Localdex Privacy Policy

Effective date: 13 October 2026

Pilot version 2. This page is under legal review and will change; we will post each new version here.

1. Who we are

Localdex is a pilot service run by Resolve Holdings Pty Ltd (ABN 15 676 829 477), trading as Carbon Black Digital, based on the Gold Coast, Queensland, Australia ("we", "us"). Localdex helps people and AI agents find service businesses, read their published profiles and send quote requests that a person has approved.

This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It applies to the Localdex website, its API, MCP and A2A interfaces, and the emails Localdex sends.

Localdex is a pilot. Features change often. We will update this policy when how we handle personal information changes (see section 16).

2. The short version

• We collect what we need to run accounts, publish business listings, pass approved quote requests between customers and businesses, and run free website audits.
• Nothing is sent to a business until a signed-in person approves it. Businesses get the job details you approved. They don't get your name or email address from us.
• We don't sell personal information. We don't send marketing email. We don't use tracking, analytics or advertising cookies.
• Some data is processed overseas, mainly in the United States: AI interpretation (Anthropic) and possibly email delivery (Resend).
• You can ask to see, correct or delete your information. You can complain to us, then to the OAIC.

3. What we collect

Everyone who uses the website

• Connection data. Our website runs behind Cloudflare, which handles your IP address and request details to deliver pages and protect the service. Our database provider (Supabase) and our servers also keep standard technical logs, which can include IP addresses.
• Hashed IP address for rate limits. For website audits, we store a keyed hash (HMAC) of your IP address, not the address itself, to enforce the five-audits-per-hour limit. These counter records are deleted after two days.
• Cookies. See section 10.

You can search Localdex and view public business profiles without an account.

Account holders

• Email address and password. Supabase Auth stores your password in hashed form; we never see it.
• A display name if you give one, and simple preferences (for example, whether you're mainly finding a service or listing a business, and your email settings).
• Your organisation and business memberships and your role in each.

Customers who request quotes

• The request details you enter or approve: category, job description, suburbs or locations, dates and times, load or size details, budgets and any extra fields the selected businesses ask for.
• Your approval record: who approved, when, and a snapshot of exactly what was approved.
• Quotes and declines you receive from businesses, including their notes.
• Jobs left with us when no business matches. We keep your account, job category, locations, load, requested time and optional notes so Localdex can find a business and email you about that job. Only you and Localdex administrators can read these jobs; they are not sent to businesses.

If you use the free-text "describe what you need" box, your description is sent to Anthropic to fill in the search form (see section 7). We don't store that description. Only what you then confirm and submit is kept.

Businesses and their team members

• Business listing details you publish: trading and legal name, description, website, public email and phone, ABN or other identifiers, services, service areas, capacities, prices or pricing statements, request fields and agent connection details.
• Verification information: evidence and admin notes about identity, domain or ABN checks. Verification evidence is private. Only the resulting status (for example "verified") is public.
• Quotes, declines and notes you send to customers.
• Team invitations: the invitee's email address, role, who invited them and the invitation status.

Business listings are public by design. Once published, listing details can be read by anyone, including AI agents, through the website and our public profile (ABP) API. Don't publish personal contact details you don't want public.

People named by someone else

Sometimes someone else gives us your email address:

• Named approvers. An AI agent or API client may prepare a quote request and name you as the person who must approve it. We send you one email asking you to review it.
• Team invitees. A business owner or admin may invite you to join their business on Localdex.

We use your address only for that request or invitation. Each email explains why you received it and how to stop further requests.

Website audit users

When you submit a website URL for an Agent Readiness audit, we:

• fetch a small number of public pages from that site (at most eight requests, respecting robots.txt, identifying ourselves as ACNBot), and
• may send up to about 20,000 characters of visible page text and structured data to Anthropic to suggest business facts, and
• ask Anthropic's Claude, with web search, a few questions a customer might ask about that kind of business near the suburb found on the site, including one question about the business by its name and website.

We store the resulting report: the score, signals, suggested facts and short source quotes, and the assistant's answers with the businesses they name and the web pages they cite. These can include contact details published on the site, such as a business phone number or email. We don't store full copies of the pages. Query strings and fragments are removed from the URL you submit.

Anyone with a report's link can open it. The link isn't listed or indexed, but treat it like a shared document link.

API, MCP and A2A clients

• The client name, the organisation it belongs to, scopes, status, expiry and last use. We store only a hash of each API key. We can't recover a lost key.
• Requests made with the key, including search inputs and draft quote requests, and the responses we returned (kept so that retried requests don't create duplicates).

Activity and audit records

We record every state change to a quote request, quote or approval: who acted (person, API client or system), what changed, when, through which channel (web, REST, MCP or A2A), a request ID and the previous status. These records protect customers and businesses against disputes and duplicate actions.

What we don't collect

• Payment details. Localdex takes no payments and makes no bookings.
• Health details. Health categories (for example physiotherapy or GP appointments) ask only for the service, location and preferred time. Please don't include symptoms, medical history or other health information in a request. We don't ask for it and don't need it. If it is included anyway, we handle it as sensitive information and use it only to pass on the request you approved.
• Tracking data. We don't use analytics, advertising or cross-site tracking tools.

