Privacy Policy

Last updated and effective: 20 October 2026

Lightfast Pty Ltd (ABN 35 690 889 984) ("Lightfast", "we", "us", or "our") is an Australian company that studies how people, machines, and artificial intelligence can work together. We are based in Victoria, Australia, and people read our work from around the world.

This policy explains what personal information we handle when you visit lightfast.ai (the "Site"), subscribe to our newsletter, join a waitlist, or write to us. It says who receives that information, how long it is kept, and what rights you have.

We use the Australian Privacy Principles in the Privacy Act 1988 (Cth) as our standard for handling personal information, whether or not that Act requires it of a company of our size. Where the laws of another place apply to us, such as the EU's General Data Protection Regulation, we follow those too. Sections 11.3 to 11.5 set out what that means for you.

1. The Short Version

• You can read the Site without telling us who you are.
• The Site sets no cookies. It stores one thing in your browser: whether you chose the light or dark theme, which never leaves your device.
• We learn your email address when you give it to us, and we use it only for what you gave it for. The one exception is an address a business publishes on its own website, which we may write to about business that concerns it, as Section 6 says.
• We count visits, clicks on a few links and completed forms, and measure speed, in a way that does not identify you, and not at all if your browser asks us not to.
• We do not sell personal information, show advertising, or follow you across other websites.
• We are a small company and rely on a handful of service providers, most of them in the United States. Section 7 names each one.

2. What This Policy Covers

This policy covers the Site, our newsletter, any waitlist we open, and email you exchange with us.

It does not cover:

• Other websites and platforms. We link to GitHub, X, LinkedIn, Discord, and other services. What you do there is governed by their own privacy policies.
• Products. We do not yet offer a product with accounts. Before we do, we will publish the privacy terms that apply to it and update this policy.

3. Information We Collect

3.1 Information You Give Us

• Newsletter. Your email address; the fact that you asked to receive updates and confirmed it by following the link we emailed you; when you confirmed; and which version of the sign-up wording you agreed to.
• Waitlist. If we open a waitlist, your email address.
• Correspondence. If you write to us, your name, your email address, and whatever you choose to tell us. Our contact form also accepts your company, job title and the topics you want to discuss; those fields are optional.

You do not have to give us any of this. Without an email address we cannot send you the newsletter or reply to you, and nothing else on the Site depends on it.

3.2 Information Collected When You Submit a Form

When you submit a sign-up or contact form, or confirm a newsletter sign-up, we check that the request comes from a person and not from an automated program. For that check, our security provider receives:

• your IP address;
• the technical headers your browser sends with the request, such as its name and version; and
• the email address you entered in a form, to check that it is correctly formed and that its domain can receive mail. Newsletter signups are also checked for disposable addresses.

3.3 Information Collected When You Visit

• Delivery of the Site. To send you a page, our host processes your IP address, the page you asked for, the date and time, the page that referred you, and your browser's name and version.
• Visit counts. We record page views in aggregate: the page address, the referring site, the country, region, and city suggested by your IP address, and your device type, operating system, and browser. A visit is told apart from another by a code calculated from the request. That code is discarded after 24 hours, and the statistics we see cannot be traced back to you.
• Clicks and completed forms. In the same way, we count when someone clicks one of a few links that invite them to contact us or to read our writing, and when a contact enquiry or a newsletter sign-up is accepted. Each count holds a fixed label saying which link was clicked and where on the Site it was, or which form was completed, together with the details recorded for a visit count. It never holds your name, your email address, the topics you chose, or anything you typed.
• Speed measurements. We record how quickly pages load: the page, the timing figures your browser reports, your connection speed, device type, operating system, browser, and country.
• Error reports. If something breaks, we receive the error message, the place in our code where it happened, the address of the page including any query string, your browser and operating system, the other technical headers your browser sent with the request, and any warnings the page logged. A report also carries a short trail of what the page did just before: the pages opened, the buttons and links pressed, and the requests made. We have set these reports to leave out your IP address, cookies, and anything you typed into a form.
• Diagnostic logs. When a sign-up is refused or one of our providers fails, our server records a line saying what happened and why. Contact delivery failures may include the form's submission reference so we can match a failure to its enquiry email. These lines do not hold your name, email address, IP address or message.

