On this page
01Who we are and what this policy covers
This policy explains how Cyberscape IT handles personal information. It covers people who visit our website, contact us, become clients, or use the apps we build and host.
Cyberscape IT, ABN 68 824 287 472, is based in Melbourne, Victoria ("we", "us", "our"). We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), whether or not the small business exemption applies to us, because our clients trust us with their data.
Personal information is information or an opinion about an identified person, or a person who is reasonably identifiable.
02Personal information we collect and how we collect it
We collect only what we need to talk with you, deliver our services and run our business.
| Who you are | What we collect | How we collect it |
|---|---|---|
| Website visitor | Basic technical information such as browser type, pages visited and approximate location from your IP address | Automatically, through our hosting provider's logs |
| Enquirer or prospect | Name, business name, role, email, phone and what you tell us about your business and its processes | From you, by email, phone, video call or our online booking page. Occasionally from public business sources such as your website or LinkedIn |
| Client | Contact and billing details for your business contacts, plus notes from meetings, support requests and change requests | From you and your staff while we work together |
| Client billing | Payment details | Collected and stored by our payment provider, Stripe. We don't see or store full card or bank account numbers |
| Users of apps we build | Whatever the client's app is designed to hold | From the client and their users. See "Information inside the apps we build for clients" |
We don't ask for sensitive information such as health, racial or ethnic origin, or criminal records. If a client's app needs to hold sensitive information, we agree extra controls with that client first.
You can deal with us without giving your name where that's practical, for example when asking a general question. We'll need contact details to quote for or deliver work.
03How we use personal information
We use personal information to:
- reply to enquiries, run discovery calls and prepare quotes and prototypes
- design, build, host, support and change the apps we provide
- manage accounts, invoices and payments
- keep our systems and our clients' apps secure, including monitoring and investigating suspicious activity
- send service updates, such as maintenance notices and security alerts
- send occasional news about our services, if you've agreed to receive it
- meet our legal, tax and accounting obligations
We don't sell personal information. We only use it for another purpose if you'd reasonably expect it, you agree, or the law requires or allows it.
05Information inside the apps we build for clients
The information held in a client's app belongs to that client. We handle it on their behalf, under our agreement with them.
- We access it only to host, back up, secure, support and change the app, or when the client asks us to.
- Each client's app runs in its own deployment with its own database, separate from other clients.
- If you use a client's app and want to see, correct or delete your information, contact that client first. We'll help them respond.
- When a client leaves, we give them a complete export of their data. We then delete it from live systems within 30 days, and it expires from backups within a further 30 days, unless the law requires us to keep it.
Each client is responsible for having a lawful basis to collect information in their app and for telling their own users how it's handled.
06Security, data breaches and how long we keep information
We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These include:
- encryption in transit and at rest
- multi-factor sign-in and least-privilege access on every system we use
- a separate deployment and database for each client's app
- testing, vulnerability scanning and review of every change before release
- daily backups and regular restore tests
Data breaches. If we suspect a data breach, we act quickly to contain it and assess the harm. If it's likely to cause serious harm, we notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. If the breach affects a client's app, we tell that client promptly and help them meet their obligations.
How long we keep it. We keep personal information only while we need it for the purposes in this policy, or as long as the law requires. For example, we keep financial records for at least five years for tax purposes. When we no longer need information, we securely delete it or remove anything that identifies you.
07Marketing, cookies and automated decisions
Marketing emails. We send news about our services only to people who have agreed to receive it or who would reasonably expect it as an existing client. Every marketing email identifies us and includes an easy way to unsubscribe. We act on unsubscribe requests within five business days. Service messages, such as security alerts, aren't marketing and continue while you're a client.
Cookies and analytics. Our website doesn't use advertising or tracking cookies. Our hosting provider records basic technical information to keep the site running and secure. The site loads fonts from Google Fonts, so Google receives your IP address and browser details when you visit. If we add analytics later, we'll update this policy first.
Automated decisions. We don't use computer programs to make decisions about individuals that could significantly affect their rights or interests. If that changes, we'll update this policy to describe the kinds of information used and the kinds of decisions involved, as the APPs require from 10 December 2026. Where a client's app makes decisions like this, the client is responsible for disclosing it to their users.
08Access, correction, complaints and contact
Access and correction. You can ask to see the personal information we hold about you, or ask us to correct it. We'll respond within 30 days. Asking is free; if providing a large amount of information takes significant work, we may charge a reasonable fee and will tell you first. If we can't give you access, we'll explain why in writing.
Complaints. If you think we've mishandled your personal information, contact us with the details. We'll acknowledge your complaint within five business days and aim to resolve it within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
Changes to this policy. We may update this policy as our services or the law change. The current version is always on our website, with its effective date at the top.