Legal Privacy policy.

Effective date: 18 October 2026

Operator: Louis Pont trading as Kybos (ABN 40 798 701 909) ("Kybos", "we", "us").

1. Scope and how to contact us

This policy explains how we handle personal information when people visit kybos.au, enquire about or buy our reality-capture services or hardware, use a project record or hosted 3D model, or interact with Site Atlas at sites.kybos.au. It also covers personal information collected during on-site capture, in project files provided by clients, and through our client portal where applicable.

Our services include construction-stage and existing-conditions capture, 3D walkthroughs, point clouds, Scan-to-BIM and drone documentation. Site Atlas is a browser-based project map that may combine drone and interior models with client-supplied plans, spreadsheets, photographs, brochures or reports. It may show project stages, lots or apartments, defects, listing status and repeat captures over time. Some Site Atlas projects allow visitors to register interest or request a report.

Contact us about privacy at info@kybos.au. If a client has commissioned a Site Atlas project and controls its contents or visitor enquiries, that client may also be responsible for explaining its own use of the information to affected people.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) to the extent they apply to us. This policy also describes the practices we commit to follow for information within its scope. It does not replace a client's own privacy notice for its project or marketing activities.

2. Information we collect

The information we handle depends on the service and the choices made by the client or visitor. It may include:

Enquiries and transactions: name, business, job title, email, phone, site address or location, project details, requested timing, messages, uploaded files, quote and order details, invoices, payment status and support correspondence. Kybos' public contact form asks for name, email, phone and the topic of the enquiry, and offers optional company, region, site location, timing, message and one attached file (up to 8 MB).

Project material: plans, drawings, spreadsheets, site and lot information, reports, brochures, photographs, video, aerial imagery, interior imagery, 3D models and point-cloud data supplied by a client or created during a commissioned capture. An image, plan or location record can be personal information where a person is identifiable from it, including through a face, address, vehicle registration, name, unit or property link.

Site Atlas interactions: project access details, the project and lot a visitor views or asks about, and the name, email, optional company or phone and message a visitor submits on an access or interest form, where those fields are enabled. A message or report request may be emailed to the relevant client or project contact with the relevant lot or project reference.

Technical information: IP address, browser and device information, pages requested, time of access, and error and security logs kept by our hosting providers. kybos.au uses Google Analytics to understand how the site is used: which pages are visited, how visitors arrived (for example from a search engine), the type of device and browser, and an approximate location (city or region). Google states that Google Analytics uses the IP address only to estimate location and does not log or store it. We do not use advertising tools, and Google's advertising features and signals are turned off for our analytics. Ahrefs Web Analytics also provides aggregate visitor counts without cookies or visitor identifiers that persist across days. Ahrefs states that it does not store IP addresses with analytics data. Section 10 explains the Google Analytics cookies and how to turn both analytics tools off.

Hardware orders: delivery and contact details and information needed to arrange fulfilment or support with the relevant manufacturer or distributor.

Payments: card payments are processed by Stripe or Square, and bank transfers by the banks involved. Kybos never sees or stores card numbers; we receive only the payment status and the details needed for invoices and records.

We do not ask clients to include health, identity-document, biometric, financial-account or other sensitive information in general project uploads. A client should tell us before supplying unusually sensitive material so that we can assess whether it is necessary and agree suitable handling. Site capture may incidentally record people or private details. We do not describe Site Atlas or a visual record as a facial-recognition or identity-verification service.

3. How we collect information

We collect information directly when someone contacts us, requests a quote, places an order, visits or uses a website or project, submits an interest or report request, or communicates with our team. We also receive information from clients, their staff or agents, project stakeholders, manufacturers or distributors involved in an order, and third-party service providers. On-site capture devices may record visible areas within the agreed scope at the time of attendance. Technical information may be collected automatically when a browser connects to a website or hosted project.

Where it is lawful and practical, a person may make a general enquiry without identifying themselves or may use a pseudonym. We may need a real name and contact details to issue a quote, deliver a paid service, respond to a Site Atlas lead, verify an access request, or meet legal obligations.

4. Why we use and disclose information

We use and disclose personal information to:

1. answer enquiries, scope and quote work, arrange site access, deliver capture services or hardware orders, and provide support;

2. prepare, process, host, display and share project records or Site Atlas content as instructed by the client and under the agreed project access setting;

3. route a Site Atlas visitor's request or message to the client or nominated project contact, including a project or lot reference, and respond to service issues;

4. administer accounts, access settings, billing and records; detect abuse, protect the service, investigate incidents and maintain business continuity;

5. comply with legal obligations, respond to lawful requests, manage claims or disputes and protect our rights; and

6. send service updates or marketing where permitted by law and a person's choices. Commercial electronic messages will include an appropriate way to opt out. We will not use client-controlled Site Atlas lead data for Kybos' unrelated marketing without a separate lawful basis and, where required, the client's instruction.