3.4 Information We Do Not Collect

We do not ask for or knowingly collect sensitive information, such as information about your health, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record. Please do not send it to us.

We do not collect payment details, government identifiers, or precise location. We do not buy personal information from anyone, and we do not combine what we hold with information from data brokers.

4. Cookies, Browser Storage, and Tracking Signals

The Site sets no cookies. If you choose the light or dark theme, your browser's local storage keeps that choice so the Site can show it on your next visit. It stays on your device and is never sent to us or anyone else. The Site uses no other storage in your browser. The visit counts, click and form counts, and speed measurements in Section 3.3 work without it.

We do not collect information about what you do across other websites, we do not build a history of your visits, and we do not allow anyone else to do either through the Site.

If your browser sends a Global Privacy Control or "Do Not Track" signal, the Site also leaves out the visit counts, click and form counts, and speed measurements described in Section 3.3: nothing is sent for any of them. Turning that signal on in your browser is how you object to them.

If this changes, we will update this policy first, and ask for your consent where the law requires it.

5. Why We Use Information

We do not use personal information described in this policy for advertising, for building profiles of individuals, or for training artificial intelligence models.

6. Emails From Us

The sign-up form asks for your consent before you subscribe. We then send one email to the address you entered, with a link to confirm. The address joins the list only when that link is followed, and we send the newsletter only to addresses confirmed this way. The link works for 48 hours; if it is never followed, the address is not added and we send it nothing more unless the form is submitted for it again. Every newsletter email says it is from Lightfast and includes a working way to unsubscribe. We act on an unsubscribe request promptly, and in any case within five business days. You can also unsubscribe by writing to legal@lightfast.ai.

Submitting the sign-up form again does not by itself reactivate an address that has unsubscribed: it is subscribed again only if the confirmation link sent to it is followed. Contact enquiries do not subscribe you to the newsletter.

We do not sell, rent, or trade email lists.

We may write to a business at an email or postal address it publishes on its own website, about business that concerns it. We keep that address, where we found it, our messages and any request to stop. We never give them to anyone our message mentions. Reply "stop" to any message and we won't write again.

7. Who Receives Information

We use service providers to run the Site. Each receives only what it needs for its task and handles it on our behalf. The personal information we hold is kept in their systems: we keep no separate database of our own.

We may also disclose personal information:

• When the law requires it, or when it is reasonably necessary to protect the rights, safety, or security of Lightfast, our visitors, or the public.
• In a business transfer, such as a merger, acquisition, or sale of assets. The recipient must handle the information as this policy describes, unless you agree to something else.
• With your consent, or at your direction.

We do not sell personal information, and we do not share it for advertising.

8. Where Information Goes

Lightfast is in Australia. Our service providers are mostly in the United States, and some process information in other countries where they or their own suppliers operate. Wherever you live, your information is therefore likely to be handled outside your country, in places whose privacy laws may differ from yours.

Before we send personal information overseas, we take reasonable steps to make sure the recipient will handle it in a way that is consistent with the Australian Privacy Principles, and we remain responsible for how our providers handle it. Where EU or UK law applies to a transfer, we rely on a decision that the destination provides adequate protection or on standard contractual clauses approved for that purpose. You can ask us for a copy of the safeguards that apply to your information.

9. Security

We protect personal information with measures suited to how little of it we hold: encrypted connections, access limited to the people who need it, providers chosen with care, and error reports set to leave out IP addresses, cookies, and form contents.

No system is perfectly secure. If a breach of our systems is likely to cause you serious harm, we will tell you, and we will notify regulators where the law requires it.

