Privacy policy
DRAFT. A lawyer must check this before launch. Written by Wren (researcher, not a lawyer) on 17 Oct 2026; 18 Oct risk review (previous version: draft-privacy-policy-2026-10-17.md; changes in terms-risk-review.md): marketing use of clients' clones is now a separate, withdrawable opt-in, no new clone videos after a client leaves, no patient/client health data, platform roles instead of passwords, and provider training opt-out. Not legal advice. Aims to meet the Australian Privacy Act 1988 and Australian Privacy Principles (APPs), the Spam Act 2003, and the UK GDPR / Data Protection Act 2018 and PECR for UK visitors, with US buyers in mind (TCPA for calls and texts). Every [NEEDS …] / [CONFIRM …] is a gap.
For the lawyer, the main questions:
- Small-business exemption: if turnover is under A$3m the Privacy Act may not apply. This draft follows the APPs anyway (UK GDPR applies regardless).
- Clone recordings (face and voice): are they biometric / sensitive information (APP 3, UK GDPR Article 9)? The draft asks for explicit consent.
- UK GDPR Article 27: do we need a UK representative?
- US: texts and any future AI caller to US mobiles need prior express written consent (TCPA; the FCC's Feb 2024 ruling covers AI-generated voices). Is the form's consent line enough?
- Applicants are routed automatically by their answers (revenue band, readiness). Does that need mentioning under the Privacy Act's new automated-decision rules?
- Which tools we actually use. Typeform, Calendly and Zoom are in the brief. Every other tool is marked [CONFIRM].
- Business name and entity (settled by the operator, 17 Oct; ABN Lookup checked by Walter and Wren, 17 Oct). ABN 78 636 258 011 is held by SAKIB, SADMAN, Individual/Sole Trader, active from 1 May 2021, VIC 3168, with registered business names "SPOTLESS DIAMOND SOLUTIONS" (from 10 Jan 2024) and "THE OMELETTE GUYS" (from 9 May 2025). "Clone Your Brand" is not yet a registered business name: register it with ASIC under this ABN before trading under it. Also check the wording "a trading name of Spotless Diamond Solutions": Spotless Diamond Solutions is itself a business name, not a separate legal entity. The legal person is Sadman Sakib as a sole trader, so the correct line may be, e.g., "Clone Your Brand is a business name of Sadman Sakib (ABN 78 636 258 011)". Prices are in USD only (operator, 17 Oct); confirm any GST or price-display rules for Australian buyers.
- Naming our tools (operator, 17 Oct: the clone tool isn't named on the site unless the law requires it). My reading: not required. UK GDPR Art. 13 asks for "recipients or categories of recipients", and APP 8 / APP 1.4 ask for the countries data is likely to go to, so the drafts describe "an AI video and voice platform, based in the United States". Lawyer: confirm. Background:
leave-terms-research.md. - How long we keep data, deliberately general (operator, 17 Oct). The operator doesn't want fixed handover or deletion periods promised, because clients' clones may be used in our marketing. The drafts say we keep data "for as long as we need it for the purposes in this policy, or as the law requires", plus the criteria we use. Why that should be enough: the APPs don't require fixed periods, but APP 11.2 requires destroying or de-identifying data once it's no longer needed. UK GDPR Art. 13(2)(a) requires the period or the criteria used to set it, which is why the criteria are listed. Lawyer: confirm.
- Using clients' clones and content in our marketing (operator, 17 Oct). The operator wants to feature clients' clones, likeness and content in Clone Your Brand's marketing, including testimonial videos spoken by the client's clone. Terms section 8 now drafts this as a separate, withdrawable opt-in the client gives when they sign up. Questions: (a) Is the separate opt-in enough (risk review moved it out of the standard terms)? Under UK GDPR, consent bundled into terms isn't "freely given", and face and voice used this way may be biometric / special-category data needing explicit consent. Under the ACL, a one-sided standard term could be an unfair contract term. (b) Can the client withdraw it, and what happens to marketing already published? (c) Is a "testimonial" spoken by the client's AI clone misleading under the ACL (s18; s29 on false testimonials) or the US FTC rules (Endorsement Guides, 16 CFR Part 255; the 2024 rule banning fake reviews and testimonials, including AI-generated ones)? The draft limits it to what the client actually said or approved in writing, and requires an AI label. (d) US state laws on the use of a person's likeness or digital replica in ads (right of publicity; New York's disclosure rule for synthetic performers in ads, cited by competitor Avatar Agency as effective 9 Jun 2026). Lawyer: check.
Last updated: [DATE OF PUBLICATION]
1. Who we are
Clone Your Brand (Spotless Diamond Solutions, ABN 78 636 258 011), based in Melbourne, Australia ("we", "us"). We're responsible for the personal information described here. Contact: hello@cloneyourbrand.com · +61 421 319 700.
2. What we collect
When you apply on our website:
- your answers: what describes you, your rough monthly revenue, whether you're in a position to invest, and what has stopped you posting
- your first and last name, mobile number and email address
- your consent to be contacted, and the date and time you gave it
- the ad or link that brought you [CONFIRM: UTM tracking]
When you book a call: the time you choose, your time zone and the details you enter in the booking calendar.
When we talk: notes from our phone calls and texts, and from the Zoom call. [CONFIRM: are Zoom calls recorded? If yes: "We record the call only if you agree at the start."]