We may use information for another purpose if the person consents or the law permits or requires it. A client's instructions to publish or share a project do not, by themselves, establish permission to disclose personal information in it. Clients should remove unnecessary personal information from files and obtain notices, permissions and consents needed for their project and invited audience. Kybos will also apply its own legal obligations to personal information it handles.

5. Site Atlas access and visitor requests

The client can select a project sharing setting described as Off, Password or Open. In Password mode, a project uses a shared project password; it is not a separate identity check for each viewer. In Open mode, material made available through the project may be accessible without that password. Anyone receiving a link, password or exported content may be able to share it further. Clients should choose a setting appropriate to the sensitivity of their project material and check files before publication.

In practice: a project set to Off shows "not found" and its files are not served. A project set to Password shows a password page at its own address, refuses its files until a correct password is entered, and asks search engines not to list that page. A correct password keeps the visitor signed in to that project for up to 30 days through one cookie (see section 10); changing the project password signs everyone out. A project set to Open can be viewed by anyone with the link and may be found through search engines unless the project page asks them not to list it.

Where a Site Atlas visitor submits an interest, report or access request, Kybos processes the submitted details to provide the feature, including forwarding the message to the relevant client or nominated contact. The access form asks for a name and email and offers optional phone, company and message fields. The details are emailed and are not kept in the form service's logs, which record only the project and whether the message was delivered. The client decides how it responds and whether it later uses the details for sales, project administration or another purpose. The client's own privacy notice should explain those later uses. If a visitor has a question about a particular project's listing, disclosure or follow-up, the visitor should contact the project owner as well as Kybos where appropriate.

6. Who may receive information

We may disclose personal information, as reasonably necessary for the purposes above, to:

the client, its nominated users and contacts, and other people to whom the client makes a project available;

our staff, contractors and professional advisers under appropriate confidentiality or legal duties;

providers of website, client-portal, Site Atlas, 3D-model hosting, cloud storage, email, communications, analytics, payment and security services, to the extent actually used;

a manufacturer, distributor, freight provider or support provider involved in a hardware order;

where a referral partner introduced a client to Kybos, that partner, limited to the status of the referral and any fee owed to it. Project files and site information are not shared with a referral partner without the client's agreement; and

regulators, courts, law enforcement or other parties where required or authorised by law, or in connection with a dispute or business transaction permitted by law.

Our current service providers, by role:

Website hosting and contact form: Netlify (contact-form submissions and attached files).

Site Atlas: Amazon Web Services (project storage, page delivery, and the access and enquiry form service).

Email: Google (info@kybos.au).

Client portal: Bloom.

3D walkthroughs: the specialist platforms that host our 3D tours.

Domain registration: VentraIP.

DNS (domain name service): Netlify.

Website analytics: Google Analytics (Google) and Ahrefs Web Analytics (Ahrefs). How Ahrefs handles analytics data.

Payments: Stripe and Square.

Code libraries: jsDelivr, which receives a visitor's IP address and browser details when delivering files. Our fonts are served from our own website.

Section 7 explains where these providers hold information. We do not sell personal information as a product. This statement does not prevent lawful paid services that necessarily involve handling client-supplied information under the client's instructions.

7. Overseas handling

Some services involve storage, support or access outside Australia:

Site Atlas project files and its access and enquiry form service are stored in Sydney, Australia. Pages are delivered through a worldwide content delivery network, so copies can pass through servers in other countries on the way to a visitor.

Our website and its contact form, including any file attached to an enquiry, are hosted by a provider in the United States.

Email to and from info@kybos.au is provided by Google and may be stored outside Australia, including in the United States.

Code libraries used by our websites are delivered by a global provider that receives a visitor's IP address and browser details.

Website analytics is provided by Google, which processes it in the United States and other countries.

Our client portal provider is based in the United States and processes information there.

Our 3D walkthrough platforms are overseas: one stores tour data on servers in Japan and Singapore and may transfer it to other countries to provide its service; another is based in Italy (European Union) and uses analytics services in the United States.

Our domain registration provider is Australian and generally stores information in Australia; some of its service providers may be located outside Australia. Our DNS is provided by our website host in the United States.

Card payments: Stripe may transfer information to the United States, India and the European Union; Square's Australian entity may disclose information to service providers in the United States, Canada, Japan, Ireland, France, Spain and the United Kingdom.

For hardware orders, order and delivery details may be shared with the manufacturer or its distributor, which may be located overseas, including in China and Hong Kong.