10. How Long We Keep It

• Newsletter and waitlist email addresses. Until you unsubscribe or ask us to delete them. After you unsubscribe we keep a record that the address is unsubscribed, so that a repeat signup does not reactivate it unless the address confirms it again. We keep that record, and the record of your confirmation, until you ask us to delete them.
• Newsletter signups that are never confirmed. We keep no list of them. The confirmation email we sent stays in our email provider's delivery records for as long as that provider keeps them.
• Sign-up security checks. 30 days.
• Error reports and diagnostic logs. Up to 90 days.
• The code that tells one visit from another. 24 hours.
• Aggregate visit counts and speed measurements. For as long as they are useful. They do not identify anyone.
• Host request logs. A short period set by our host, for security and troubleshooting.
• Correspondence. Enquiry emails, Lightfield contact details and notes, and Slack notifications are kept as long as we need them to deal with your enquiry and keep a proper record of it.

When we no longer need personal information, we delete it or remove what identifies you, unless the law requires us to keep it.

11. Your Rights and Choices

11.1 Everyone

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy, in a portable form where that is practical;
• correct it if it is wrong, out of date, or incomplete;
• delete it;
• stop sending you email.

Write to legal@lightfast.ai. We do not charge for this. We may need to confirm that the request comes from you, usually by replying to the email address concerned. We answer within 30 days. If a request is unusually complex we may need longer, and we will tell you so, and why, within those 30 days. If we cannot do what you ask, we will tell you why and how to complain.

11.2 Australia

We give you the rights of access and correction set out in the Australian Privacy Principles. If you think we have mishandled your personal information, please tell us first so that we can put it right. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au, which handles complaints about organisations the Privacy Act covers. A complaint about email you did not ask for can also go to the Australian Communications and Media Authority at acma.gov.au.

11.3 European Economic Area, United Kingdom, and Switzerland

Where the data protection law of these places applies, Lightfast Pty Ltd is the controller of your personal information. In addition to the rights in Section 11.1, you can:

• withdraw consent at any time, as easily as you gave it, by using the unsubscribe link in any newsletter email or by writing to us. Withdrawing does not affect what we did before;
• restrict our use of your information in certain cases;
• receive the information you gave us in a structured, commonly used format, or ask us to send it to someone else;
• complain to us, using the details in Section 15; and
• complain to a data protection authority: the one where you live, where you work, or where you think the law was broken. In the United Kingdom that is the ICO, at ico.org.uk.

Your right to object. Where we rely on our legitimate interests, as shown in Section 5, you can object at any time for reasons that relate to your own situation. We will then stop, unless we have compelling grounds to continue that the law recognises.

Section 5 gives the legal basis for each use, Section 8 explains transfers, and Section 10 gives retention periods. You are not required by law or by contract to give us personal information.

11.4 United States

We do not sell personal information and do not share it for cross-context behavioural advertising, and we have not done so in the past twelve months. We do not use or disclose sensitive personal information. Sections 3 and 7 list the categories of information we collect and who receives them.

If you live in California or another state with a privacy law, we will honour a request to know, correct, or delete your information whether or not that law applies to a company of our size, and we will not treat you differently for asking. If we decline a request, you can appeal by replying to our decision. We will answer the appeal in writing within 60 days, with our reasons, and if you are still not satisfied you can contact the attorney general of your state.

11.5 Canada, New Zealand, and Elsewhere

If the privacy law where you live gives you rights beyond those above, we will respect them. Write to us and say which right you want to use.

12. Automated Checks

When you submit a sign-up or contact form, or confirm a newsletter sign-up, software decides whether to accept it: it looks for signs of an automated program, limits repeated attempts from the same IP address, and checks that the email address can receive mail. If it refuses a genuine submission, write to us and a person will look at it.

We do not make decisions about you by automated means that have legal or similarly significant effects.

13. Children

The Site is written for adults and is not directed to children. Please do not subscribe or join a waitlist if you are under 16. If we learn that we hold the personal information of a child under 16 without a parent's or guardian's consent, we will delete it.

14. Changes to This Policy

We may update this policy as the Site, our providers, or the law changes. We will post the new version here with a new date. If a change materially affects how we use information we already hold, we will tell newsletter subscribers by email before it takes effect.

15. Contact and Complaints

For any privacy question, request, or complaint:

Lightfast Pty Ltd
ABN 35 690 889 984
Victoria, Australia
Email: legal@lightfast.ai

We take complaints seriously. We will acknowledge yours promptly, look into it, and tell you the outcome within 30 days. If it needs longer, we will tell you why within that time.