Privacy policy

This policy is written against the Australian Privacy Principles in the Privacy Act 1988. It covers Mahomed Aqeel Ahmed Hussein, a sole trader based in Queensland, Australia, who operates Cairn. In this policy, "we" and "us" mean that business.

What we collect

About you, our customer: your name, email address, organisation name, and what you do in the app. If you subscribe, Stripe collects and holds your payment details — we never see or store a card number.

About the businesses you assess: whatever you put in. A client record holds a business name and optionally a contact name, email and notes. An assessment holds your answers, your written evidence, and any files you attach.

Automatically: ordinary web server logs — IP address, browser, pages requested — kept for security and troubleshooting.

A note on evidence files

We do not inspect what you upload, and we have no way to know whether a screenshot or config export contains personal information. You are the one who decides what goes in. Upload the minimum that supports your finding, and if a document contains personal information that is not needed to evidence a control, leave it out.

Why we collect it

To run the service: to give you an account, hold your assessments, produce your reports, take payment, and answer you when you contact us. We do not use your content, or your clients' content, to train machine learning models, and we do not sell it.

Who else sees it

Only the suppliers that make the service work:

• Laravel Cloud — application hosting and the database.
• Stripe — payments. They hold your billing details, not us.
• Resend — sending email such as invitations and password resets.
• Cloudflare — domain name services, and forwarding email sent to our addresses.
• Sentry — error monitoring. When something breaks, a technical report of the fault is sent so we can fix it. It is set up to leave out names, email addresses, form contents and anything you or your clients typed; each report carries only a numeric account reference.

We also disclose information where the law requires it. Anyone you send a report share link to can read that report — that disclosure is one you make, not us.

Where your information is held — read this one properly

The application and database are hosted in Sydney, Australia. Your account, your client records and your assessment answers are stored there.

Uploaded evidence files and logos are not guaranteed to be stored in Australia. Our object storage provider does not offer an Australian location; storage is placed automatically and may sit outside Australia. We are telling you this plainly rather than leaving it in the small print, because it may matter to your clients. If it does, consider recording findings as written evidence rather than uploading files.

Stripe, Resend and Sentry are overseas providers, so taking payment, sending email and reporting errors involve disclosure outside Australia. This is an overseas disclosure for the purposes of Australian Privacy Principle 8.

Keeping it safe

Access is over HTTPS. Passwords are stored hashed, never in plain text. Each organisation's data is separated at the database query level, and that separation is covered by automated tests that run on every change. Evidence files are served only through an authenticated route, never a public URL.

No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

How long we keep it

Your content stays until you delete it or ask us to close your account. Server logs are kept for a short period for security purposes. After an account is deleted, content may persist in backups for a limited time before those expire.

Getting at your information, and correcting it

You can see and change most of it in the app. For anything else, email privacy@ucecairn.com and we will respond within 30 days. We will need to be reasonably satisfied of who you are before releasing anything.

If you are an end business whose details are in Cairn because your IT provider put them there, contact that provider first — it is their record. We will help them help you.

Cookies

Cairn sets a session cookie to keep you signed in and a token to protect forms from cross-site request forgery. That is all. There is no advertising, no analytics and no third-party tracking.

Complaints

Email privacy@ucecairn.com. We will acknowledge within 5 business days and respond within 30 days.

If you are not satisfied with how we handle it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes

If we change this policy materially we will email the account owner before it takes effect.