Your enquiry,
handled with care.

1. Who we are

Next Token is a registered business name (ABN 77 221 933 421), based in New South Wales, Australia (“we”, “us”). We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth).

This policy covers this website, enquiries, demonstrations and our records about customers. How we handle data on a computer or AI system we install for you is also set out in your written quote.

Privacy contact: use the enquiry form.

2. The short version

3. What we collect

When you send an enquiry

• Your name, email address and, if you give it, your agency or business
• The service and main workflow you choose, your suburb or city, and your message
• For maintenance requests, whether Next Token built the computer
• The time you sent it and your IP address, which our intake system records for security and to stop abuse

When you request a demonstration

• Details we need to verify your agency or business and book the session
• What you type or upload during the session, such as prompts, reference images or documents, and the outputs you create

Demonstrations run on a Google Meet video call. You try workflows on our machines through a temporary link in your web browser, and the link stops working when the session ends. We don’t record sessions, and we don’t use Meet’s recording, transcript or note-taking features.

When you become a customer

• Contact and billing details, your quote, invoices and payment records
• Delivery details, hardware specifications and notes about the job

When you visit the website

• Cloudflare, which delivers and protects the site, receives technical information such as your IP address, browser, the pages you view and performance measurements. This includes Cloudflare Web Analytics.
• Our web server keeps standard technical logs for security and to fix problems.

We don’t ask for sensitive information, such as health information, and we ask you not to include it. Please also leave confidential client material out of enquiries.

4. How we collect it

Mostly from you: through the enquiry form, email, calls, demonstrations and our work together. Technical information is collected automatically when you use the website. To verify an agency or business before a demonstration, we may check public information about it, such as its website and ABN.

5. Staying anonymous

You can browse this website without telling us who you are. You can send an enquiry using just a first name. To quote, invoice or supply work, we need your real details or your business’s details.

6. Why we use it

• To reply to your enquiry and assess the work you describe
• To verify agencies and businesses and run demonstrations
• To quote, supply, install, support and maintain the work you buy
• To invoice, receive payment and keep business records
• To keep the website and our systems secure and screen out spam
• To deal with complaints and legal claims, and meet our legal obligations

We only use or disclose your information for another purpose if you agree, if you would reasonably expect it and it’s related to the purposes above, or if the Privacy Act allows it.

7. Spam screening and automated decisions

Our intake system screens enquiries for spam using fixed rules, such as unexpected form fields or sales-pitch wording. It doesn’t use artificial intelligence. A flagged enquiry is set aside so we can recover it, and deleted after 90 days. If you haven’t heard back within a few business days, please contact us again.

We don’t use AI to assess enquiries, and we don’t use computer programs to make decisions that significantly affect you.

8. Who we share it with

• Cloudflare: delivers and protects the website, measures visits, and forwards email to our inbox
• Google: runs the email service we use to correspond with you, and Google Meet, which we use for demonstration calls
• Suppliers and couriers: only the details needed to order or deliver hardware for you
• Professional advisers, such as our accountant or lawyer
• Government agencies, courts or police, where the law requires or allows it
• A buyer of our business, if it is sold

We don’t sell personal information.

9. Information that leaves Australia

Our enquiry records and customer relationship system are on servers we run in New South Wales. Some information is handled overseas:

• Cloudflare, Inc. (United States): every visit to this website, including what you type into the enquiry form, passes through Cloudflare’s network. Cloudflare usually serves Australian visitors from Australian data centres, but it may process data in other countries.
• Google LLC (United States): emails you send us and our replies are stored by Google, in the United States and other countries where it runs data centres. Enquiries sent through our website form aren't emailed: we get a short alert with no details and read the enquiry in our customer records. In a demonstration, your name, video, voice and anything you share in the Google Meet call pass through Google’s servers. Google doesn’t keep a call’s video or audio unless recording, transcripts or note-taking are switched on, and we don’t switch them on.

We choose providers that publish privacy and security commitments, and we remain accountable under the Privacy Act for how they handle your information.

10. Marketing

Sending an enquiry doesn’t subscribe you to a mailing list, and we don’t add enquirers to marketing lists. If we ever send you marketing, it will only be with your consent. Every message will identify us and include a free way to unsubscribe, and we will act on it within 5 business days. Messages about your enquiry, quote or job are not marketing.

11. Cookies and analytics

Our site sets no cookies and stores nothing in your browser. Cloudflare Web Analytics measures visits without cookies. Cloudflare may set a strictly necessary security cookie if it needs to check for bots. We don’t use advertising or social media tracking pixels, and the site’s fonts are hosted with the website.

12. Security and retention

• The website and enquiry form use encrypted connections (HTTPS).
• The form has size and rate limits and spam screening.
• Only people who need your information for their work can access it.
• Enquiries that don’t lead to work are deleted within 12 months of our last contact with you. Other information is kept while we need it for our business relationship and for record-keeping, and then deleted or stripped of the details that identify you.
• We delete what you enter or upload in a demonstration, and the outputs you create, within 30 days of the session, unless you ask us to keep them for a job.
• We keep customer and financial records for at least 7 years after the transaction, as company record-keeping law requires.
• Technical logs are kept for a limited time and then overwritten.

13. Data breaches

If a data breach is likely to cause serious harm to the people involved, we will notify them and the Office of the Australian Information Commissioner (OAIC), following the Notifiable Data Breaches scheme.

14. Access and correction

Contact us to ask for a copy of the information we hold about you, or to correct it. It’s free to ask. We usually respond within 30 days, and we may need to confirm your identity first. If we refuse, we will tell you why in writing and how to complain. You can also ask us to delete your information. We will, unless the law requires us to keep it.

15. Complaints

Contact us first so we can investigate. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner on 1300 363 992.

16. Changes to this policy

We update this policy when our practices or the law change. The date at the top shows the latest version.

Use of the website is also covered by our website terms.