Privacy policy

What we collect

• Account details: name, email address, password (stored only as a secure hash) and sign-in records.
• Organisation details: organisation name, members, roles and plan.
• Content you add: findings, risks, policies, evidence files, incidents, vendor records, reports and assistant conversations.
• Details of people you invite: email addresses of staff asked to acknowledge policies and vendor contacts sent questionnaires.
• Demo requests: the details you submit on our contact form.
• Technical data: IP address, browser type and timestamps used for security and troubleshooting.

Why we use it

• To provide, secure and support the service.
• To send emails the service needs: invitations, policy acknowledgement requests, reminders and alerts.
• To answer demo requests and enquiries.
• To meet legal obligations.

We do not sell personal information. We do not use customer content to train AI models.

Customer content

For information that customers put into their workspace, the customer decides what is collected and why. We process it on their behalf and only to provide the service. Each organisation's data is kept separate, and the database enforces this.

Where it is stored and who processes it

We use a small number of service providers to host and run StrikeWard. Some are based overseas or store data overseas, including in the United States. The current list is on our subprocessors page.

AI features

When you use the AI assistant, your question and the relevant records from your organisation are sent to an AI model provider to produce an answer. The assistant can only read what you can already see.

Keeping and deleting information

We keep information while your account is active and as long as we need it for the purposes above or to meet legal requirements.

• Any user can delete their own account in Settings → Security. This removes their sign-in and memberships straight away.
• Organisation owners can request deletion of the whole organisation in Settings → Security, or by emailing privacy@strikeward.com. We confirm the request with the owner and complete it within 30 days.
• Backups roll over and are cleared on their normal cycle after deletion.

Cookies and local storage

We only use storage that the service needs to work. We do not use advertising or analytics cookies, so we don't show a cookie banner.

• Sign-in session: stored in your browser's local storage to keep you signed in.
• Workspace preference: remembers which organisation you last opened.
• __cf_bm: a short-lived cookie set by our hosting network (Cloudflare) to tell people from bots. It holds no personal profile.

If we ever add optional cookies, we will ask for your consent first.

Children

StrikeWard is a business service for people aged 18 and over. We do not knowingly collect information from children. If you think a child has given us information, contact us and we will delete it.

Security

We use reasonable steps to protect information, including encryption in transit, separate data for each organisation enforced by the database, role-based access, private file storage and optional two-factor sign-in. No system is completely secure. Our security page has more detail.

Data breaches

If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

Visitors from outside Australia

If you are in the EU, UK or another region with its own privacy law, you may have rights to access, correct, delete, restrict or move your information, and to object to some uses of it. Contact us to use these rights. Where we act on a customer's behalf, we will help that customer respond to such requests.

Access, correction and complaints

You can ask to see or correct your personal information, or make a complaint, by emailing privacy@strikeward.com. We aim to respond within 30 days. If you are not satisfied with our answer, you can contact the OAIC at oaic.gov.au.

[Legal entity name], [Business address].