When you visit our pages: basic technical data (device, browser, pages viewed) through cookies and similar tools. [CONFIRM: which analytics and ad pixels, e.g. Meta Pixel, Google Analytics; list them and add a cookie banner if UK visitors are tracked by non-essential cookies]
If you become a client:
- your recording(s) of your face and voice, and the AI clone made from them
- the material your clone is trained on: your stories, opinions, how you answer buyers' questions
- access to the social media accounts we post to, and their analytics
- billing details (processed by our payment provider, not stored by us) [CONFIRM: payment provider]
Your face and voice may be biometric information. We collect and use them, with your explicit written consent given at onboarding, to build and run your clone. We use them to feature you and your clone in our own marketing only if you tick the separate box for that in your order form, and you can withdraw that at any time (see our Terms, section 8). We don't let our AI provider use your recordings to train its general models where it gives us that choice. [CONFIRM: provider setting]
We don't need, and ask you not to send, your patients' or clients' personal or health information. For your social media accounts, we use each platform's own account roles or approved scheduling tools rather than your password wherever the platform offers them.
3. Why we use it (and our lawful bases in the UK)
| What we do | Why | UK GDPR lawful basis |
|---|---|---|
| Review your application and decide whether a call would help | To respond to your request | Steps before a contract; legitimate interests |
| Call, text and email you about your application and call | You asked us to, on the form | Consent (PECR for texts) and steps before a contract |
| Hold the call on Zoom and send reminders | To deliver the call you booked | Steps before a contract |
| Build and run your clone, make and post your content | To deliver your programme | Contract; explicit consent for face and voice |
| Feature clients' clones, likeness and content in our marketing | Only if you tick the separate box in your order form; you can withdraw it | Consent (explicit consent for face and voice) [LAWYER: confirm] |
| Send marketing emails (tips, the free Starter Kit, the course waitlist) | Only if you opt in separately | Consent |
| Measure and improve our ads and pages | To run the business | Legitimate interests; consent for non-essential cookies |
| Keep financial records | The law requires it | Legal obligation |
About our application: we use your answers to decide what to offer next. If your answers show now isn't the right time (for example the lowest revenue band, or "not right now"), you're shown a free resource instead of the calendar. You can still contact us and ask for a call.
4. Calls, texts and emails
By ticking "I agree to be contacted by phone, text and email about my application", you agree to us contacting you about your application only. We won't send you marketing unless you opt in separately. Every marketing email or text tells you who it's from and how to unsubscribe, and we act on unsubscribe requests within 5 working days. Reply STOP to any text to stop texts. [LAWYER: US numbers, TCPA wording; AI caller later]
5. Who we share it with
We don't sell your personal information. We share it only with the services that help us run the business, under contracts that protect it:
- Typeform (application form), Calendly (booking) and Zoom (calls), all based in the United States
- [CONFIRM: email and text provider], [CONFIRM: phone / calling app], [CONFIRM: CRM], [CONFIRM: website host], [CONFIRM: analytics and ad platforms, e.g. Meta]
- for clients: an AI video and voice platform that creates and hosts your clone (based in the United States), the social media platforms we post to, [CONFIRM: payment provider]
- our professional advisers (accountant, lawyer), and authorities where the law requires it
6. Sending information overseas
We're in Australia, and several of the services above store data outside Australia, mainly in the United States. [CONFIRM: list countries per provider] Before we use a provider we take reasonable steps to make sure it protects your information to the standard of the Australian Privacy Principles. For UK visitors, transfers are covered by [LAWYER: UK adequacy regulations / the UK International Data Transfer Agreement or Addendum / the UK–US data bridge, as applicable].
7. How long we keep it
We keep personal information for as long as we need it for the purposes in this policy, or as the law requires. To decide how long, we consider why we collected it, whether we still need it (for example to deliver your programme, to feature you in our marketing as our Terms allow, or to deal with a question or dispute), and what the law requires us to keep (for example financial records for tax). When we no longer need it, we delete it or make it anonymous.
If you opted in to marketing emails, we keep your email address until you unsubscribe.
8. Your clone and content when you stop
You own your clone and your content. When your programme ends, we stop making new content for you and remove our access to your social media accounts. Content already published on your accounts stays there. We won't make any new video with your clone unless you approve it in writing. If you gave us permission to feature you in our marketing, we may keep doing so until you withdraw it (our Terms, section 8). Everything else is kept as set out in section 7.
9. Your rights
You can ask to see the personal information we hold about you and to correct it. If you're in the UK you can also ask us to delete it, restrict or object to how we use it, or give you a copy in a portable format, and you can withdraw consent at any time. Email hello@cloneyourbrand.com. We reply within 30 days.
10. Keeping it safe
We use services with strong security, limit who on our team can see your information, and use two-factor sign-in on our accounts. [CONFIRM: accurate] If a data breach is likely to cause serious harm, we'll tell you and the regulator as the law requires.
11. Complaints
Tell us first at hello@cloneyourbrand.com (or call +61 421 319 700) and we'll respond within 30 days. If you're not satisfied:
- in Australia: the Office of the Australian Information Commissioner (OAIC), oaic.gov.au
- in the UK: the Information Commissioner's Office (ICO), ico.org.uk
[LAWYER: UK representative details here if Article 27 applies]
12. Children
Our services are for business owners. We don't knowingly collect information from anyone under 18.
13. Changes
If we change this policy, we'll update the date at the top. If a change affects how we use your information in a significant way, we'll tell clients by email.