Privacy Notice
What personal data we collect, why we collect it, where it is stored, who receives it, how long we keep it and what you can require us to do about it.
1. Who We Are
BlackSnow Intelligence is a trading style of Khufu Management Pty Ltd, incorporated in Australia and based in Brisbane. Khufu Management Pty Ltd is the controller of the personal data described in this notice. BlackSnow Intelligence is not itself a registered company; it is the name this business trades and publishes under.
- Australian Business Number: 98 676 753 683
- Australian Company Number: 676 753 683
- Registered office: 38 Miles Platting Rd, Eight Mile Plains, QLD 4113
- Privacy contact: ror@blacksnowintel.com
The governing law of this notice is the law of Queensland. Nothing in it limits a right you hold under the General Data Protection Regulation, the UK General Data Protection Regulation, the Privacy Act 1988 or the California Consumer Privacy Act, and where one of those gives you more than this notice does, it is the one that applies.
2. Our Representatives In The European Union And The United Kingdom
We have appointed a representative under Article 27 of the GDPR. Our EU representative is DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland.
We have also appointed a UK representative under Article 27 of the UK GDPR. Our UK representative is DataRep UK, 85 Great Portland Street, London, W1W 7LT, United Kingdom.
You can write to either representative at datarequest@datarep.com. Quote BlackSnow Intelligence in the subject line or in the body of your message, so that it is routed to us rather than to another company the same representative acts for.
3. Data Protection Officer
We have not appointed a Data Protection Officer, and we are not required to appoint one. We are not a public authority; our core activities do not consist of regular and systematic monitoring of individuals on a large scale; and we do not process special categories of data on a large scale. We state this rather than leave it unanswered, because an unanswered question reads the same as an avoided one.
Privacy questions are answered by the founder, who is accountable for this notice, at ror@blacksnowintel.com.
4. Information We Collect
The categories of personal data we collect are set out below. We apply a data classification to each category and we hold the smallest amount that answers the purpose it was collected for.
4.1 From Everyone Who Visits The Site
Our host writes a server log for each request: the internet protocol address, the time, the address requested, the browser's user agent string and the referring page. We use it to keep the service available and to investigate abuse. We use no advertising cookie and no third-party analytics service.
4.2 From Anyone Who Runs The BSI Calculator
When you type a domain into the calculator we record that domain, a random session identifier, the time, and the result the calculator produced. The result is the reading itself: which addresses answered, which documents could be read, what the rules established and — just as importantly — what they could not establish.
The calculator reads pages that the organisation you named has already published to the open internet. Where one of those pages publishes a contact address, that address is recorded as part of the result, because it is part of what was read. We do not go looking for individuals, we sign in to nothing, and we read nothing that is not publicly served.
We do not ask you to identify yourself in order to run the calculator, and you do not have to.
4.3 From Anyone Who Signs Up Or Contacts Us
If you sign up to keep your assessments, or ask us for access to something, we record the name, the work email address and the organisation you give us. If you write to us, we keep the correspondence and our reply.
4.4 From Professional Networks
For business development we record the name, job title, employer and profile address of a person who has published that information themselves on a professional network. We buy no contact lists, we rent none, and we use no data broker.
4.5 What We Do Not Collect
We do not collect sensitive personal information and we do not collect special categories of personal data. We do not knowingly collect anything about a child. We do not collect payment card details on this website.
5. Why We Collect It, And On What Lawful Basis
Why we collect each category, and the legal basis we rely on for it:
| Category | Purpose Of Processing | Lawful Basis |
|---|---|---|
| Server logs | Keeping the service available and investigating abuse | Legitimate interests |
| Calculator events and results | Producing the reading you asked for, and testing the rule set against what it found | Legitimate interests |
| Sign-up and access records | Answering you, and giving you the thing you asked for | Legitimate interests, and performance of a contract where one exists |
| Correspondence | Answering you, and keeping a record of what was said | Legitimate interests |
| Professional network information | Business development | Legitimate interests |
Why we collect anything at all is a fair question to ask of a company that publishes readings of other companies. Where we rely on legitimate interests we have carried out a balancing assessment and recorded the outcome. You can object to processing on that basis at any time, and we will stop unless we can show a compelling ground that overrides your interests.
We do not process personal data for any purpose other than the ones stated here. If that ever changes we will say so before it takes effect, not after.
6. Where Your Data Is Stored And Processed
This website, the BSI Calculator and the records behind them are hosted in Ireland. The application runs in the Dublin region and the database runs in the Ireland region, so records created by this website are stored in Ireland and processed in Ireland.
Research inputs are transferred to the United States, where the two model providers named in section 10 operate their services.
Backups are stored in Ireland alongside the systems they protect.
7. Transfers Out Of The European Economic Area And The United Kingdom
The European Commission has adopted an adequacy decision covering the United Kingdom, and the United Kingdom has adopted adequacy regulations covering the European Economic Area. We do not rely on an adequacy decision for our own arrangements.
Where personal data leaves the European Economic Area, we rely on the European Commission's Standard Contractual Clauses. Where it leaves the United Kingdom, we rely on the International Data Transfer Addendum to those clauses. Both are in place with every party named on our Sub-Processors page.
We carry out a transfer impact assessment before a new transfer begins, and we record the outcome of it.
8. Who Receives Your Data
We disclose personal data to the sub-processors named on our Sub-Processors page, and to nobody else. That page names every party, what it does for us and which country it is in. It is a closed list of every recipient, not an illustration of the kinds of recipient there might be.