4. How we collect it

Most information comes directly from you when you create an account, edit a listing, search, approve a request or respond to one. We also collect it:

• from AI agents or API clients acting for a customer (draft requests and a named approver's email),
• from business owners and admins (team invitations),
• from public websites submitted for an audit, and
• automatically, through cookies and technical logs.

5. Why we use it

We use personal information to:

• create and secure accounts, including email confirmation and password reset,
• publish business listings and generate public profiles for people and agents,
• match requests to eligible businesses and pass on approved requests,
• show quotes and responses to the right people,
• send the service emails described in section 9,
• run website audits and let business owners claim and review the results,
• prevent abuse, enforce rate limits and investigate problems,
• verify businesses and moderate or suspend listings,
• keep audit records and resolve disputes, and
• meet legal obligations.

We don't sell personal information, and we don't use it for marketing. We use it for another purpose only if you would reasonably expect it and it is related to the original purpose, if you agree, or if the law requires or allows it.

6. Who we share it with

• Businesses you choose. When you approve a request, each selected business receives the request summary and details you approved, the request ID and the timezone. We don't give them your name or email address. They reply through Localdex.
• Customers. When you quote or decline as a business, the customer sees your response, notes and your public listing.
• The public and AI agents. Published business listings and public profiles.
• Named approvers. The approver sees the full draft request, the selected businesses and the name of the client that prepared it.
• Your organisation. Other members of a business's organisation can see that business's enquiries and responses, according to their role.
• Service providers who run parts of Localdex for us (section 8).
• Authorities, if the law requires it or to protect someone's safety.

7. AI interpretation (Anthropic)

Localdex uses Anthropic's Claude models for three things only:

1. Interpreting a free-text request into search fields. We send only your description (up to 2,000 characters), the list of service categories and the current time. We don't send your identity, account details, business records or request history.
2. Suggesting business facts during a website audit. We send sampled public page text from the submitted site, as described in section 3.
3. Showing what an AI assistant says about a checked business. We send customer-style questions built from the business's public name, website, service category and suburb, and Claude searches the web to answer them. We then send those answers back to Claude to list the businesses they name. We don't send your identity or account details.

AI output is a suggestion only. It never decides which businesses are eligible; our database rules do that. Interpreted details are shown to you to confirm before anything is searched or sent. Audit suggestions must be accepted, edited or rejected by the business owner before they are used.

Anthropic processes this data in the United States. Under its commercial terms, Anthropic may not train its models on our data. It deletes API inputs and outputs within 30 days, unless it needs to keep them longer to enforce its usage policy or to comply with the law.

8. Service providers and overseas disclosure (APP 8)

Before disclosing personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the APPs, mainly through the provider's contractual and data-protection terms.

9. Emails

Localdex sends service emails only. We don't send marketing or newsletters.

Job emails contain only the structured job basics and a link to sign in and see the full request. They don't contain free-text notes, custom request fields or customer contact details. Our emails contain no tracking images.

10. Cookies

Localdex uses only cookies needed for the site to work. We don't use analytics, advertising or tracking cookies. Our fonts are served from Localdex's own site, so loading a page doesn't contact Google.

All Localdex cookies are HttpOnly (page scripts can't read them) and are sent only over secure connections in production.

11. Security (APP 11)

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include:

• encrypted connections between your browser and Localdex,
• database row-level security, so each person and business can see only their own records,
• hashed passwords and API keys, and keyed hashes instead of raw IP addresses for rate limits,
• separate, limited database logins for email sending and website audits,
• an approval step before any request is sent, plus daily caps on requests and invitations, and
• private verification evidence and a restricted admin console.

No system is completely secure. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as the law requires.

12. How long we keep it

When we no longer need personal information for any purpose allowed by law, we delete or de-identify it.

13. Access, correction and deletion (APPs 12 and 13)

You can update most of your information yourself: your listing in the business dashboard, and email settings in Account settings or Business settings.

You can also ask us to:

• access the personal information we hold about you,
• correct information that is inaccurate, out of date, incomplete, irrelevant or misleading, or
• delete your account.

Contact us using the details in section 17. We will confirm your identity, respond within 30 days and won't charge you for making a request. If we refuse, we will tell you why in writing and how to complain. If we don't correct information, you can ask us to attach a statement saying you believe it is wrong.

When you delete an account, we may keep some records where we have a legitimate reason or legal duty: for example, approved requests and quotes that another person or business relies on, and audit records. Where we keep them, we remove or de-identify your details where we reasonably can.

14. Using Localdex without identifying yourself

You can search and view public business profiles without an account. You need an account with a confirmed email address to approve a quote request or run a business listing. This prevents spam and duplicate or unauthorised requests.

15. Children

Localdex is not intended for anyone under 18. Don't create an account or submit requests if you are under 18. If we learn we hold an under-18's personal information, we will delete it.

16. Changes to this policy

We may update this policy. We will post the new version here with a new effective date. If a change significantly affects how we handle your information, we will also tell account holders by email or on the site before it takes effect.

17. Questions and complaints

Contact: Josh Hockley, Privacy Officer, Resolve Holdings Pty Ltd trading as Carbon Black Digital

Email: [email protected]

If you have a privacy complaint, contact us first and give us a chance to fix it. We will acknowledge it within 5 business days and aim to respond within 30 days.

If you're not satisfied, you can complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992