Privacy Policy

We collect what we need to run the service, we don't sell it, and you can ask for it or ask us to delete it. The detail follows.

SteepleTool is provided by Northpoint Integrity Services Pty Ltd ABN 49 688 665 723 ("we", "us") at steepletool.com. We are the entity responsible for the personal information described in this policy. Contact: hello@steepletool.com.

• Account details. Email address, name if you provide one, and authentication data (handled by our auth provider, Supabase). If you sign in with Google, we receive your email and basic profile from Google.
• Billing details. Plan, billing period, and payment status. Card details go to our payment processor and never touch our servers.
• Usage data. The URLs you scan, the reports generated, and product analytics (feature usage, error logs) used to run and improve the service.
• Information about people named in your reports. When you run a scan, we collect and process publicly available information about the organisation and, where relevant, individuals connected to it — for example directors, executives, or spokespeople named in public sources. This information isn't collected from those individuals directly; it's drawn from the public sources our reports are built on. See "People we scan" below for how we handle this.

• Provide the service — run scans, generate reports, maintain your account.
• Bill you for your subscription.
• Send transactional email: receipts, password resets, service notices.
• Improve the product, using aggregated or de-identified usage data.
• Email communications you opt in to. When you place a report order, you opt in to receive email communications from us — transactional email about that order, and occasional marketing about SteepleTool (product updates, new features, relevant content). You can opt out of marketing at any time using the unsubscribe link in any marketing email, or by emailing us; opting out doesn't affect transactional email about your orders or account.
• Generate the STEEPLE report you request, which involves collecting and analysing publicly available information about the organisation (and connected individuals) you've asked us to scan.

We do not sell your personal information. We do not use your scan content, or the personal information in a report, to market to the organisations or individuals you scan.

Our staff and contractors, on a need-to-know basis, to build, run, and support the service. Service providers who process data on our behalf: hosting and compute (Cloudflare), database and authentication (Supabase), payments, and email delivery. Each is bound by its own data-processing terms. Some providers store data outside Australia; where they do, we take reasonable steps to ensure comparable protection.

We use cookies and similar technologies to run the site and understand how it's used:

• Essential cookies. Needed to log you in and keep the service working. These can't be switched off.
• Analytics cookies. We use Google Analytics to understand feature usage and improve the product. You can opt out via your cookie settings or browser controls.

You can change your analytics choice at any time on our Cookie Preferences page, and manage or block cookies through your browser; blocking essential cookies may stop parts of the service working. We don't use cookies to serve advertising.

Our pages also load typefaces from Google Fonts. This means your browser requests those font files from Google's servers, which involves Google receiving your IP address and basic request information. No cookies are set for this purpose.

Account data is kept while your account is active. Scan history is kept so you can return to past work. When you close your account, we delete personal information within 30 days, except what we must keep for legal or accounting reasons.

SteepleTool reports draw on information that's already publicly available — company filings, news, and similar sources — and may include personal information about individuals connected to the organisation you scan, such as directors or executives. This section explains how we handle that.

• We collect this information only from public sources, and only to generate the report you request. We don't build ongoing profiles of individuals beyond what a given report requires.
• We don't deliberately collect sensitive information (such as health, criminal record, or political or religious affiliation) about individuals, and we take reasonable steps to filter it out where our sources surface it incidentally.
• Because this information is drawn from public sources rather than the individual, and is generally limited to the name and position title of key people, we don't notify each person individually before a report is generated. If you're an individual named in a SteepleTool report and want to know what's included, ask us to correct it, or ask us to review how you're described, contact us at hello@steepletool.com and we'll respond within a reasonable time.
• Reports are AI-generated and may contain errors. We don't treat report content as verified fact about any individual, and neither should you — see our Terms of Service for how reports should be used.

Data is encrypted in transit and at rest. Access is limited to what operating the service requires. No system is beyond compromise; if a breach affects your personal information, we will notify you and the OAIC as the Notifiable Data Breaches scheme requires.

You can ask us to access, correct, or delete your personal information at any time — email hello@steepletool.com. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au). These rights are available to our account holders and to individuals named in a SteepleTool report, whether or not you're a customer of ours.

If this policy changes materially, we'll tell you by email or in the product before the change takes effect. The date at the top is the version you're reading.

This policy sits alongside our Terms of Service, which cover how the service itself may be used.