Last updated 2 November 2026
Privacy policy
Supermill is a product of Alex Boffa Holdings Pty Ltd, trading as Supermill Labs. ABN 66 611 895 197. We are based in Melbourne, Australia. In this policy "we" and "us" mean Alex Boffa Holdings Pty Ltd, trading as Supermill Labs. This policy explains what personal information we handle in running Supermill and this website, why, where it's kept and how to reach us about it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
What we collect
People at client companies. When a company uses Supermill, it tells us who on its team should have access. For each person we hold:
- name, work email address, role and the company they work for;
- sign-in records: when they signed in, from what IP address and browser, and whether through Google or Microsoft (we receive your name and email address from your work account, never your password);
- a record of what they do in Supermill, kept for security and support;
- questions they type or speak into Supermill. A spoken question is turned into text and the recording is then deleted.
Signing in with Google or Microsoft. When you sign in, Google or Microsoft confirms who you are and gives us your name and email address. We use them to let you into your company's Supermill, keep it secure, send service notices and show who did what there. We don't sell them, use them for marketing or share them beyond the providers listed below.
Business data a client connects. A client connects its own systems, such as its accounting system, online store, warehouse and retailer orders. This is mostly business records, but it can include personal information, such as contact names on orders and invoices or customer names and addresses on online orders. We handle it to provide Supermill to that client, under the client's agreement with us. The client decides what it connects.
People who contact us. If you email us, we keep your name, email address and what you wrote.
Website visitors. This website uses no analytics, tracking or advertising cookies. Our website host, Cloudflare, processes visitors' IP addresses and browser details to deliver the site and protect it from attacks. If we ever add analytics, we'll say so here first.
Why we use it
- to provide Supermill to our clients and let the right people sign in;
- to send service emails, such as a company's weekly operations summary and notices about a person's access;
- to keep Supermill secure, find and fix problems and answer support requests;
- to meet our legal obligations.
We don't sell personal information and we don't use it for marketing.
Where it's kept and who helps us
We use these service providers. Each handles personal information under its terms with us.
| Provider | What it does for us | Where |
|---|---|---|
| Google Cloud | Runs Supermill and stores client data and backups | Australia (Sydney; backups in Melbourne) |
| Google Identity Platform | Handles sign-in | May be stored in the United States |
| Amazon Web Services | Sends service emails; turns spoken questions into text | Australia (Sydney) |
| Anthropic | Provides the AI model that reads a question and the client data needed to answer it | United States and other countries where it operates |
| Google Workspace | Our email, including ops@supermill.ai | Google's data centres in the Americas, Europe and Asia (locations) |
| Cloudflare | Hosts this website and our domain | The Cloudflare data centre nearest each visitor, in many countries (locations) |
This means some personal information is handled outside Australia, mainly in the United States, and also in the Americas, Europe, Asia and the countries of Cloudflare's network. We may also disclose personal information where the law requires it.
How long we keep it
- Account details: while your company keeps you on Supermill.
- Sign-in, activity and security records: 12 months.
- Questions typed or spoken into Supermill: 12 months, and the person who asked can delete them sooner.
- Backups: 35 days.
- Client business data: for the term of the client's agreement, then returned or deleted as that agreement sets out.
- Spoken questions: the recording is deleted once it has been turned into text.
- Emails to us: as long as we need them to deal with your request and keep business records.
How we protect it
Connections to Supermill and this website are encrypted, and data is encrypted where it's stored. People sign in with their work Google or Microsoft account, and only people who need access to run the service have it. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner (OAIC). To report a security problem, email security@supermill.ai.
Seeing or correcting your information
You can ask to see the personal information we hold about you, or to correct it, by emailing ops@supermill.ai. We may need to confirm who you are first, and we'll respond within 30 days. If we can't do what you ask, we'll explain why. The person who manages Supermill at your company can also update your name and email address.
Making a complaint
If you're concerned about how we've handled your personal information, email ops@supermill.ai. We'll look into it and reply within 30 days. If you're not satisfied with our reply, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
Changes to this policy
When we change this policy we'll update this page and the date at the top.
Contact
- Company
- Alex Boffa Holdings Pty Ltd, trading as Supermill Labs
- ABN
- 66 611 895 197
- Based in
- Melbourne, Victoria, Australia
- ops@supermill.ai