We disclose personal data to a public authority only where the law compels it, on the terms set out in section 15.
If we are ever party to a merger or an acquisition, we will tell you before your personal data moves, and this notice continues to apply until it is replaced by one that is no less protective.
9. Automated Decision-Making And Profiling
We carry out no automated decision-making that produces a legal effect concerning you or similarly significantly affects you, and we carry out no profiling.
The BSI Calculator does produce an automated reading, but it reads organisations rather than people: it fetches published documents and applies a fixed, versioned rule set to their text. It makes no decision about any individual, and it makes no decision about the organisation either — it reports what it could establish and what it could not.
10. Artificial Intelligence
We use large language models from two providers in our research work: Anthropic and OpenAI. We use no other model provider. Where a model is used to help produce research, a person checks the output against the source before anything is published.
We do not use customer data to train models. Our accounts with both providers are configured so that our inputs are excluded from model training, and we do not permit any provider to train on what we send.
Prompts and model inputs are retained by those providers for a limited period set by each of them for abuse monitoring, and are then deleted. We keep no separate copy of a prompt.
Nothing you submit to the BSI Calculator is sent to a model provider. The calculator is a rule-based reader, not a model: it fetches published pages and applies a fixed rule set to them. No model is involved in producing a calculator result.
11. How Long We Keep It
Our retention period runs from the date a record was last used, not from the date it was created. If a record is used again, the clock restarts at that use. A record nobody has touched for the stated period is deleted whether or not anyone remembers it exists.
| Record | Retention Period |
|---|---|
| Calculator events and results | 24 months from last use |
| Sign-up and access records | 24 months from last use |
| Correspondence | 24 months from last use |
| Professional network information | 24 months from last use |
| Server logs | 90 days |
When a retention period ends the record is deleted. Deletion reaches backups, caches and archives on their own cycles, which complete within a further 90 days, and no copy of a deleted record is retained in a model. We say this because a deletion that stops at the live database is not a deletion, and a notice that only promises the live database has not answered the question.
12. How We Protect It
Personal data is encrypted in transit and encrypted at rest.
Access is role-based, granted on a need-to-know basis and on the principle of least privilege. Access controls are reviewed whenever a role changes.
Where we publish or analyse results across more than one organisation, we work from aggregated data and anonymised records rather than from identifiable ones.
Data breach notification: where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and we will notify you without undue delay where the risk to you is high.
Our Security Overview sets out the controls in more detail.
13. Direct Marketing
We do not buy, rent or licence contact lists, and we use no data broker.
Our outreach is conducted on LinkedIn, using professional information a person has published on their own profile. We send direct marketing by email only to a person who has given us their address, and every marketing communication carries a working unsubscribe route.
You can stop marketing communications at any time by replying to any message, or by writing to ror@blacksnowintel.com. We act on it on receipt, not at the end of a cycle.
14. Sale And Sharing Of Personal Information
We do not sell personal information, and we have not sold personal information in the preceding twelve months.
We do not share personal information for cross-context behavioural advertising, and we have not done so in the preceding twelve months.
We honour the Global Privacy Control. Where your browser sends a GPC signal we treat it as an opt-out request, and nothing further is required from you.
15. Government And Law Enforcement Requests
We have received no law enforcement or government request for personal data, and no national security request. We will publish a transparency report if that ever changes.
Where we receive a request from a public authority we will require it in writing, satisfy ourselves that it is lawful and binding on us, disclose no more than the request compels, and tell the person affected unless we are prohibited from doing so.
16. Your Rights
You have the right to access the personal data we hold about you, the right to correct it, the right to erasure, the right to restrict processing, the right to object to processing and the right to data portability. Under the Australian Privacy Principles you have rights of access and correction. Under the California Consumer Privacy Act you have the right to know, the right to delete, the right to correct and the right to opt out.
We answer a request within 30 days. We charge nothing for it. We ask only for enough information to be satisfied that the request really comes from you, and we do not use what you send us to verify a request for any other purpose.
To exercise any of these, write to ror@blacksnowintel.com, or to our representatives at datarequest@datarep.com quoting BlackSnow Intelligence.
17. Complaints And Appeals
If you are dissatisfied with how we have handled your personal data, write to ror@blacksnowintel.com and we will answer.
You have a right to appeal a decision we make on a request. Write to the same address and mark the message an appeal; it will be reviewed by someone other than the person who made the original decision, and we will give you the reason for the outcome in writing.
You may also lodge a complaint with a supervisory authority. In the European Union that is the data protection authority where you live or work; in the United Kingdom it is the Information Commissioner's Office; in Australia it is the Office of the Australian Information Commissioner; in California it is the California Privacy Protection Agency or the Attorney General. You do not have to come to us first, though we would rather you did.
18. When We Process Data On Behalf Of A Client
In our consulting and assessment work we sometimes process personal data on behalf of a client. In that case the client is the controller and we are the processor. We process personal data on behalf of that client strictly in accordance with their documented instructions, on the terms of our Data Processing Terms, and the nature and purpose of the processing is fixed by those terms rather than by us.
19. Changes To This Notice
This is version 1.0, published on 17 August 2026. When we change it we publish the new version at this address and move the version number and the date. Where a change is material we say what changed rather than leaving you to compare two documents.
20. How To Reach Us
Write to ror@blacksnowintel.com, or to the registered office at 38 Miles Platting Rd, Eight Mile Plains, QLD 4113. In the European Union and the United Kingdom you may instead write to our representatives at datarequest@datarep.com, quoting BlackSnow Intelligence.
Our other published documents are indexed on the Legal page.