Privacy Policy

1. Information We Collect

We may collect and hold the following types of information:

• Personal Information: name, email address, phone number, company details, billing information.
• Account Information: username, password, account settings and roles.
• Usage Information: how you interact with the Service, including pages viewed and actions taken.
• Device Information: IP address, browser type, operating system, device identifiers.
• Customer Content: data you submit to the Service, which may include personal information about your own customers, staff or contacts.
• Other Information: anything you submit voluntarily (for example, support enquiries).

We generally do not collect sensitive information (as defined in the Privacy Act). If we need to, we will only do so with your consent or as permitted by law. Where it is lawful and practicable, you may deal with us anonymously or using a pseudonym; however, we usually cannot provide the Service without identifying account information.

2. How We Collect Information

• Directly from you through your interactions with the Service.
• Through the cookies that keep you signed in (see section 9).
• From third-party service providers, such as payment processors.

Where you provide us with personal information about other individuals, you confirm you are authorised to do so and have made them aware of this policy.

3. Why We Use Your Information

We use personal information to:

• provide, operate, maintain and secure the Service;
• process payments and manage subscriptions;
• communicate with you about your account, service updates and support;
• send marketing communications where permitted (you can opt out at any time — see section 8);
• improve and personalise the Service;
• detect, prevent and respond to fraud and security incidents; and
• comply with our legal obligations.

4. Disclosure of Your Information

We may disclose personal information to:

• Service Providers who perform functions on our behalf (hosting, payments, email, analytics, support);
• Legal and Regulatory Authorities where required or authorised by law;
• Professional Advisers such as auditors and lawyers; and
• Business Transfers, in connection with a merger, sale or acquisition.

We do not sell your personal information.

5. Overseas Storage and Disclosure

We use cloud service providers and may store or process personal information in Australia and overseas (for example, in the United States and other countries where our providers operate). Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the APPs, except where you consent or disclosure is otherwise permitted by law. For customers outside Australia, additional safeguards (such as Standard Contractual Clauses under the GDPR) are applied where required.

6. Data Security and Data Breaches

• We implement reasonable administrative, technical and physical safeguards to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. No system is completely secure.
• If we become aware of an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner ("OAIC") in accordance with the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

7. Data Retention and Destruction

We retain personal information only for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes and enforce our agreements. When personal information is no longer needed, we will take reasonable steps to destroy or de-identify it. Where you close your account, data is handled in accordance with our Terms and Conditions.

8. Direct Marketing and Opt-Out

We may send you marketing communications about our products and services where permitted by law. Every marketing email includes an unsubscribe option, and you can opt out at any time by contacting us. We comply with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth). Opting out of marketing does not affect service or account-related communications.

9. Cookies

We set four cookies, all of them strictly necessary to sign you in and keep you signed in. We do not use analytics, advertising or third-party tracking cookies, and we do not embed third-party trackers or advertising pixels in the Service. Nothing is set until you log in — browsing our public pages sets no cookies at all.

• dbs_access_token – your short-lived session token. Not readable by scripts (HttpOnly).
• dbs_refresh_token – renews your session so you are not signed out mid-task. Not readable by scripts (HttpOnly).
• dbs_user_data – your account and organisation context, so the app knows who you are and what to show.
• device_id – recognises devices you have signed in from, which supports account security.

All four are sent only over HTTPS and are restricted to dblsuite.com. Because they are strictly necessary to provide the service you have asked for, they do not require consent — but you can remove them at any time through your browser settings, or by signing out, which clears them. Blocking them will prevent you from signing in.

If we ever introduce analytics or advertising cookies, we will ask for your consent first and give you a genuine choice about them.

10. Access and Correction

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading, by contacting us using the details in section 13. We will respond within a reasonable period. There is no charge to request correction. If we refuse access or correction, we will explain why and how you can complain.

11. Additional Rights for International Users

GDPR (EU/UK)

• Access – request a copy of your personal data.
• Rectification – request correction of inaccurate data.
• Erasure ("right to be forgotten") – request deletion of your data.
• Restriction – request that we limit how we use your data.
• Portability – request transfer of your data to another service.
• Object – object to processing based on legitimate interests or direct marketing.
• Withdraw consent – at any time where we rely on consent.

You may also lodge a complaint with your local data protection authority.

CCPA/CPRA (California)

California residents have the right to know what personal information we collect, use and share; to request deletion; to opt out of the sale or sharing of personal information (we do not sell personal information); and to non-discrimination for exercising these rights.

To exercise any of these rights, contact us at [email protected].

12. Third-Party Links

The Service may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and we encourage you to review their privacy policies.

13. Complaints and Contact

If you have a question, wish to exercise your rights, or want to make a privacy complaint, please contact our Privacy Officer using the contact form here or by email. We will acknowledge your complaint and aim to respond within a reasonable period (generally 30 days).

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will indicate the "Last Updated" date and, where changes are significant, take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.