Salvanote Privacy Policy

Effective date: 11 June 2026

1. Who we are

Salvanote Pty Ltd (ABN 55 631 326 157) (“Salvanote”, “we”, “us”, “our”) is an Australian technology company. We operate:

• the Salvanote website at salvanote.com (the “Website”); and
• Salvanote SDS, a secure document platform that organisations use to exchange documents securely with the people they deal with (“SDS”).

This policy explains what personal information we collect through the Website and SDS, how we use and protect it, and how you can contact us about it.

Salvanote is committed to handling personal information responsibly. We are guided by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we aim to handle personal information consistently with them as a matter of good practice. Where we handle personal information about individuals in New Zealand, we also have regard to the New Zealand Privacy Act 2020.

You can contact us about anything in this policy at [email protected].

2. Who this policy covers

We deal with three groups of people, and we collect different information about each:

• Website visitors — people who browse salvanote.com or contact us through it.
• Client organisations and their staff — the organisations that subscribe to SDS (“clients”) and the staff members they authorise to use it.
• End-customers — the individuals our clients exchange documents with through SDS.

Clients provide us with the contact details of their end-customers so that SDS can operate. The client is responsible for ensuring it may provide those details to us. If you are an end-customer and have questions about why your information was provided to Salvanote, your first point of contact is the organisation you are dealing with — though we will always assist where we can.

3. What we collect

3.1 Website visitors

If you use our contact form, we collect your name, email address, and the message you send us.

Like most websites, our servers automatically record basic technical logs: IP address, browser/device information, the pages you visit, and timestamps. We use a small number of cookies and basic analytics to understand how the Website is used in aggregate. We do not use this information to build advertising profiles.

3.2 Client organisations and their staff

When an organisation becomes a Salvanote client, we collect:

• Organisation details — business name, ABN or registration details, billing and contact information.
• Staff member details — names, work email addresses, and mobile phone numbers of the staff the client authorises to use SDS, used for account administration and to authenticate staff when they sign in.
• Account and support records — sign-in and authentication events, account settings, and correspondence when staff contact our support.

3.3 End-customers

Clients supply us with end-customer contact details, which may include name, mobile phone number, and email address. As end-customers interact with SDS, we also collect service and verification records — such as SMS delivery status, verification events, document activity events, and associated technical data (IP address, browser/device information, timestamps).

What we do not collect: the contents of documents. Document contents are end-to-end encrypted before they reach us — see section 6.

4. How we use personal information

We use the personal information described above to:

• provide, operate, and administer the Website and SDS;
• verify identity — including sending SMS one-time passcodes (section 5);
• secure the platform, detect and prevent fraud and unauthorised access, and maintain audit and compliance records;
• communicate with clients and their staff about their account, the service, and support requests;
• bill clients for the service;
• comply with the law; and
• improve the service, using aggregated or de-identified information wherever possible.

We do not sell personal information. We do not use end-customer contact details for marketing of any kind.

5. SMS messaging

SDS sends SMS messages for one purpose only: identity verification. When an end-customer follows a secure access link, we send a one-time passcode by SMS to the mobile number their organisation registered for them. Entering the code confirms that the right person is using the link.

• Purely transactional. Our SMS messages are verification messages only. SDS will not send marketing or promotional material by SMS, and we will not add your mobile number to any marketing list.
• Who sends them. Messages are sent via AWS End User Messaging, a service of Amazon Web Services, from infrastructure in the Asia Pacific (Sydney) region.
• Where we send them. We currently send SMS to Australian and New Zealand mobile numbers.
• Charges. We do not charge you to receive verification messages, but standard carrier message and data rates may apply depending on your mobile plan.
• Opting out. You can opt out of SMS at any time by replying STOP to a verification message, or by contacting us at [email protected]. If you opt out, we will stop sending SMS to your number. Because the passcode is how SDS confirms your identity, opting out may mean you cannot use features that rely on SMS verification — if so, please contact the organisation you are dealing with to arrange an alternative.

