Privacy Policy

1. About this policy

This policy explains how Keywicket Operator [placeholder entity name] (ABN to be confirmed) ("Keywicket", "we", "us") handles personal information when you use the Keywicket website and service. We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), whether or not the small business exemption might apply to us. For customers in New Zealand we also follow the Information Privacy Principles (IPPs) in the Privacy Act 2020 (NZ), which applies to overseas agencies carrying on business in New Zealand.

2. What we collect

About you, as a Keywicket user

• Your name, work email address and the identifier of the Microsoft or Google account you sign in with.
• Your organisation's tenant or domain identifier, and your role in your Keywicket workspace.
• What you add: comments on findings, approvals, help questions and messages you send us.
• Billing details you give Stripe if you open checkout. Card details go to Stripe; we never see them.
• Technical information that Cloudflare processes to deliver and secure the site, such as IP address and browser type. We don't use analytics, advertising trackers or third-party cookies.

About people in a tenant you connect

When you connect Microsoft 365 or Google Workspace, Keywicket reads directory metadata about your organisation's people and apps: names, email addresses and user principal names, object IDs, account status, admin roles, which types of MFA method are registered, sign-in and login dates, and the names and owners of apps with access. Keywicket never reads mail, files, chat or calendar content, and never receives passwords.

For this information you, as the customer, decide what is connected and why; we handle it to provide the service to you. If you're an employee and your details are in a tenant someone has connected, please contact your employer first. We'll help them respond to your request.

3. How we collect it

Directly from you; from Microsoft and Google through the read-only access an administrator authorises; and from Stripe and Resend about the status of payments and emails.

4. How we use it

• To provide Keywicket: run scans, show findings, produce reports and send alerts and invites.
• To sort your comments on findings into a category, and to answer help questions, using Cloudflare Workers AI. Only the comment or question text is sent; directory data is not.
• To respond to support, privacy and security enquiries.
• To keep the service secure, detect misuse and comply with the law.
• To manage billing once paid plans begin.

We don't sell personal information, use it for advertising, or send marketing emails without your consent. Keywicket doesn't make decisions about individuals that have legal or similarly significant effects.

5. Who we disclose it to

We use these service providers to run Keywicket: Cloudflare (hosting, database, job queue and AI), Resend (email delivery) and Stripe (billing). Microsoft and Google are the sources of tenant data and provide sign-in. Details are on the security and data handling page. We may also disclose information if the law requires it, or to protect someone's safety. If Keywicket is sold or transferred, we'll tell you before your information becomes subject to a different privacy policy.

6. Overseas disclosure (APP 8 and IPP 12)

Keywicket's database is placed in Cloudflare's Oceania region, but Cloudflare's network may process data in other countries, including the United States. Resend is based in the United States and sends Keywicket's email through its Tokyo region. Stripe may process billing information in the United States, Ireland and Australia. Microsoft and Google operate globally.

We choose providers that make contractual commitments to protect personal information and that publish security and privacy terms. For New Zealand customers, we rely on those commitments to give comparable safeguards to the NZ Privacy Act. By using Keywicket you acknowledge these disclosures.

7. How we keep it secure

Connections are encrypted in transit. Keywicket asks only for read access to tenants. Stored Google tokens are encrypted with AES-GCM, Microsoft access uses certificate-based tokens that aren't stored, every operator account uses multi-factor authentication, and access to production data is limited to operating the service.

8. How long we keep it

Raw directory data from a tenant is deleted after 30 days. Findings, comments and reports are kept until you delete them, or 30 days after you disconnect the tenant. Account details are kept while your account exists. Our database provider keeps a recovery history for 7 days, after which deleted data can't be restored. Full details are on the security page.

9. Accessing and correcting your information

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing keywicket@vdbs.net. We'll respond within 30 days and won't charge you. If we refuse, we'll explain why and how to complain.

10. Complaints

Please contact us first at keywicket@vdbs.net. We'll acknowledge your complaint and aim to resolve it within 30 days. If you're not satisfied:

• In Australia, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
• In New Zealand, you can complain to the Privacy Commissioner at privacy.org.nz or on 0800 803 909.

11. Data breaches

If a breach is likely to result in serious harm, we'll notify affected customers and individuals without undue delay and notify the OAIC under the Notifiable Data Breaches scheme. Where the NZ Privacy Act applies, we'll notify the Privacy Commissioner and affected people of notifiable privacy breaches as soon as practicable. We'll contain the breach, assess it and take steps to prevent it happening again.

12. Cookies and local storage

Keywicket uses one strictly necessary cookie to keep you signed in. Your choice of light or dark theme is kept in your browser's local storage. There are no analytics or advertising cookies.

13. Changes to this policy

We'll publish changes here with a new version number and effective date, and email workspace owners about significant changes.

14. Contact

Keywicket Operator [placeholder entity name] (ABN to be confirmed), Brisbane, Queensland, Australia. Email keywicket@vdbs.net.