Privacy Policy

1. Information We Collect

Account Information

When you create a Scan365.ai account we collect your full name, email address, password (stored as a cryptographic hash), company name, job title, industry, business website, LinkedIn profile, phone numbers, address, city, state, postcode and country.

Scan Data

When you run a security scan we collect the domain name you scan, M365 tenant domain, company size, scan results including risk scores and findings, and timestamps. We do not scan or access the internal content of your systems.

Usage Data

We collect information about how you use Scan365.ai including pages visited, features used, scan history and login times for security and service improvement purposes.

Payment Information

Payment processing is handled by Stripe. We do not store credit card numbers or payment card data. We receive transaction records including plan type, amount and payment status.

2. How We Use Your Information

• To provide, operate and improve the Scan365.ai service
• To send scan results, reports and security alerts
• To process payments and manage subscriptions
• To provide customer support and respond to enquiries
• To personalise your experience and tailor recommendations
• To send service announcements and product updates (you may opt out)
• To comply with legal obligations and prevent fraud
• To aggregate anonymised data for security research and product development

3. Data Storage and Security

All Scan365.ai data is stored in a PostgreSQL database hosted in the Oceania (Sydney) region by Supabase. Your data does not leave Australia. Supabase is SOC 2 Type II certified.

We implement the following security controls:

• Encryption at rest and in transit (TLS 1.3)
• Cryptographic password hashing
• Multi-Factor Authentication for privileged access
• Audit logging of all data access and changes
• Role-based access control limiting staff access to data

4. Disclosure of Information

We do not sell your personal information to third parties. We may share your information with:

• Supabase: Our database provider for data storage and hosting
• Stripe: Our payment processor for subscription management
• Law enforcement: Where required by Australian law or court order
• IT Service Link staff: On a need-to-know basis to deliver the service

5. Your Rights

Under the Australian Privacy Act 1988 you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of your account and personal data
• Opt out of marketing communications at any time
• Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

To exercise these rights, contact us at admin@itsl.com.au. We will respond within 30 days.

6. Cookies

Scan365.ai uses essential cookies for authentication and session management. We do not use tracking cookies or third-party advertising cookies. You may disable cookies in your browser but this may affect the functionality of the service.

7. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on Scan365.ai. Continued use of the service after changes constitutes acceptance of the updated policy.

8. Contact Us