Privacy and your records
Current operating statement · 9 November 2026
Who is responsible
RedRooEnergy Pty Ltd operates the RRE platform. Kenneth John Scott, Founder and CEO, is responsible for privacy enquiries and review. Email info@redrooenergy.com.au. This policy covers RRE-controlled pages, accounts, supplier workspaces, enquiry records and optional visitor analytics. Linked providers have their own notices.
What we collect and why
Public browsing does not require an RRE account. Account sign-in supplies provider-verified identity and basic profile details. Buyer and supplier workspaces hold the details, business contacts, applications, product information and evidence you enter to prepare and review those records. General questions collect an optional name, required email and message. RRE uses these records to operate the requested workspace, assess submissions, answer questions and provide support. RRE does not request passwords, identity documents or banking details through the general enquiry form. Live trading, payments and paid campaign activation remain on HOLD.
Access and sharing
You can access only workspaces and records permitted by the relevant account and company membership. Staff and reviewer access remains subject to existing roles. Only Kenneth’s configured identity may read the general enquiry inbox and CEO analytics. Existing approved agents retain their existing scoped permissions. RRE does not automatically publish company applications or evidence. An enquiry does not subscribe you to marketing. Information is shared with service providers needed to host, authenticate, store or operate the requested function, and with other parties only for an authorised purpose or where required by law. A new integration or public disclosure needs review before use.
Optional measurement and browser storage
Optional analytics starts after consent on that website address. Declining does not prevent browsing or sign-in. Privacy & analytics lets you withdraw consent and clears local measurement identifiers. Random browser IDs rotate after 30 days; stored events cover up to 90 days and expired events are removed when collection next runs. Measures include controlled page paths, broad country/Australian state, coarse device class, generic actions and active reading time. RRE analytics does not retain form values, passwords, raw IP addresses, precise coordinates or session recordings. Operational hosting and security providers may separately process network information. Required sign-in/session storage and form anti-abuse controls are separate from optional measurement.
General enquiry retention and deletion
Web enquiries become unavailable 90 days after receipt. Expired rows are removed before the next enquiry write or inbox read; this is not an exact-time background purge. Kenneth can delete an enquiry earlier on request. Early deletion records only a random reference, deletion time and test marker in protected storage separate from the active database, retained for one year and removed on the next private inbox read after expiry to help prevent a database recovery reopening it. The record contains no name, email or message. Application business backups exclude web enquiries. Provider recovery copies follow provider retention arrangements; RRE does not promise immediate or complete erasure from provider systems. Restored enquiries must remain unavailable until expiry and deletion controls have been applied. Separately sent email is governed by the mailbox arrangements, not the web-inbox timer.
Other business records
RRE retains account, supplier, evidence, review and correspondence records while their purpose remains active or retention is required for an applicable legal, contractual, dispute or security reason. Kenneth reviews necessity when a matter closes and during the annual policy review, removes unnecessary copies where the system permits, and records any reason for continued retention. These records do not all have the enquiry form’s 90-day limit. A deletion request does not silently erase existing business records or override another party’s rights. RRE will explain what can be removed, what must remain and any provider limitations.
Providers and overseas handling
The current architecture uses OpenAI for managed Sites/sign-in, Cloudflare services for hosting, D1/R2 storage and protection, and Vercel for the canonical main-domain delivery. The providers’ public notices describe processing in the United States and other jurisdictions; Cloudflare also describes the European Economic Area. RRE has not verified every account-specific storage, support or recovery location and does not claim Australian-only hosting. Countries of processing can vary with the provider and service. Contact Kenneth for the current provider register and available detail before supplying sensitive material.
Access, correction and complaints
Email info@redrooenergy.com.au with the relevant page or enquiry reference and the access, correction, deletion or privacy concern. Do not send a password or unnecessary identity evidence. RRE will verify only the identity and authority needed, assess the request, and explain the outcome and any limitations. Kenneth aims to respond within 30 days; if more time is needed, RRE will explain the reason and next step. If unresolved, ask for review and consider the Office of the Australian Information Commissioner’s available complaint pathway. This notice does not limit applicable rights.
Review and changes
Operating notice effective 9 November 2026. Kenneth owns the policy register, access/request log and annual review, and reviews material new collection, sharing or integration before activation. The published statement describes implemented arrangements and their limits; it is not a claim that every provider recovery or assistive-technology acceptance test has been completed.
Provider notices: OpenAI · Cloudflare · Vercel. OAIC privacy policy guidance.