Privacy policy

1Who we are

BlueArc Cert is provided by BlueArc Technologies Pty Ltd (ABN 61 690 034 121), referred to as BlueArc, we or us. This policy covers the BlueArc Cert application at bluearccert.com and this website, bluearccert.com.au.

When an organisation uses BlueArc Cert, the organisation decides what information it puts in. We handle that information on the organisation's behalf to provide the service. Questions about information your employer or another organisation has put into BlueArc Cert can also be raised with that organisation.

2What we collect

We collect only what the service needs.

Your account

• Your username, name and contact email address.
• Your password, stored only as a one way hash, never as the password itself.
• Your authenticator for the second sign in step.
• Sign in times and the network address your requests come from, for security.

What your organisation puts in

• Documents, evidence files, registers (such as risks, suppliers, assets and people), tasks, audits, comments and decisions.
• A record of changes: who changed what and when, so an audit trail can be shown to an auditor.

Billing

• When an organisation subscribes, Stripe collects the payment details, billing address and, if provided, ABN. We keep the Stripe customer and subscription references and the subscription status. We never see or store card numbers.

Help, feedback and errors

• Feedback you send: its title, text, type and impact, the page you came from, the app version, your browser and screen size, any screenshot you attach, and whether we may contact you.
• Help searches that find nothing: the words you typed, kept without your name, so the help can be improved.
• Error reports: when the app breaks in your browser it sends us a short technical note. We remove email addresses, tokens, network addresses, numbers and quoted text before keeping it, and it carries no name or organisation. Because that removal works by pattern, we treat these notes as possibly personal information.
• Emails you send us, and our replies.

This website

• This website has no forms and no analytics. Our hosting and security provider processes your network address and browser details to deliver pages and block abuse. See the Cookie policy.

3Why we collect it

We use personal information to provide BlueArc Cert to your organisation, to keep it secure, to show an honest audit trail, to send the sign in and account emails the service relies on (such as confirmation, invitation and password reset emails), to bill subscriptions, to answer support requests, and to improve the service. We do not sell personal information, and we do not use it for advertising.

BlueArc Cert does not make automated decisions about individuals. Readiness scores and suggestions describe an organisation's compliance work, and people decide what to do with them.

4No AI training

Information in BlueArc Cert, including your organisation's data, is not used to train any artificial intelligence model.

BlueArc Cert does not currently send your data to any AI service. If we introduce optional AI features, we will update this policy before they are available, and they will be used only by organisations that turn them on.

5Who can see it

People in your organisation see what their role allows. An auditor your organisation invites sees only the audit they were invited to, read only, and only until their access ends. Someone sent a one time link sees only the item it is for.

BlueArc staff look at your organisation's data only when you ask for help, or when the law requires it. Feedback you send, and any screenshot with it, is seen only by you and the BlueArc team. Error reports are read only by BlueArc staff.

We disclose personal information to the service providers below, and otherwise only with consent or where the law requires or permits it.

6Service providers

These providers process information for us under agreements that require them to protect it. Each receives only what it needs.

7Where it is stored

Your organisation's records and files are stored in a database in Sydney, Australia, run by Supabase on Amazon Web Services.

Some providers above are based overseas, mainly in the United States, and their staff or sub processors may access information from other countries. Under Australian Privacy Principle 8 we treat this as disclosure overseas, and we take reasonable steps to ensure each provider handles personal information consistently with the Australian Privacy Principles.

8How long we keep it

• Organisation data: for as long as the organisation exists, including while it is read only after a trial or subscription ends. An owner can export everything and ask for the organisation to be deleted, as described in our Terms of Service.
• Records under a legal hold or retention setting: for the period the law or your organisation's own retention settings require, then removed.
• Audit trail: changes are recorded in a log that cannot be rewritten. If someone leaves your organisation, their name stays on the changes they made.
• Feedback: until the organisation is deleted.
• Error reports: deleted after 30 days.
• Backups: kept for a short period, currently seven days, then replaced.
• Billing records: for as long as Australian tax law requires.

9Security

Everyone signs in with a password and a code from an authenticator app. Each organisation's data is kept separate by rules in the database itself, not only in the application. Data is encrypted on its way to us and where it is stored. Uploaded files are checked, and files that fail the checks are refused.

No system is perfectly secure, so we also limit who can reach data, keep an audit trail of changes, and review our controls as the service grows.

10Data breaches

If we suspect a data breach, we act promptly to contain and assess it. Where a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and we will tell affected organisations.

11Cookies and browser storage

We use no advertising or tracking cookies and no analytics. In the application, your sign in is kept in your browser tab's session storage and is gone when you close the tab. If you arrive through an invitation, its link is kept in your browser for up to 14 days so you can finish signing up, and is cleared once you accept or decline. Nothing about your organisation's records is kept in your browser. The Cookie policy has the detail.

12Marketing

We do not send marketing email without your consent, and any marketing email we send will let you unsubscribe. Emails the service needs to work, such as sign in and invitation emails, are not marketing.

13Access, correction and complaints

You can ask to see, correct or delete the personal information we hold about you by writing to support@bluearccert.com. We will respond within 30 days and there is no charge. Your organisation's owners can correct most details themselves. If we cannot do what you ask, we will explain why.

You can browse this website without telling us who you are. Using BlueArc Cert requires an account, so it cannot be used anonymously.

If you have a complaint about how we have handled your personal information, write to our Privacy Officer at the address above. We will acknowledge it, look into it and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Where the European Union or United Kingdom General Data Protection Regulation applies to you, you also have the rights it gives you.

14Children

BlueArc Cert is a service for organisations. It is not intended for anyone under 18.

15Changes to this policy

When this policy changes, the date at the top changes. We will tell organisation owners of any change that materially affects how their information is handled.

16Contact