Privacy Policy (Australia)

Effective date: 15.11.25

We respect your privacy. This policy describes how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle EU/UK data, see the International transfers section.

1. Personal information we collect

• Account & contact: name, email, region/time zone, support communications.
• Billing: via Stripe—payment method details are handled by Stripe; we store limited transactional metadata (amount, status, last 4 digits, expiry month/year).
• App usage & device: logs (IP address, device type, OS/browser), event timestamps, error diagnostics.
• Content: the project data you add (cards, notes, attachments). This is typically not "personal information" unless you include personal details.
• API keys (BYOK): if you store an external AI key in the app, we store it encrypted locally (and/or in your chosen secure storage) and transmit only as necessary to fulfil your requests.

2. How we use personal information

• Provide, operate, and improve the Service.
• Authenticate and secure accounts; prevent fraud/abuse.
• Process payments and manage subscriptions.
• Provide support and service communications.
• Comply with legal obligations and respond to lawful requests.

3. Legal bases (APPs & consent)

We collect personal information with your consent and where reasonably necessary for our functions/activities (APP 3). You may decline to provide certain data, but some features may not work.

4. Disclosure to third parties

We may disclose limited personal information to:

• Stripe (payments), cloud/hosting and analytics providers, email/support tools.
• Professional advisers and insurers (confidentiality-bound).
• Authorities as required by law or to protect rights, safety, or security.

We do not sell personal information.

5. International transfers

Our service providers may be located outside Australia (e.g., the US, EU, or other regions). Where we disclose personal information overseas, we take reasonable steps to ensure recipients protect it in line with the APPs (APP 8). If you use BYOK with a non-AU provider, your prompts/outputs may be processed where that provider operates—review their privacy terms.

6. Data security

We use technical and organisational measures (encryption in transit, role-based access, least-privilege, audit logging) and expect our vendors to do the same. No method is 100% secure; report suspected incidents to support@plotability.net.

7. Data retention

• Account & billing: retained while your account is active and for reasonable periods for legal/accounting purposes.
• Content: retained while your account is active or until you delete/export it.
• Backups/logs: kept for limited durations for reliability and security.

8. Access & correction (APP 12 & 13)

You may request access to, or correction of, personal information we hold about you: support@plotability.net. We'll respond within a reasonable period. If we refuse, we'll tell you why and how to complain.

9. Marketing

We may send service updates and optional marketing emails. You can unsubscribe at any time.

10. Cookies & analytics

We may use essential cookies and privacy-respecting analytics to understand aggregate usage. You can control cookies through your browser.

11. Notifiable Data Breaches (NDB) scheme

If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the NDB scheme.

12. Children

The Service is not directed to children under 16. Do not sign up or submit personal information for children.

13. Changes to this policy

We may update this policy; the latest version will be posted on our website with an effective date.

14. Complaints

If you have privacy concerns, contact support@plotability.net. If unresolved, you can contact the OAIC (https://www.oaic.gov.au) for guidance or to lodge a complaint.