Privacy policy

1. Who we are

bizkick is built and operated by marinopoulos.au, an Australian business based in Melbourne, Australia. This policy covers the bizkick website, the bizkick product and everything we do with personal information around them.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

2. What personal information we collect

About you, as a bizkick user, we collect:

• your name, email address and mobile phone number
• your password, stored only as a one-way hash we cannot reverse
• your two-step verification and passkey details, so we can check it is you
• your organisation's business details: legal name, ABN, registered address and billing contact
• a record of what you did in the product: sign-ins, records you changed, and the device and IP address you did it from
• the consents you gave, with the version of the document and the date
• anything you write to us in a support message or an enquiry form

3. Personal information you put into bizkick

bizkick is a CRM, so most of the personal information in it is not yours: it is your customers', your suppliers' and your staff's. Under the Privacy Act you are the entity responsible for that information, and we hold it on your behalf.

We only use it to run the product for you. We do not mine it, sell it, or use it to train models that serve anybody else.

You are the one who must have a lawful basis for collecting it, tell those people you hold it, and answer them when they ask about it. If somebody asks us directly about a record inside your organisation, we point them to you.

4. How we collect it

Almost all of it comes straight from you: when you make an account, when you create an organisation, when you type records into the product, when you import a file, and when you write to us.

Some is collected automatically as you use the product, such as the device and IP address on a sign-in, which we keep so we can show you your own account activity and spot an intrusion.

We also receive information from your customers when they fill in one of your published forms or place an order through your shop. That information goes into your organisation, not ours.

5. Why we use it

• to give you the product you subscribed to
• to sign you in and to keep the account secure
• to take payment and to issue invoices
• to send you service messages: receipts, alerts, notifications you turned on, and notice of changes to these documents
• to answer your support requests
• to find and fix faults, and to work out which parts of the product need attention
• to meet our obligations under Australian law

We send marketing email about bizkick only where you have agreed to receive it, and every one of those carries an unsubscribe link that works.

6. Who we disclose it to

We use a small number of specialist providers to run the product. Each one gets only what it needs for its job, and each is bound to protect it.

• Stripe: payments and subscriptions. Stripe receives your billing contact and takes your card details directly. We never see or store a card number.
• SendGrid: email delivery, including the mail bizkick sends on your behalf.
• Twilio: text messages for two-step verification.
• MongoDB Atlas: the database your records live in.
• Vercel: hosting for the website, the product and the API.
• An AI model provider: the AI assistant sends the part of a record needed to answer your question. It is not used to train a public model.

We also disclose personal information where the law requires it, where it is needed to protect somebody's safety, or to a professional adviser under a duty of confidence. If our business is ever sold, personal information may pass to the buyer, and we will tell you before that happens.

We do not sell personal information to anybody, in any circumstance.

7. Overseas disclosure

We keep production data in Australian regions where our providers offer them. Some of the providers above are based in the United States and may process data there or in other countries.

Before we use a provider we check that it is bound by terms requiring protection comparable to the Australian Privacy Principles. Tell us if you need a full list of locations for your own compliance work.

8. How we protect it

• traffic is encrypted in transit, and stored data is encrypted at rest
• passwords are hashed, and card numbers never reach our systems
• two-step verification is required on every account, and passkeys are supported
• each organisation's records are separated, and access inside a bizkick account is controlled by role and permission
• access by our own staff is limited to the people who need it and is logged
• we back the platform up, and we test that the backups restore

No system is perfect. If a data breach happens that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

9. How long we keep it

• Your organisation's records: for as long as the subscription is live, then 30 days after cancellation, then we delete them.
• Account and security logs: up to 12 months, so you can review your own activity.
• Billing and tax records: seven years, as Australian tax law requires.
• Consent records: for as long as the account exists, plus seven years, because they are the proof of an agreement.
• Support messages: three years.

When we no longer need personal information for any of these purposes, and the law does not require us to keep it, we destroy it or de-identify it.

10. Cookies

The bizkick product sets the cookies it must have to work: a sign-in session, a device you asked us to trust, and your layout preferences. There is no advertising cookie and no third-party tracker in the product.

The bizkick website sets no session cookie at all. If we later add analytics to it, we will update this policy first.

11. Access, correction and choice

You can see and correct most of your own details inside the product, under your account settings. For anything you cannot reach there, write to hello@bizkick.com.au.

• Ask for a copy of the personal information we hold about you. We answer within 30 days and we do not charge for a reasonable request.
• Ask us to correct anything that is wrong.
• Ask us to delete your account. We do it unless the law requires us to keep a record, in which case we tell you which record and why.
• Turn off any notification you no longer want, or unsubscribe from marketing email.

We may ask you to prove who you are before we act on a request, because handing an account file to the wrong person is the harm this rule exists to prevent.

12. Complaints

If you think we have mishandled your personal information, write to hello@bizkick.com.au with the subject line Privacy complaint. We acknowledge within 5 business days and give you an answer within 30 days.

If our answer does not satisfy you, take it to the Office of the Australian Information Commissioner at oaic.gov.au, or by phone on 1300 363 992. You do not have to come to us first, but it is usually quicker.

13. Changes to this policy

We publish any new version on this page with a new version number and effective date. If a change materially affects how we handle your information, we email the administrators of every organisation before it takes effect.

14. Contact us

Privacy questions go to hello@bizkick.com.au. We are in Melbourne, Australia.