Our verification messages are transactional service messages, not commercial electronic messages. We nevertheless operate consistently with the Spam Act 2003 (Cth) and honour all opt-out requests.

6. Encryption — what we cannot see, and what we can

SDS is built around end-to-end encryption:

We want to be accurate about the limits of this protection. While document contents are unreadable to us, we do see and retain certain metadata about documents and platform activity — such as file sizes, timestamps, the identities of the client and end-customer involved, and document activity events (including IP address and browser/device information). This metadata is necessary to operate the service and to provide the security and audit functions described in section 7.

7. Storage, security and retention

• Where your data lives. SDS data is hosted with Amazon Web Services in the Asia Pacific (Sydney) region in Australia. Our Website is hosted with SiteGround on Australian infrastructure (see sections 8 and 9).
• How we protect it. In addition to end-to-end encryption of document contents, we use encryption in transit and at rest, access controls within our own team, multi-factor authentication, and security event logging. No system is perfectly secure, but security is the core of what we build and we treat it accordingly.
• Audit logs. We retain access and security event logs (timestamps, IP addresses, browser/device information, document activity events) for security, fraud prevention, and compliance purposes.
• How long we keep things. We keep personal information only as long as it is needed for the purposes described in this policy. Client account information is kept for the life of the client relationship and for a reasonable period afterwards for legal, accounting, and dispute-resolution purposes. Encrypted document data is retained only as long as needed to provide the service, after which it is deleted. Security and audit logs are kept for as long as reasonably required for security and compliance purposes. When personal information is no longer needed, we take reasonable steps to delete or de-identify it.

8. Disclosure and service providers

We do not sell or rent personal information. We disclose personal information only:

• to the service providers listed below, to the extent needed to run the service;
• to our professional advisers (lawyers, accountants, auditors) under confidentiality obligations;
• where required or authorised by law, including to law enforcement or regulators under a valid legal process; and
• in connection with a business sale, merger, or restructure, in which case we will require the recipient to handle personal information consistently with this policy.

Current service providers

We may engage additional service providers in the future and will update this list when we do.

9. Overseas transfers

Our primary infrastructure — including SDS document storage and SMS sending — is located in Australia (AWS Sydney region).

Our Website is hosted on SiteGround’s Australian infrastructure, so website files, email, and related data are stored in Australia. SiteGround may carry out limited administrative processing (such as account and billing administration) outside Australia. Where any personal information is processed overseas, we take reasonable steps to ensure it is handled consistently with this policy.

10. Access, correction and complaints

You can ask us to:

• tell you what personal information we hold about you (access);
• correct it if it is inaccurate, out of date, or incomplete; or
• look into a concern if you believe we have mishandled your personal information (complaint).

To do any of these, email [email protected]. We will need to verify your identity before acting on a request, and we aim to respond within 30 days. If you are an end-customer, we may need to coordinate with the organisation that registered your details.

If you are not satisfied with our response:

• Australia: you can contact the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au, phone 1300 363 992.
• New Zealand: you can contact the Office of the Privacy Commissioner (OPC) — www.privacy.org.nz, phone 0800 803 909.

11. Data breaches

We maintain a data breach response process. If a data breach occurs that is likely to result in serious harm to individuals, we will act promptly to contain and assess it, notify affected individuals, and notify the OAIC and, where New Zealand individuals are affected, the New Zealand Office of the Privacy Commissioner, where appropriate. Where a breach involves end-customer information provided to us by a client, we will notify and coordinate with that client promptly.

It is worth repeating in this context: because document contents are end-to-end encrypted and we hold ciphertext only, a breach of our storage systems would not by itself expose the contents of documents.

12. Changes to this policy

We may update this policy from time to time. The current version will always be available at salvanote.com/privacy, with its effective date shown at the top. Material changes will be reflected here with a new effective date.

13. Contact us

Privacy Officer
Salvanote Pty Ltd
10 Seaview St, Nambucca Heads NSW 2448
Email: [email protected]