Privacy Policy
The short version
We collect the details you give us, information about how you use our websites, courses and tools, and professional details that people publish on sites such as LinkedIn.
We use AI to answer chat messages, to run some of our products, and to help our team with its work. Section 5 describes each use.
Some decisions about access to our products are made automatically. Section 6 explains them, and you can ask us to look at one again.
We do not sell personal information.
Some of our service providers store or process information outside Australia, including in the United States and Singapore.
You can ask to see or correct your information, stop marketing, or make a complaint. Section 15 has our contact details.
1. Who we are and what this policy covers
MAGNA Performance and Risk Consulting Pty Ltd (ABN 99 636 288 938) trades as MAGNA NDIS Consultant and as MAGNA Performance & Risk Consulting. In this policy, "MAGNA", "we" and "us" mean that company.
This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers:
our website, ndisconsultant.au
our client portal, courses and online tools, including the Audit Copilot in the Audit-Ready Accelerator, The NDIS Growth Engine and The LinkedIn Referral Engine
our chat and messaging channels, emails, social media and advertising
our consulting, training and advisory work.
The website of MAGNA Performance & Risk Consulting, performanceconsulting.au, has its own privacy policy.
Our Terms and Conditions of Use, our Terms of Sale, and the MAGNA Ads Explorer v2 Privacy and Use Addendum (for information we receive through Meta's advertising tools) sit alongside this policy.
When we handle personal information for a client, the client's privacy policy applies to it. Section 9 explains how that works.
2. The personal information we collect
Depending on how you deal with us, we may collect:
Contact details: your name, email address, phone number, organisation, role and location.
Messages and enquiries: what you send us through forms, website chat, WhatsApp, SMS, Instagram, Facebook, email or LinkedIn, and our replies.
Purchases and accounts: what you buy, order and payment status, your access term, and the email address you sign in with. Our payment processor handles your card; we do not store card details.
Course and tool use: lessons you open or complete, what you enter into our tools, the questions you ask, and the answers and files our tools return.
Business information: details about your organisation, services, registration and audit preparation. This is mainly about your business, but it can include information about you and your staff.
Professional information: details professionals publish about their work, such as a LinkedIn profile, job title, employer, location and posts.
Recordings: if we record a call or live session, the recording and its transcript.
Website and email data: your device, browser, IP address, the pages you visit, how you reached our site, and whether you open our emails or click their links.
Information about other people: files you share with us, or details you enter into our tools, can include information about your staff, your clients or NDIS participants. Section 7 applies to it.
3. How we collect it
We collect personal information:
from you, when you fill in a form, chat or message us, buy something, use our portal or tools, join a session or email us
automatically, through cookies and similar tools on our websites and in our emails (section 11)
from sites where professionals publish information about their work, such as LinkedIn, using software that helps us search for and organise profiles
from clients, when they share material with us for a project
from service providers, such as our payment processor confirming a payment.
4. Why we use it
We use personal information to:
answer your enquiries and point you to resources that suit your business
sell and deliver our products, manage your access, and send receipts, tax invoices and access emails
carry out our consulting, training and advisory work
run our courses and tools, including their usage limits
send you information about our products and resources (section 10)
find NDIS and allied health professionals who may be interested in our work, and contact them, including on LinkedIn
show our advertising to relevant professionals and measure how it performs
improve our websites, products and services
keep our systems secure, prevent fraud and misuse, and meet our legal, tax and contract obligations.
We use personal information for another purpose only if you would reasonably expect it, you agree to it, or the law allows it.
5. How we use AI
We use AI in the ways described below, and each can involve personal information. When AI produces information about you, such as a summary of your enquiry, we handle it as personal information under this policy, and you can ask to see or correct it.
Our chat assistant
Messages to our website chat, WhatsApp, SMS, Instagram and Facebook are answered first by an AI assistant, built on the AI chat feature of our customer records platform. It uses what you write to answer questions and suggest resources, and it will not ask for card details or passwords. Conversations are kept in our customer records. If you want to deal with a person, email us at the address in section 15.
The Audit Copilot
The Audit Copilot in the Audit-Ready Accelerator answers questions about preparing for an NDIS audit. When you ask it a question, we send the question to Anthropic's Claude to prepare the answer. We keep a record of each question and answer, linked to your account, so we can run and improve the service and fix problems, and we count your questions to apply its daily limit. When you use its gap check, the text you provide is compared with a reference model on our server and is not kept. Please do not include names or other details that identify NDIS participants in anything you give the Copilot.
Our engines
The NDIS Growth Engine and The LinkedIn Referral Engine connect your own AI assistant, such as Claude, to our server. When you use them:
you sign in with your email address through our secure sign in provider
the details you give the engines are sent to our server, where some steps use Anthropic's Claude under our account
we keep the details you enter and the choices you approve in your engine workspace, so each step can build on the last
if you upload a LinkedIn contact list to The LinkedIn Referral Engine, we keep the cleaned list in your workspace to build your campaign files. The list can include names, profile links, job titles, employers and locations, and you must have the right to use it.
What you type into your own AI assistant is also handled by that assistant's provider, under your agreement with them.
AI tools our team uses
Our team uses AI assistants, including Claude (Anthropic), Codex (OpenAI) and Grok (xAI), to draft and check messages and documents, analyse enquiries and sales records, prepare LinkedIn comments and messages, summarise recorded calls and maintain our customer records. These tools can process your contact details, messages and purchase history. A person decides what is sent to you and how results are used.
Advertising platforms
Meta and LinkedIn use their own automated systems to choose who sees our ads. We may give Meta lists of contact details, such as people who have bought from us or replied to us, so it can reach similar professionals or leave existing customers out of an ad. Meta matches these lists with its own users.
