Privacy Policy

This policy explains how Company name TBC: Registered company name to be confirmed, trading as Wattle Cloud (“we”, “us” or “our”), handles personal information about you when you use Wattle Board, its website, its emails and our support.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you're in the United Kingdom, the UK GDPR and the Data Protection Act 2018 also apply, and if you're in the European Economic Area (EEA), the EU GDPR. Under those laws, we're the controller of the personal information this policy describes.

When a business or organisation uses Wattle Board, the content its people put on their boards is controlled by that organisation, and we process it on its behalf, as our Terms of Service explain. If you have questions about that content, ask the organisation first.

Information you give us

• Account: your name, email address, password (which we store only as a scrypt hash, never in readable form), your two-factor settings, and any passkeys (we keep only their public keys) or API tokens (we keep only a fingerprint of each) you create.
• Profile: anything you choose to add, such as a profile photo, header image, public name, pronouns, job title, department, organisation, location, time zone and a note on working with you, along with who you allow to see each one.
• Board content: the workspaces, boards, lists, cards, descriptions, checklists, comments, custom fields and files you add, and who they're assigned to.
• Invitations and access requests: the email addresses of people you invite, and the notes you write when you ask for access to a board.
• Billing, once paid plans are available: your billing name and address, a business name and tax number if you give them, and your payment history. Card payments are handled by our payment provider, and we don't store your full card number.
• Support: the messages you send us, and our replies.

Information we collect when you use Wattle Board

• Activity: actions on your boards, such as creating, moving or archiving cards, which appear in the board's activity log and in notifications.
• Presence: whether you're currently looking at a board, so others on that board can see who's online. We use it only for that.
• Security records: sign-in attempts, the devices you've chosen to trust, and your signed-in sessions (browser, IP address where available, how and when you signed in, and when each was last active), so we can protect your account, show you your recent devices and limit repeated guessing.
• Technical information: IP addresses, browser and device details, and request and error logs.

Wattle Board doesn't use analytics or advertising trackers. Our Cookie Policy lists the little we store in your browser.

You don't have to give us personal information, but without an email address and password we can't open an account for you. You can ask us a question without giving your name, as long as you give us a way to reply.

We don't sell personal information, rent it out, or use it for advertising. We don't use your board content to train AI models.

Every marketing email has an unsubscribe link. Service emails, such as sign-in codes and security notices, aren't marketing, so we keep sending them while your account is open.

People in your workspaces

Your full name is visible to people you share a workspace or board with. For everything else on your profile, including your photo and email address, you choose who can see it in Account settings: anyone signed in to Wattle Board, people in your workspaces, or only you. Workspace Owners and Admins can always see members' email addresses when managing members. What you add to a board can be seen by everyone with access to that board. When you request access to a board, its Admins see your name, email address and note.

Service providers

We share personal information with companies that help us run Wattle Board, such as our hosting and storage providers, our email provider and, once paid plans are available, our payment provider. They may use it only to provide their services to us. We'll give you a current list on request.

Others

• Our professional advisers, such as lawyers, accountants and auditors.
• Authorities, when the law requires it or when it's needed to protect someone from serious harm. We check each request and share only what we must.
• A business that takes over all or part of Wattle Board. It must protect your information as this policy describes, and we'll tell you before it happens.
• Anyone else, if you ask us to or agree to it.

We hold personal information electronically, on infrastructure chosen by Wattle Cloud and in the systems of our service providers. We're based in Australia.

Some of our service providers may store or access personal information in other countries. Before that happens, we take reasonable steps to make sure it's protected in line with the Australian Privacy Principles. For information from the UK or EEA, we rely on adequacy decisions where they exist and, where they don't, on safeguards the law recognises, such as the UK International Data Transfer Addendum and the EU standard contractual clauses.

• Account information and board content: while your account, workspaces and boards are open. After you close your account or delete a workspace or board, we keep it for 30 days so you can bring it back, then delete it, apart from the records below. If you choose to delete everything when you close your account, we delete your personal details straight away.
• Archived cards stay on the board, out of sight, until someone restores or deletes them.
• Billing and tax records: 7 years, as Australian tax and company laws require.
• Security records and technical logs: only as long as we need them to run and secure the service.
• Support messages: as long as we need them to deal with the matter, and longer if the law requires it or a dispute is ongoing.

When we no longer need personal information, we delete it or make it anonymous. Copies in backups are deleted as those backups expire.

Every account uses two-factor sign-in. Passwords are hashed with scrypt, authenticator secrets are encrypted at rest, sessions use encrypted, httpOnly cookies, sign-in attempts are rate-limited, and attachments are only ever sent to people with access to their board. Photos you upload have hidden camera and location data removed before they're stored. Our Security page has more detail. Our team accesses personal information only when their work needs it.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. For people in the UK and EEA, we tell the relevant regulator within 72 hours where the law requires, and tell you without undue delay if there's a high risk to you.

Wherever you are, you can ask us to:

• give you a copy of the personal information we hold about you
• correct information that's wrong, out of date or incomplete
• delete your information, unless we need to keep it for a reason this policy describes
• stop sending you marketing emails, which you can also do with the unsubscribe link

If you're in the UK or EEA, you can also ask us to restrict or stop using your information, object to how we use it, or give you your information in a format you can take to another service. Where we rely on your consent, you can withdraw it at any time. That doesn't affect what we did before.

You can do much of this yourself in Account settings: change your profile and who sees each detail, change your email address, download a copy of your data (Privacy tab) and close your account (Account preferences).

To make a request, email [email protected]. We may need to confirm who you are first. We'll respond within 30 days, and there's no charge unless a request is clearly unfounded or excessive. If we can't do what you ask, we'll explain why and tell you how to complain.

You can change your name, email address, password and two-factor settings yourself in your account settings, and close your account at any time.

You must be at least 16 to open an account, and we don't knowingly collect personal information from younger children. If you think a child under 16 has given us personal information, email [email protected] and we'll delete it.

We'll post any changes here and update the date at the top. If a change is significant, we'll email account holders before it takes effect.

For privacy questions, requests or complaints, email [email protected] with “Privacy” in the subject line. We'll look into a complaint and reply within 30 days with what we found and what we'll do.

Business

Company name TBC: Registered company name to be confirmed, trading as Wattle Cloud

ABN

TBC: ABN to be confirmed

Address

TBC: Registered address to be confirmed

Email

[email protected]

If you're not satisfied with our response, you can complain to a regulator: in Australia, the Office of the Australian Information Commissioner (opens in a new tab); in the UK, the Information Commissioner's Office (opens in a new tab); in the EEA, your local data protection authority.