Before disclosing personal information to an overseas recipient, we will take reasonable steps required by APP 8 to ensure the recipient does not breach the APPs in relation to that information, unless a lawful exception applies. Information merely routed through overseas infrastructure and information disclosed to an overseas recipient can be treated differently under privacy law; we assess the actual arrangement rather than assuming that every international data path is the same.

8. Security, retention and deletion

We take steps reasonable in the circumstances to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Those steps depend on the nature of the information and the systems involved. No internet service or storage system is risk free. Among other steps, all Kybos web addresses use encrypted (HTTPS) connections; Site Atlas project storage is not publicly readable; Site Atlas passwords are not stored, only a one-way fingerprint used to check them; and our forms filter automated spam and limit the size and rate of submissions. Our administrator accounts are protected by two-step (multi-factor) sign-in.

We keep information for the period needed to provide the service, manage the relationship and meet lawful record-keeping, dispute or security needs, then take reasonable steps to destroy or de-identify it when no longer needed and no law requires retention. Hosting periods for a Kybos record are set by the applicable quote or agreement; a hosted copy is not promised to remain online indefinitely. Our retention periods are:

Enquiries (contact and Site Atlas forms): 2 years after the last contact.

Project files (captures, models, client-supplied plans and documents): deleted 90 days after the project's hosting period ends, or 90 days after delivery where nothing is hosted. Clients who chose the offline add-on keep their own copy.

Invoices and financial records: at least 5 years, as Australian tax law requires.

Site Atlas sign-in cookies: up to 30 days (section 10).

Website analytics: detailed visit data is kept by Google Analytics for no more than 14 months; summary reports without individual visit details may be kept longer.

If we become aware of a data breach, we will investigate and take steps to contain and assess it. Where the Notifiable Data Breaches scheme applies and an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as the law requires. We may also contact a client promptly where its project information is involved so the client can meet its own obligations.

9. Access, correction and complaints

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Email info@kybos.au with enough detail to identify the information and verify your identity. We may ask for further information needed to protect others' privacy. We aim to respond within 30 days, or will explain if we need more time. Access may be refused or limited where law permits; if so, we will explain the reason and available complaint options where required.

If the information sits within a client-controlled Site Atlas project, we may refer the request to the client and assist it as required by our agreement and applicable law. That does not remove any obligation Kybos has in its own right.

To complain about our handling of personal information, email info@kybos.au with a description of the issue. We will investigate and respond within a reasonable time, ordinarily within 30 days. If you are not satisfied, or we have not responded within a reasonable time, you may complain to the OAIC (where the OAIC has jurisdiction).

10. Marketing choices and cookies

You can opt out of Kybos marketing by using the unsubscribe method in a message or contacting info@kybos.au. Service, transaction or security communications may still be sent where needed. We do not currently send marketing emails or SMS. If we start, we will only send them in line with the Spam Act 2003 (Cth): with your consent or where the law otherwise permits, identifying Kybos as the sender, and with a working unsubscribe option that we honour within 5 business days.

Cookies and browser storage. kybos.au uses Google Analytics cookies and cookieless Ahrefs Web Analytics to count visits. Our websites do not use advertising cookies.

kybos.au sets two Google Analytics cookies, _ga and _ga_LM1Z6R4PSS. They tell one visit from another without identifying you by name, and last up to 2 years. The site also stores two items in your browser for the current tab only: one remembers that the opening animation has already played; the other holds the site guide's progress (the answers you pick in Kybo's tour, such as your role, and which service pages you have seen). Neither is sent to us, and both are deleted when the tab is closed.

Site Atlas sets one cookie on a password-protected project once you enter its password, so you stay signed in to that project. It applies only to that project's address, lasts up to 30 days, and is removed when it expires or when you clear your browser's cookies.

Turning analytics off. Use the switch below to turn Google Analytics and Ahrefs Web Analytics off on this browser (the site then keeps one item in your browser to remember your choice), install Google's opt-out browser add-on, or turn on Global Privacy Control in your browser. The Google opt-out add-on applies only to Google Analytics; the switch below and Global Privacy Control apply to both tools. The site works the same with analytics off.

Analytics is on for this browser. Turn analytics off

3D walkthroughs opened from our websites are shown by the platform that hosts them. Those platforms may use their own cookies or analytics (one uses Google Analytics) under their own privacy policies.

There is no cookie banner: apart from Google Analytics and cookieless Ahrefs Web Analytics, which you can turn off as described above, the items Kybos itself uses are needed for the site to work as requested. If we add other optional tools, we will update this section first and offer a choice where the law requires it.

11. Changes

We may update this policy when our practices or legal obligations change. The updated version will be posted on our websites with a new date. Where a change is material and we have contact details, we will take reasonable steps to notify affected clients or users. A new policy does not retrospectively authorise a use or disclosure that otherwise requires consent.