Recordings
If we record a call or live session, we tell you before recording starts. We use a recording and transcription tool, and we may use AI to summarise the recording. We do not use recordings of clients in our marketing without their consent.
6. Decisions made by software
Some decisions about your use of our products are made by software:
Access: when your payment succeeds, access to your purchase is granted automatically to the email address you paid with. Access can end automatically when your access term ends.
Usage limits: the Audit Copilot counts the questions you ask and pauses new questions when you reach its daily limit.
Payments: our payment processor runs automatic checks that can decline a payment.
Software also helps with decisions that a person makes, or that affect you less directly. Our chat assistant chooses which resources to suggest, our tools sort and filter professional profiles to help us decide who to contact, and advertising platforms choose who sees our ads.
These decisions use your email address, purchase and payment records, usage counts and the professional information described in section 2. They do not use health or disability information. If you think a decision about you is wrong, email us and we will look into it.
7. Information about NDIS participants and other sensitive information
Our services do not need information that identifies NDIS participants. Before you share client files, registers or examples with us, or enter them into our tools, please remove names and other details that identify a participant.
If we receive health or disability information about a participant that we did not ask for, we destroy it, or remove the details that identify the person, as soon as practicable where it is lawful and reasonable to do so. Where a client engagement needs that kind of information, we agree in writing with the client how it will be handled before it is shared, and section 9 applies.
We put sensitive information into an AI tool only when the work needs it.
If you tell us about your own health or disability, we use that information only to respond to you.
8. Who we share it with
We do not sell personal information. We share it with:
Service providers that run our systems: our customer records platform (which also runs our website, emails, SMS, chat, forms and client portal), our payment processor, our email and document provider, our course video host, the sign in provider for our engines, the hosting provider for our online tools, and our website security provider.
AI providers: Anthropic, OpenAI and xAI, as described in section 5.
Advertising and social platforms: Meta, LinkedIn and Google, for advertising, website analytics and messaging.
Recording tools: the recording and transcription tool we use when we record a call.
Professional advisers: such as our accountant or lawyer, when they need it.
Clients: the results of work we do for them (section 9).
Authorities and others, as the law requires or allows: for example to prevent fraud or in connection with a legal claim.
Service providers handle information on our instructions and under their own terms. Advertising and social platforms also handle information under their own privacy policies.
Outside Australia
Our customer records platform, payment processor, course video host and sign in provider, and our AI providers Anthropic, OpenAI and xAI, store or process information in the United States. Our online tools run on servers in Singapore. Our recording tool stores recordings in data centres in Europe. Google, Meta, LinkedIn and our website security provider run data centres in many countries, including the United States and countries in Europe and Asia.
9. When we work for a client
When we handle personal information for a client, for example running an NDIS provider's advertising, managing its enquiries or supporting its operations, we act as that client's service provider. The client's privacy policy governs the information, and we use it only for the work in our agreement with the client. In our Managed Ads with Verified Leads service, enquirers' personal information is not placed in MAGNA's customer records or in any public AI tool, and it is not used to train AI models.
10. Marketing
We may send you emails or SMS about our products and resources if you have agreed, or if the law otherwise allows it, for example after you have bought from us or enquired. Every marketing email has an unsubscribe link, and you can reply STOP to an SMS or email us at any time.
We may also contact NDIS and allied health professionals on LinkedIn about our work, using the professional details they publish there. If you do not want to hear from us, reply to tell us or email us, and we will stop.
If you opt out, we stop marketing to you, but we still send messages about your purchases and access.
11. Cookies and similar tools
ndisconsultant.au uses cookies, pixels and similar tools from third parties, including Google Tag Manager, Google Analytics, the Meta Pixel and the LinkedIn Insight Tag. Google, Meta and LinkedIn use these tools to collect or receive information from our website and elsewhere on the internet, and use that information to measure visits and to target and deliver ads, including ours. Our emails record when they are opened and when their links are clicked.
To see how Google uses information from sites that use its services, visit google.com/policies/privacy/partners. To opt out of ad targeting, visit aboutads.info/choices or youronlinechoices.eu, and manage your ad preferences in your Meta, LinkedIn and Google accounts. You can also block or delete cookies in your browser.
12. Where we keep it and how we protect it
We hold personal information in our customer records system, our client portal and online tools, our email and document accounts, and the systems of the service providers in section 8. We protect it with access controls, encrypted connections and the security measures of those providers, and we limit access to people who need it for their work. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the law requires.
13. How long we keep it
We keep personal information only for as long as we need it for the purposes in this policy, or as long as the law requires. For example, we keep purchase, payment and tax records for at least five years, as Australian tax law requires. When we no longer need information, we take reasonable steps to delete it or remove the details that identify people.
14. Seeing and correcting your information
You can ask for a copy of the personal information we hold about you, including information produced by AI, and ask us to correct it. Email us (section 15). We may need to confirm your identity first, and we will respond within 30 days. If we refuse a request, we will explain why and how you can complain. If we refuse to correct information and you ask us to, we will attach a statement to it saying you believe it is wrong.
15. Complaints and contact
For privacy questions, requests or complaints, email [email protected].
MAGNA Performance and Risk Consulting Pty Ltd, Sydney, New South Wales, Australia.
Tell us what happened and what you would like us to do. We will acknowledge your complaint, look into it and reply in writing within 30 days. If you are not satisfied with our reply, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
16. Changes to this policy
We update this policy when our practices, providers or the law change, and we change the date at the top when we do. The current version is always on this page.