Privacy Policy

This policy explains how Beige Orca Pty Ltd (ABN 64 693 498 298), which runs Issued ("we", "us"), handles personal information. It's written to meet the Australian Privacy Act 1988 and Australian Privacy Principles, the UK GDPR, the New Zealand Privacy Act 2020, and US state privacy laws where they apply.

Two roles

• For our customers' accounts (team members, billing, our website), we decide how personal information is used. We're the "controller" or "agency" responsible for it.
• For the documents and client details our customers put into Issued, we act on our customer's behalf, under our Data Processing Addendum. If you're a client who received a link from a team using Issued, that team is responsible for your information, and you should contact them first. We'll help them respond.

What we collect

• Account details: name, email address, password (stored as a one-way hash), two-factor and passkey settings, team name and branding.
• Billing details: Paddle, our reseller, collects your payment details. We receive your name, email, country, tax ID if given, and the status of your subscription and invoices, but never your full card number.
• Client stakeholders: names, email addresses, job titles and organisations that teams add, and the comments, approvals, signatures and decline reasons they give.
• Documents: the files teams upload and the text and details extracted from them.
• Audit and security records: sign-ins, one-time codes, views, comments, approvals and signatures, with time, IP address and browser details.
• Technical data: server logs and error reports, used to keep the service running and secure.

We don't use marketing or analytics trackers on our website, and we don't sell or rent personal information.

Why we use it

• To provide Issued: running accounts and teams, sharing documents, sending emails and reminders, and recording approvals and signatures (to perform our contract with you).
• To take payment, through Paddle (to perform our contract).
• To keep Issued secure, prevent misuse and fix problems (our legitimate interests).
• To keep records the law requires, such as tax records (legal obligation).
• To send you service emails about your account. We'll only send marketing emails if you ask for them, and you can unsubscribe at any time.

Who we share it with

We use these service providers ("sub-processors") to run Issued. Each is bound by a contract to protect the information and use it only for us:

Provider	What it does	Where
Laravel Cloud	Hosts the app and database	Sydney, Australia
Cloudflare	Stores documents (R2), protects and delivers the site, email routing	Near Australia, and global network
Resend	Sends email	United States
Paddle	Payments, invoices and tax, as merchant of record	United Kingdom and United States
Laravel Nightwatch	Error and performance monitoring	United States
exe.dev	Processes PDFs (cleaning, stamping, merging); keeps no copies	Hosted service

We may also share information if the law requires it, to protect people's safety, or if our business is sold (in which case this policy would continue to apply).

Overseas transfers

Our main hosting is in Australia. Some providers above process information in other countries, including the United States and the United Kingdom. Where UK or EU data protection law applies, we use the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or another lawful transfer mechanism. Under the Australian Privacy Principles, we take reasonable steps to make sure overseas recipients handle information consistently with them.

How long we keep it

• Team data is kept while the subscription is active. After a paid subscription ends, it's read-only for 90 days and then deleted. Cancelling a trial, or deleting a team, deletes its data straight away.
• After deletion we keep only the fingerprint (SHA-256 hash) and issue date of each sealed PDF, so the public verify page still works. These contain no personal information.
• Billing and tax records are kept for as long as the law requires (generally 5 to 7 years).
• Logs are kept for a short period, normally no more than 90 days.

Security

Data is encrypted in transit and at rest, documents are stored privately and served only through short-lived links, and uploaded PDFs are cleaned of scripts. See Security and privacy.

Your rights

Depending on where you live, you can ask to access, correct, delete, restrict or move your personal information, object to how we use it, or withdraw consent. Email [email protected]. We'll respond within 30 days and won't charge you, unless the law allows a fee for unreasonable requests. If you're a client stakeholder, we may pass your request to the team that invited you.

Complaints

Contact us first at [email protected] and we'll respond within 30 days. If you're not satisfied, you can complain to:

• Australia: the Office of the Australian Information Commissioner (oaic.gov.au)
• United Kingdom: the Information Commissioner's Office (ico.org.uk)
• New Zealand: the Office of the Privacy Commissioner (privacy.org.nz)
• the European Union: your local data protection authority

Cookies

We only use cookies that are essential for Issued to work. See our Cookie notice.

Children

Issued is for business use and isn't intended for anyone under 18.

Changes

We'll post any changes here with a new version number and effective date, and email account holders about significant changes.

Contact

Beige Orca Pty Ltd, 105B Union St, Northcote VIC 3070, Australia. Email: [email protected].