Legal
Privacy Policy
SlashTech Australia Pty Ltd · Last updated 17 September 2026
01Who this is about
This policy explains how SlashTech Australia Pty Ltd handles personal information in SlashTech — the workspace a firm signs into, the portal that firm’s clients are invited to, and the emails the service sends.
It should be read with our terms of service. Where a firm has signed a separate data processing agreement with us, that agreement governs.
02Controller or processor: which one we are
This is the most important thing on the page, because it decides who can answer a question about your data.
| The data | Who decides | Our role | Who you ask |
|---|---|---|---|
| A firm's account: the firm's name, its staff, their logins, billing arrangement and settings | The firm, with SlashTech Australia Pty Ltd | We are the controller | Us |
| Everything a firm records about its own clients: contacts, projects, documents, time, invoices | The firm, alone | We are a processor acting on the firm's instructions | That firm |
| A client portal user's login and activity in the portal | The firm that invited them | We are a processor | That firm |
03What we collect, and why
From a firm and its staff
| Category | Examples | Why |
|---|---|---|
| Identity and contact | Name, work email, position, phone | To create an account, authenticate a person, and address them correctly |
| Authentication | Password hash, session records, sign-in link tokens | To sign a person in and keep the session secure. Passwords are hashed and never stored or readable in plain text. |
| Work records | Clients, projects, engagements, time entries, documents, invoices | Because this is the product. The firm decides what goes in. |
| Audit and security | Who did what and when, IP addresses on security-relevant actions, rate-limit counters | To investigate an incident, to meet a firm's own audit needs, and to stop abuse |
| Operational diagnostics | Error reports when something breaks | To find and fix defects. See Sentry in section 06. |
From a client portal user
Your name and email, given to us by the firm that invited you; the credentials you set; and a record of what you did in the portal — documents you opened, approved or signed, and messages you sent where the firm has that feature.
From the marketing site
If you join the early-access waitlist, we keep your name, email, company, team size and anything you chose to write in the free-text field. We use it to run the waitlist and for nothing else. It is not added to any other mailing list and is not passed to anyone. Ask us to remove it at any time at privacy@slashtech.com.au.
04What we do not do
- We do not sell personal information, and never have.
- We do not use your data to advertise to you or to anyone else.
- We do not use one firm’s data to serve another firm.
- We do not run per-user behavioural analytics in the product. There is no third-party analytics tag on the signed-in application.
- We do not read a firm’s documents except where support requires it and they ask.
05Keeping it separate, and keeping it safe
Each firm’s data is separated at the record level, and every query the application makes is scoped to the firm the signed-in person belongs to. Reaching another firm’s data is not a matter of guessing an address.
Alongside that:
- Everything is encrypted in transit (TLS), and at rest by the storage providers below
- Passwords are hashed with bcrypt; we cannot read them
- Uploaded files are held in private storage and served only through an endpoint that checks who is asking first
- Access inside our team is limited to the people who need it to operate the service
- Security-relevant actions are recorded in an audit log
No service can promise it will never be breached, and we do not. If a breach affects your data we will tell the affected firm, and where the law requires it the relevant regulator, without undue delay.
06Who else touches it
We use a small number of providers to run the service. These are all of them — not an illustrative list.
| Provider | What for | What it holds |
|---|---|---|
| Amazon Web Services | Hosting and file storage, in Sydney (ap-southeast-2) | The application, and every uploaded file |
| Neon | The database | All application records |
| Upstash | Rate limiting and short-lived caching | Counters keyed to an IP or account; no work records |
| Resend | Sending email | Recipient address and message content, at the time of sending |
| Sentry | Error reporting | Diagnostics when something breaks, which can include the signed-in user's identifier |
Each is bound to use the data only to provide its service to us. We will update this list before adding another.
Beyond those, we disclose personal information only where the law requires it, or to a successor if the business is sold — in which case this policy continues to apply until you are told otherwise.
07Where it is held
The application and uploaded files are hosted in Australia (AWS Sydney). Some providers above operate outside Australia, so limited data — a rate-limit counter, an email in transit, an error report — may be processed overseas. Where that happens we require protections comparable to those we apply here.
08How long we keep it
A firm’s data is kept while its account is active, because that is the product: a record of work that is still being referred to.
When a firm closes its account we make its data available for export, then delete the firm and everything belonging to it — clients, projects, documents, signed agreements and the signature evidence. That deletion cannot be undone.
We have not set fixed retention periods for every category of data, and we would rather say so than publish a number we do not hold ourselves to. If your firm needs specific periods committed to in writing, raise it with us and it can go in your agreement.
09Your rights, and how to use them
Subject to the roles in section 02, you can ask to see the personal information we hold about you, have it corrected, have it deleted, or object to how it is used.
If you are a firm’s staff member, ask your firm’s administrator first — most of it they can do themselves. Otherwise write to privacy@slashtech.com.au.
If a firm invited you into a portal, ask that firm. We will pass a request on if you cannot reach them, but we cannot act on their data without them.
We will respond within a reasonable time. If you are not satisfied with how we have handled a privacy matter, tell us first so we can put it right — and you can escalate to the privacy regulator in your jurisdiction.
10Cookies
The application sets only what it needs to work: a session cookie so you stay signed in, and short-lived cookies for security checks. There are no advertising cookies and no third-party tracking cookies.
Blocking the session cookie will stop you signing in, because it is the mechanism by which you stay signed in.
11Changes, and contact
We may update this policy. Where a change materially affects how we handle personal information, we will tell affected firms before it takes effect. The date at the top is when it last changed.
Privacy questions and requests: privacy@slashtech.com.au.