Privacy Policy

This Privacy Policy explains how Bluestone HSE Pty Ltd (ABN 71 614 588 411), trading as Bunya Bowtie (“Bunya Bowtie”, “we”, “us”, “our”), collects, uses, discloses and protects your personal information when you use the Bunya Bowtie website at bunyabowtie.com and the Bunya Bowtie web application at app.bunyabowtie.com (together, the “Service”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we handle the personal information of individuals in the EU or UK, the EU General Data Protection Regulation (GDPR) or the UK GDPR may also apply — see “International users” below. By using the Service, you agree to the collection and use of information as described in this Policy.

1 Information we collect

Information you provide to us

• Account information — your name, email address, company / organisation name, and password. Passwords are stored only in hashed form by our authentication provider; we never see your plain-text password.
• Sign-in via Google or Microsoft — if you choose to sign in with Google or Microsoft, we receive your name, email address and basic profile information from that provider. We do not receive your Google or Microsoft password.
• Your Content — the bowtie diagrams, risk analyses, text, file and folder names, and related data you create, upload or store in the Service (“Your Content”).
• Billing information — if you purchase a subscription, our payment processor (Stripe) collects and processes your payment details. We do not store full card numbers; we receive limited information such as your subscription status and card type / last four digits.
• Communications — information you provide when you contact us for support or feedback.

Information we collect automatically

• Usage and technical data — such as log data, IP address, browser and device information, pages viewed and timestamps, collected to operate, secure and improve the Service.
• Cookies and similar technologies — see “Cookies” below.

2 How we use your information

We use personal information to:

• create and manage your account and authenticate you;
• provide, maintain, support and improve the Service, and store and display Your Content;
• process subscriptions and payments;
• keep the Service secure and investigate misuse;
• respond to your enquiries and send service-related messages (e.g. important account, security or billing notices);
• comply with our legal obligations; and
• where permitted, send product updates and news — you can opt out of marketing messages at any time.

3 Disclosure of your information

We do not sell your personal information. We disclose personal information only as needed to run the Service, including to the following service providers (“sub-processors”) who process data on our behalf under contract:

• Supabase — authentication, database and file storage (hosted in Sydney, Australia);
• Vercel — application hosting and delivery;
• Stripe — payment processing;
• Google / Microsoft — only if you choose to sign in with those providers.

If your access to the Service is arranged by an organisation (for example, your employer or the entity that pays for your account), we may share your account, subscription and usage information with that organisation. We may also disclose information where required or authorised by law, to protect our rights or the safety of others, or in connection with a sale or restructure of our business (in which case we will take steps to ensure your information remains protected).

4 Where your data is stored

Your Content and your core account data are stored onshore in Australia. Our database, authentication and file-storage provider (Supabase) hosts this data on servers in Sydney, Australia (Amazon Web Services), with automatic backups. The application itself is delivered globally from Vercel’s edge network, but no user data is stored there.

Some limited personal information is processed overseas by service providers: payment details are handled by Stripe on its PCI-compliant servers, and if you choose Google or Microsoft sign-in, your identity is verified by those providers. Where we disclose personal information overseas, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the Australian Privacy Principles.

5 Your Content

Your Content belongs to you. We access it only to provide and support the Service (for example, to store, display and back it up), to maintain security and integrity, where you ask us to, or as required by law. We do not use Your Content to train machine-learning or artificial-intelligence models.

6 Storage and security

We use reputable infrastructure providers and take reasonable technical and organisational measures — including encryption in transit (TLS / HTTPS) and at rest (AES-256), access controls, and database row-level security — to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7 Data breaches

We maintain procedures to detect, assess and respond to data breaches. If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

8 Data retention

We retain personal information and Your Content for as long as your account is active or as needed to provide the Service. If you delete content or close your account, we will delete or de-identify your personal information within a reasonable period, except where we are required to retain it to meet legal, accounting or security obligations.

9 Your rights

Under the APPs you may request access to, and correction of, the personal information we hold about you. You may also update your account details at any time within the Service, request deletion of your account and associated data, and opt out of marketing communications. To make a request, contact us using the details below; we may need to verify your identity first, and we will respond within a reasonable time (usually within 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10 Cookies

We use essential cookies and similar technologies to keep you signed in, remember your preferences and keep the Service secure. We do not use them for third-party advertising. You can control cookies through your browser settings, although disabling essential cookies may affect how the Service works.

11 Google and Microsoft sign-in

Bunya Bowtie’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Where you sign in with Microsoft, we likewise use the information we receive only to verify your identity. We use sign-in data from either provider solely to authenticate you and to create and manage your account, and for no other purpose.

12 Children

The Service is intended for business users and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe that a child has provided us with personal information, please contact us at hello@bunyabowtie.com and we will take reasonable steps to delete it.

13 International users

If you access the Service from outside Australia, you understand your information will be processed as described in this Policy. Where the GDPR or UK GDPR applies, you may have additional rights (such as data portability and the right to object). Our lawful bases for processing include performance of our contract with you, your consent, and our legitimate interests in operating and securing the Service.

14 Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and update the “Last updated” date. We may notify you of material changes by email or in-app.

15 Contact us