Privacy Policy

NextPoint IT Pty Ltd (ABN 44 692 718 988) handles personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. In this policy, NextPoint IT is referred to as "we", "us" and "our".

It covers this website at nextpointit.com.au and GhostPush, our secret sharing tool at ghostpush.com. Where we run a service for you under a separate agreement, that agreement governs how we handle data inside it.

Using either of them means you have read this policy.

Depending on how you deal with us, we may collect:

• Your name, email address, phone number and postal address.
• Your business name, ABN and job title.
• Account credentials for GhostPush. Passwords are stored hashed, never in a form we can read.
• What you write in our contact form.
• Technical data including your IP address, browser, device and the pages you visit, collected through cookies and analytics.
• Payment and billing details where they apply, which are processed by third-party payment providers rather than held by us.
• Anything else you choose to give us in the course of working together.

We do not collect sensitive information unless you consent, or the law requires or authorises us to.

Most of it comes straight from you, when you contact us, register an account, submit a form or engage us. Where it is reasonable and practicable to collect it from you directly, that is what we do.

Some is collected automatically through our website, by cookies, analytics and similar technologies.

A small amount may come from third parties: referral partners, publicly available sources, or people you have authorised to act for you.

We hold personal information to answer your enquiry, to run your GhostPush account, and to deliver and improve our consulting, development and related services.

We also use it to issue invoices and process payments, to answer enquiries, and to meet our legal and regulatory obligations.

Finally, we use it to protect the business, which covers security and fraud prevention, and for internal operations and analytics.

We disclose personal information to:

• Our employees, contractors and service providers who help deliver our services, such as hosting providers, payment processors and email providers.
• Professional advisors, meaning our accountants, auditors and lawyers.
• Government agencies and regulators, where the law requires it.
• Anyone else you consent to, or the Privacy Act permits.

We do not sell, rent or trade personal information to anyone for marketing purposes.

Some of our service providers, particularly cloud hosting and software platforms, store data on servers outside Australia. Our primary hosting infrastructure sits in data centres in Australia and the United States.

Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure that recipient handles it under the Australian Privacy Principles or a substantially similar regime.

Cookies are small text files stored on your device. We use essential cookies, including the session cookie that keeps you signed in to GhostPush, and analytics cookies to understand how people use the site.

Your browser settings control cookies. Disabling the essential ones will stop GhostPush working.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. In practice that means data encrypted in transit and at rest, secure authentication on GhostPush, access controls that limit who can see personal data, and regular security reviews.

No method of electronic storage or transmission is completely secure, and we cannot guarantee absolute security.

GhostPush encrypts your secret in your own browser before anything is sent to us, and the decryption key travels in the part of the link after the #, which browsers never transmit to a server. We therefore do not hold the key, and we cannot read the secret, the note or the passphrase attached to it. This is a property of how it is built, not a policy we could quietly change.

What we do store for each secret is the encrypted blob itself, a count of how many times it may still be viewed, and the time it expires. Once the last view is spent or the expiry passes, the record is deleted.

A consequence worth stating plainly: if you lose the link, we cannot recover your secret for you, and we cannot produce it for anyone else who asks us, including if we were compelled to.

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law requires. Once it is no longer needed we take reasonable steps to destroy or de-identify it.

Under the Australian Privacy Principles you may ask us for access to the personal information we hold about you, and you may ask us to correct anything inaccurate, out of date, incomplete or misleading.

Write to us at the address in clause 13. We will respond within 30 days, and we may need to verify who you are first.

If you believe we have breached your privacy or mishandled your personal information, complain to us first, using the details in clause 13. We will investigate and respond within 30 days.

If our response does not satisfy you, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au, on 1300 363 992, or at enquiries@oaic.gov.au.

We update this policy when our practices, our technology or the law change. The current version is always published here with the date it took effect, shown at the top of this page.

For any question about this policy, to make a complaint, or to access or correct your personal information, write to NextPoint IT Pty Ltd at privacy@nextpointit.com.au.