Privacy Policy
Your plan starts in your browser. Email saving is optional. This version does not send your answers to an AI model.
1. Who is responsible?
CommandBay Business is the name of this business-planning application. The operator is Kate Marie Wallwork trading as CommandBay, ABN 31 818 697 069. For customer support, privacy enquiries and deletion requests, contact commandbay@hotmail.com.
2. Information and choices
You may enter your name, age, email, business idea, registration details, selected answers, notes and future financial plans. Profile details are optional; you may use a nickname and leave age blank. A working email is needed only for email saving. Do not include tax file numbers, passwords, bank or card details, current personal finances, sensitive information or another person’s private information.
The app receives information directly from your entries and backup files you choose. When you contact support, your message and contact details are also provided. Hosting, sign-in and email providers may process IP addresses, browser/device information, timestamps, security logs and delivery records to operate their services.
3. Where your answers go
- Browser draft: answers save in this browser’s local storage. The app does not upload that draft merely because you type an email into your plan.
- Sign-in code: requesting a code sends your email to Supabase authentication and our email delivery provider, Resend. It may create an authentication account even if you never upload a plan.
- Cloud copy: after verification, you choose to save this device’s draft or open your existing plan. Once connected, changes save automatically to Supabase. The current testing database is configured in Sydney, Australia.
- Downloads and restore: PDF, Word and backup files are generated in your browser. The test-payment integration being prepared uses an authenticated Cloudflare endpoint to provide document-rendering code after checking access. Plan answers are not sent to that endpoint for document generation. Imported backups are read locally; confirmed restoration pauses cloud saving. Files you download or share are separate copies under your control.
Disconnecting email saving does not delete your cloud copy, authentication account or browser draft. Closing the page ends this app’s in-memory sign-in session, but local answers remain. Another person using the same browser profile may see them.
4. Purposes and access
We use information to provide your plan, authenticate access, save and restore chosen copies, provide support, investigate faults or abuse and meet applicable legal obligations. Saving by email does not subscribe you to marketing. This version has no advertising pixels or app analytics scripts. Local storage supports saving; service providers may use security technologies.
Cloud access controls separate customers’ plans. Authorised service administrators and providers may access information when needed to operate, support or secure the service. A private saved plan is not an end-to-end encrypted vault. We do not sell your plan or use its content for advertising.
5. AI and automated processing
The AI lesson is educational content. This version formats your answers using predefined rules and performs budget arithmetic in your browser. It does not send plan content to a generative-AI provider, train an AI model on your answers, or make decisions about your eligibility, credit, employment or legal rights. Suggestions are not personalised professional advice.
If an AI-processing feature is introduced, its data flows and controls must be explained before use, with any legally required consent obtained. Links to external AI tools or government websites have their own privacy practices; your plan is not automatically sent when you follow a link.
6. Providers and overseas handling
Supabase supplies authentication and chosen cloud storage; Resend delivers verification emails. Cloudflare hosts this testing website. They receive the information needed for their services; Resend receives email delivery information, not your full business plan. Sending a support email also involves your and our email providers.
An Australian database region does not mean all handling stays in Australia. Resend describes processing in the United States. Supabase and Cloudflare use international operations and subprocessors. The final list of likely recipient countries and applicable provider arrangements remains to be verified before launch.
Provider information: Supabase, Resend, Cloudflare. These do not replace our responsibilities.
Payments testing
Stripe test checkout is being integrated for a proposed one-time A$3 plan unlock. Use only the provided test payment details, never a real card, in a test checkout. Where enabled, checkout sends Stripe your verified email, account reference and purchase information needed to link a test payment to access. Stripe processes information entered on its checkout and technical/security information under its Privacy Policy. Our planned access record in Supabase links your account to the Checkout session, payment reference, access status and timestamps. It does not store full card details. Cloudflare processes authenticated checkout and document-access requests. Plan answers are not sent to Stripe for checkout. Test transactions do not move real funds. Before live payments begin, payment data flows, overseas handling and transaction-record retention must be confirmed and this notice updated.
7. Retention, security and deletion
Local drafts and the previous-draft recovery copy remain until replaced, cleared using Privacy and deletion in the email-saving panel, or removed through your browser’s site-data settings. Close other open copies of the app before clearing a draft. Clearing browser data does not remove cloud copies or downloaded files. Downloaded backups are not password-protected by this app; store and share them carefully.
The current cloud prototype has no automatic plan-expiry or instant cloud account-deletion feature. You can email commandbay@hotmail.com using the deletion-request link in the app. Opening the link does not send the request. We must verify your identity and clarify whether you want the business-plan copy, shared authentication account, or both considered for deletion; removing a shared account may affect other CommandBay services. Cloud plan, authentication, email-log and backup retention periods, must be finalised before paid launch. A manual administrator procedure has been documented, but its identity checks and end-to-end deletion process still require testing. We must not promise instant deletion from backups or indefinite storage. Keep your own backup.
Hosted connections use HTTPS and cloud access is checked against the verified account. No service can promise perfect security. Suspected unauthorised access should be reported to the privacy contact. The launch process must include incident assessment and any notification required by applicable law.
8. Access, correction and complaints
You can view and edit your plan, download a copy, and save corrections while connected. Editing the email field inside your plan does not change your sign-in email. For account corrections, access, deletion or a privacy complaint, contact us with the email used for sign-in and a description of your request. Do not send passwords or verification codes. Reasonable identity checks may be needed before disclosing or changing account data.
Proposed complaint process, pending operator adoption: acknowledge the request, investigate relevant records, respond with the outcome and reasons, and explain any further steps. Aim to respond within 30 days and explain delays. You may seek information or complain to the OAIC where it has jurisdiction; its procedures and eligibility requirements apply.
9. Availability and changes
Australian privacy-law coverage depends on the operator’s circumstances, including turnover and any applicable exceptions. We are obtaining advice on that coverage; this notice describes our handling practices and does not claim an exemption or certified compliance. No general promise of immediate erasure is made. Any records retained for a legal obligation or a justified dispute/security purpose must be limited to what is needed, with the reason explained when responding to a request.
This policy is free to read without signing in. You can print it or request an accessible copy from our privacy contact. Material changes should be brought to users’ attention before new handling begins. This draft describes the current hosted testing preview; it is not certification of compliance with the Australian Privacy Principles.