Privacy Policy

Last updated: [TODO(legal)]

This is a template pending legal review. It is provided as a working draft only and must be reviewed and approved by a qualified Australian lawyer before it is published or relied upon.

This Privacy Policy explains how Posboai (“Posboai”, “we”, “us” or “our”) collects, uses, discloses and protects personal information when you use our website and platform (the “Service”). We are committed to handling personal information in accordance with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth), and, where it applies, the EU General Data Protection Regulation (GDPR) for visitors and users in the European Union and European Economic Area.

1. Who we are

Posboai provides online ordering and storefront software to food and retail businesses in Australia. [TODO(legal): registered entity name, ABN/ACN and registered office address]. If you are a customer of a business that uses Posboai, that business is the entity responsible for the personal information it collects from you; we act as a service provider (processor) on its behalf.

2. What we collect

The personal information we may collect includes:

  • Account information — name, email address, business name, phone number and login credentials.
  • Billing information — billing contact and address; card payments are processed by our payment provider and we do not store full card numbers ourselves.
  • Usage and technical data — IP address, device and browser information, pages viewed and actions taken, collected via cookies and similar technologies.
  • Content you provide — products, catalogue, customer records and orders you enter into the Service.

3. How we use it

We use personal information to:

  • provide, operate, maintain and improve the Service;
  • set up and administer your account and process your subscription payments;
  • respond to your enquiries and provide customer support;
  • send service, security and billing notifications;
  • monitor, secure and troubleshoot the Service; and
  • comply with our legal obligations.

Where GDPR applies, our lawful bases for processing include performance of a contract, our legitimate interests in operating and securing the Service, your consent (where requested), and compliance with legal obligations.

4. Disclosure

We do not sell personal information. We may disclose it to trusted service providers who help us run the Service (such as our payment processor and cloud hosting provider), to professional advisers, in connection with a business sale or restructure, or where required or authorised by law. Service providers are bound to handle information consistently with this policy and applicable law.

5. Overseas disclosure & data location

Posboai data is hosted in Australia, in Amazon Web Services’ Sydney region (ap-southeast-2). Some of our service providers may process limited information (for example, support or payment metadata) outside Australia. Where personal information is disclosed overseas, we take reasonable steps to ensure it is handled consistently with the APPs, and, for GDPR-covered data, that appropriate safeguards (such as standard contractual clauses) are in place.

6. Security

We take reasonable technical and organisational measures to protect personal information against loss, misuse and unauthorised access, including encryption in transit, access controls, row-level isolation between tenant accounts, and regular backups. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your rights (access & correction)

You may request access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date or incomplete. Where GDPR applies, you may also have rights to erasure, restriction, portability and to object to certain processing. To make a request, contact us using the details below. We will respond within a reasonable period and as required by law.

8. Cookies

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service and understand how it is used. You can control cookies through your browser settings; disabling some cookies may affect how the Service works.

9. Retention

We retain personal information for as long as your account is active and as needed to provide the Service, and afterwards only as long as necessary to meet our legal, accounting and reporting obligations, resolve disputes and enforce our agreements. When information is no longer required, we take reasonable steps to delete or de-identify it.

10. Complaints

If you have a concern about how we have handled your personal information, please contact us first using the details below so we can try to resolve it. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. EU/EEA individuals may also complain to their local supervisory authority.

11. Contact

For privacy questions, access or correction requests, or complaints, contact our privacy team at privacy@posboai.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. Significant changes will be communicated through the Service or by email where appropriate.