Privacy policy

1. Who we are

Brandrail runs Brandrail from Perth, Western Australia. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). For questions or requests, email privacy@brandrail.com.au.

2. What we collect

• Account details: name, email address, avatar and the sign-in provider you use (email, GitHub, Google or Microsoft). Passwords are stored as hashes by our authentication provider; we never see them.
• Organisation details: organisation name, members, roles and invitations (including the email address of each person invited).
• Product data: Brand Kits, components, check results (repo and file names, line numbers, rule messages, scores) and the audit log.
• Billing details: billing contact, company name, ABN and address. Card details go directly to Stripe and are not seen or stored by us.
• Technical data: IP address, browser type and request logs kept by our hosting providers for security and troubleshooting, and error reports with personal details removed.
• Messages: anything you send us by email.

We don't collect source code, and we don't use advertising or third-party tracking cookies.

3. How we use it

• to provide the service, sign you in and keep your organisation's data separate from others;
• to send emails you need: sign-in links, invitations, password resets, receipts and important notices about the service;
• to bill paid plans;
• to keep the service secure, investigate problems and prevent abuse;
• to answer you and improve the product, using aggregate usage rather than individual content.

4. Who we share it with

We share personal information only with the service providers that run Brandrail for us (our subprocessors, listed on the security page), with tools you connect yourself (such as GitHub), and where the law requires it. We don't sell personal information.

Some providers store data outside Australia: today our database is in Singapore (AWS ap-southeast-1), email is sent through Japan, and error reports and payments may be processed in the United States or EU. We choose providers with strong security practices and contracts that protect the data.

5. Cookies

We use only the cookies the site needs to work: keeping you signed in, protecting forms, and remembering your theme. There is no advertising or analytics tracking, so there's nothing to opt out of.

6. How long we keep it

We keep account and organisation data while your account is active. When you delete an organisation or account, its data is deleted from the live database straight away and from backups within 30 days. We keep invoices for as long as Australian tax law requires (generally five years).

7. Security

Data is encrypted in transit and at rest, access is limited by row-level security and roles, and API keys are stored as hashes. The security page has the details. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

8. Your rights

You can see and correct most of your information in the dashboard. You can also ask us for a copy of the personal information we hold about you, to correct it, or to delete it, by emailing privacy@brandrail.com.au. We reply within 30 days.

If your organisation added you, some requests may need to go through its owner, because the organisation controls that data. If you're not happy with our answer to a complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

9. Changes

We'll update the date at the top when this policy changes, and email account holders about significant changes before they take effect.