for you, and we act on your instructions in doing so.

A walk often captures more than the building. Someone may pass through frame; a voice other than yours may end up on the audio. Where that happens, the firm doing the capture is the one with the relationship to those people, and is responsible for having the right to record and share what it records. If you need to remove a person from a walk, tell us and we will help.

We do not sell personal information, and we do not use the content of your walks to train general-purpose AI models — ours or anyone else’s. We use it to produce your outputs and to run the service.

Sully drafts; a named professional reviews and signs. Nothing we produce is a finished report, and we do not make automated decisions that have a legal or similarly significant effect on anyone.

Producing a summary means sending parts of a walk to specialist providers: the audio to a transcription service, the video and transcript to a visual reasoning model, and the result to a language model that drafts the summary. Which providers, and what each one sees, is set out in the disclosure section below.

Those providers process content on our instructions, under commercial terms, and only to return a result to us. We configure their services so your content is not used to train their models and is not retained beyond what is needed to produce the output.

Providers change as the technology does. When we add or replace one, we update the list below, and if the change is significant we will say so on this page before it takes effect.

We may disclose your personal information to:

• Our employees and contractors, on a need-to-know basis.
• The providers listed below, who help us run Sully and our business.
• Other members of your workspace, and anyone you share a walk or a summary with. What is visible inside a workspace is controlled by your firm, not by us.
• The destinations you connect — when you send a finished walk to Teams, Outlook, OneDrive, Gmail or Drive, it goes into your organisation’s account and is governed by that provider’s terms from that point on.
• Our professional advisers, such as lawyers and accountants.
• Anyone to whom our business or assets are transferred, if we are ever sold or merged.
• Government agencies, regulators and law enforcement, where required, authorised or permitted by law.

Our current providers, what each one is for, and where it operates:

• Google Cloud Platform — Hosting, file storage, our database and encryption keys — the primary home of your walks and your account. (Australia (Sydney))
• Google Cloud Vertex AI (Gemini) — Reasoning over the visuals in a walk, primed with the transcript. (Google’s global endpoint — not residency-guaranteed)
• Google Cloud Text-to-Speech — Generating dubbed audio in your workspace’s languages. (Australia (Sydney))
• ElevenLabs — Transcribing the audio from a walk, including speaker timing. (United States)
• Anthropic — Turning the transcript and visual analysis into a summary and action items. (United States)
• Vercel — Serving this website and the Sully web app. (United States (global edge network))
• Microsoft — Signing you in with your work account, and delivering finished walks to Teams, Outlook or OneDrive when you connect them. (Your Microsoft tenant)
• Stripe — Taking subscription payments. We never see or store your full card number. (Australia and United States)
• Resend — Sending account, security and service email. (United States)
• Cloudflare — DNS and network protection for our domains. (Global network)
• PostHog — Product analytics, feature flags and error diagnostics — how Sully is used and where it fails. With your consent it also records how you move through our web app, with anything you type, the imagery from your walks and your summary text masked out of the recording. It receives technical telemetry about our AI processing steps — which model ran, how long it took and how many tokens it used — not the content of your walks. (United States)

Your walks, your account and our database are stored in Australia, in Google Cloud’s Sydney region. That is where the record lives, and we do not move it.

Processing is a different question, and we would rather be precise about it than round it up to "Australian". Three steps in producing a summary leave the country: the audio goes to a transcription provider in the United States, the summary is drafted by a provider in the United States, and the visual analysis runs on Google’s global Vertex AI endpoint, which Google states does not support data residency requirements. Our website hosting, email, payment and product-analytics providers are also United States companies operating global infrastructure — the analytics provider receives your email address, how you use the product and, with your consent, the masked session recordings described above, but not the content of your walks.

So while your walks are stored in Australia, personal information contained in them may be disclosed to recipients in the United States and, across globally distributed networks, other countries where those providers operate.

We take reasonable steps to ensure that any overseas recipient handles your personal information in a way consistent with the Australian Privacy Principles, including by contracting with them on terms that require it. We have not asked you to waive that protection.

We hold personal information in electronic form, in the cloud infrastructure described above. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, modification or disclosure.

In practice that means:

• Encryption in transit and at rest, with encryption keys managed in a dedicated key management service.
• Every record scoped to a workspace, so one firm’s data is not reachable from another’s.
• Sign-in through your own identity provider, so your organisation’s password and multi-factor rules apply to Sully too.
• Least-privilege internal access, granted to the few people who need it to operate or support the service, and logged.
• Separate production and development environments, with no customer data in development.

No system is perfectly secure. If we ever suffer a data breach likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

We keep the content of your walks for as long as your workspace exists, because a site record is worth most years after it was made. If your subscription lapses, processing pauses, but what you have already captured stays viewable, searchable and exportable.

When you ask us to delete a walk or close a workspace, we delete the content and the personal information in it, other than what we are required to keep — billing records, for example — or what survives in backups until those expire on their normal cycle.

We keep account and correspondence records for as long as we need them for the purpose they were collected for, and then destroy or de-identify them.

If you ask us for product updates, or you deal with us as a customer, we may send you email about Sully. Every one of those has an unsubscribe link, and you can also just reply and ask us to stop.

We do not sell or rent your details to anyone for their own marketing. If you would rather we did not use your information for marketing at all, email us at hello@heysully.ai.

We record standard information about visits to this website — pages viewed, time of visit, and the IP address assigned to your device. We do not use that browsing information to identify you personally.

This website does not require an account, and its forms do not post to us: the newsletter and demo forms open an email in your own mail client, addressed to us. Nothing you type into them reaches us unless you send that email.

We use cookies, which are small files stored on your device. The consent banner splits them into three categories: strictly necessary cookies that make the site work, analytics cookies that tell us how the site is used, and marketing cookies that measure how our pages and campaigns perform. Only the strictly necessary ones are set unless you allow the others, and your choice is itself stored in a first-party cookie for twelve months so we do not have to ask again.

Allowing analytics cookies also turns on session recording in our web app, described above under how we collect information. Declining them, or withdrawing consent later, stops the recording and clears the analytics cookies from your device.

You can clear or block cookies through your browser at any time. Parts of the site may not work as intended if you block the strictly necessary ones.

This website links to sites we do not operate, including AI assistants you can ask about Sully and social platforms you can share a page to. Those links are provided for convenience. We are not responsible for the privacy practices or the content of those sites, and their policies will differ from ours. Read them before you use them.

You can ask us for the personal information we hold about you by emailing hello@heysully.ai. We may need to verify your identity first. Occasionally we may not be able to give you access to all of it — if that happens, we will tell you why.

If you think something we hold about you is wrong, tell us and we will take reasonable steps to correct it.

Where the information sits inside a workspace your firm controls, your firm may be able to correct or delete it faster than we can, and we may refer you to your workspace administrator first.

If you think we have breached the Privacy Act, or you are unhappy with how we have handled your personal information, email hello@heysully.ai with your name, your contact details and a clear description of the problem. We will acknowledge it, look into it, and respond within a reasonable time.

If we cannot resolve it to your satisfaction, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au.

Privacy questions, requests and complaints all go to the same place:

• Hey Sully Pty Ltd
• Attention: Privacy Officer
• hello@heysully.ai