Privacy Policy

Your Company Pty Ltd (ABN 00 000 000 000) ("we", "us") provides Wimby. This policy explains what personal information we hold, why, and what we do with it, in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. What we hold

• About the people who use the service: name, email address, a hashed password (never the password itself), whether two-factor sign-in is on, the businesses they belong to and their role, and when they last signed in.
• Inside each business: whatever the business puts in — including contact details of its customers and suppliers. For that information, the business decides what's collected and why; we hold and process it on the business's behalf, to provide the service.
• Billing: the business's name, email and, if given, ABN and address, held by our payment processor Stripe. Card details go straight to Stripe; we never see or store them.
• Technical records: server logs (IP address, page requested, time) used to keep the service secure and working, and records of sign-in attempts used to stop password guessing.

2. Why we use it

To provide the service: to sign people in, keep each business's data separate and safe, send the emails the service needs (confirming a sign-up, invitations, password resets, trial and billing notices), take payment, give support, and meet our legal obligations, such as keeping tax records. We don't sell personal information, and don't use it for advertising.

3. Where it's kept, and who else handles it

• Amazon Web Services, in Sydney, Australia: our servers, database and backups, and the email we send (Amazon SES).
• Stripe: payments and tax invoices. Stripe may process information outside Australia, under its own privacy policy.

Both handle information only to provide their services to us. We don't otherwise disclose personal information, unless the law requires it.

4. How we protect it

Each business's data is kept apart by the database itself (row-level security), as well as by the application. Passwords are hashed; two-factor secrets are encrypted; connections use HTTPS; access to the servers is restricted and logged; and the database is backed up nightly and before every release.

5. How long we keep it

• For as long as the business uses the service.
• When a business is closed, everything in it is deleted 30 days later, along with the accounts of people who belong to no other business. Backups that still hold it are deleted as they age, within 35 days after that.
• Billing records stay with Stripe for as long as tax law requires (generally five years).

6. Your choices and rights

• You can see and correct your name and password in the app. A business's owners and admins can download everything it holds at any time.
• You can ask us for access to, or correction of, personal information we hold about you, or ask a question about this policy, at support@yourdomain. We'll respond within 30 days.
• For information a business holds about you (say, as its customer), please contact that business first.
• If you're unhappy with how we've handled a complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

7. Data breaches

If a breach is likely to cause serious harm, we'll notify the people affected and the OAIC as the Notifiable Data Breaches scheme requires.

8. Changes

We may update this policy, and will email the owners of each business about any significant change.