Privacy policy

Your portal account

Creating an account collects only three things:

• Your email address, which is your sign-in identity and where account, licence and billing email is sent.
• A display name of your choosing.
• A password, stored only as a salted hash. The original is never written anywhere.

We do not ask for a company name, an ABN, a postal address or a phone number, and there is no field to enter one. Alongside the account we record whether the email has been verified, when you last signed in, and whether the account is active.

If you enable multi-factor authentication, the one-time codes are sent to your email address. Password reset requests record the request time and the IP address the request came from, so a reset attempt on your account can be investigated. Reset tokens are stored as hashes and expire.

Billing and payments

Payments run entirely through Stripe. Card numbers never reach a PezPC server. You enter them on Stripe's own hosted checkout page, and PezPC only ever receives the result. The Stripe customer record we create carries your email address and display name and nothing else; we do not collect a billing address or a tax identifier.

What is stored on our side:

• The Stripe customer and subscription identifiers linking your account to Stripe.
• Subscription state: plan, seat count, billing cadence, trial and period dates, whether it is set to cancel.
• Invoices: amount paid and due, currency, status, dates, and the links to Stripe's own hosted invoice page and PDF.
• Refunds, including the reason and which administrator issued one.
• Discount code redemptions.
• A ledger of the webhook events Stripe sent us, so a failed payment update can be retried rather than lost.

Stripe is a separate controller for the payment information it holds. See Stripe's privacy policy.

What your PezNet install sends us

A licensed install checks in so its entitlement stays valid. This is the only routine automatic flow from your infrastructure to ours, and it carries no records from your database.

When a licence is activated, the install sends either the activation code you made for it on My Licences, or a request for you to approve in the portal. An approval request may name a portal account email address to send an approval prompt to. Either way it also sends:

• A randomly generated install identifier. It is a random value generated once on that server; it is not derived from your hardware and does not identify the machine outside our records.
• The organisation name entered during setup, used as the install's label in your licence list.
• The application version and the server's machine name.

We record the public IP address an approval request came from and show it, with the server's name, machine name and version, on the approval page and in the approval email, so you can tell a server you are setting up from one you are not. Once activated, the install is given a secret that it sends with every check-in. We keep only a one-way hash of it.

On each subsequent check-in, hourly by default, it sends:

• The licence token identifier, the install identifier and the install's secret.
• The application version and how long the service has been running.
• The number of seats the licence entitles, and the number of paired secondary servers.

Our server additionally records the public IP address each check-in arrived from, and keeps one row per check-in. It does not send, and we do not receive, user names, user counts, asset counts, device inventories, network data or anything else from the install's database.

Update downloads. Installs fetch a list of available versions from https://updates.peznet.pez.au and, when updating, the release files. A release file request carries the install's licence token identifier and install identifier so the licence can be checked before the file is served; nothing else is sent, and neither is stored. As with any web request, our web server's access log records the source IP address, the user agent and what was requested. Downloads are not recorded in our database.

Feedback reports

Nothing is sent unless a user inside a PezNet install chooses to submit a report. The form shows every field before it is sent. A report carries:

• The report type, the subject and the text written.
• An optional contact email address, only if the reporter asks to be told the outcome.
• The reporter's username and email address, and their organisation name.
• Their server's host name and URL, and the page they were on, which may include a record identifier.
• Their browser user agent, time zone and local time, plus the application version and release channel.
• Any files attached, up to five, stored in our database.
• The IP address the report arrived from.

One caveat worth knowing. Attachments are served from a link protected only by a long random token, because the issue tracker has to be able to fetch and display them. Anyone holding that link can open the file. The links are not published anywhere outside the private repository, but they are the one part of a report not protected by a sign-in.

If the reporter opted in to be notified, we email them when the report is filed and when it is resolved. Reports and their attachments are retained so the issue history stays intelligible. See retention below.

Email we send

Email is sent through an SMTP relay PezPC operates or subscribes to. There is no third-party marketing platform, no tracking pixels and no open or click tracking.

• Transactional messages: welcome and email verification, password reset and change, licence purchased, expiring or ended, trial ending, a new server registering, a server running without a licence, and feedback outcomes. These are required to run your account and carry no unsubscribe link.
• Anything else carries an unsubscribe link, as required by the Spam Act 2003 (Cth).

We log the recipient address, subject and delivery outcome of each message so a failed delivery can be diagnosed. We do not log message bodies.

This website

No analytics, ever. There is no Google Analytics, no tag manager, no Plausible or Matomo, no Sentry, no session recording, no advertising and no captcha. There are no tracking cookies. The only cookies set are the session cookie that keeps you signed in and a cross-site request forgery token, both marked HttpOnly and, over HTTPS, Secure.

Two things your browser fetches from elsewhere on every page: the typefaces from Google Fonts and the Bootstrap stylesheet, scripts and icon font from the jsDelivr CDN. Those requests disclose your IP address, browser user agent and the referring page to Google and jsDelivr. No account information is included.

Our web server keeps standard access logs, and requests that fail record the error detail: the correlation identifier, the request path and query, the IP address, the browser user agent and, if you were signed in, your account email. Successful requests are not recorded in the database.

There is no contact form, no newsletter signup and no lead capture of any kind on this site.

Who at PezPC can see this

PezNet is a small operation, and administrator access is limited to PezPC staff who need it to run the service. Rather than describe that vaguely, here is exactly what the administration screens show:

• Every portal account: email, display name, whether it is an administrator, licences held, installs registered, last sign-in and join date.
• A per-customer view: billing totals paid and refunded, every licence with its status and Stripe identifier, every registered install with its name, state, version and last check-in, and every paid invoice.
• Feedback reports, including the reporter's contact details and everything listed in the feedback section above.
• Error records, including IP address, browser user agent and the account involved.

Check-in history is stored but has no administration screen. It is queried directly when a licence question needs it.

We disclose information outside PezPC only to the processors named below in order to run the service, or where we are legally required to: a lawful request from law enforcement, a court order, a regulatory direction, or another binding obligation. We do not sell or rent information to anyone.

How long we keep things

Stated plainly, including where the answer is "indefinitely".

If you delete your account from your profile page, we immediately and permanently delete your registered installs, their entire check-in history, your licence tokens and your password reset history, and we cancel any live subscription. Your account row is anonymised: the email address is replaced with a placeholder, the display name becomes "Deleted user" and the password hash is destroyed.

What deliberately survives that:

• Billing records: subscriptions, invoices, refunds and the Stripe event ledger. Section 262A of the Income Tax Assessment Act 1936 (Cth) requires a business to keep records explaining its transactions for five years from the later of preparing the record or completing the transaction, and the ATO's record-keeping rules apply the same period. These records remain linked to the now-anonymised account row rather than to you by name.
• Feedback reports you submitted, including the contact details attached to them, and any issues already filed in the tracker. Deleting your account does not withdraw them. Ask us and we will remove them.
• Error records and email delivery logs referencing your account.

Your rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and under the GDPR if you are in the EU or UK, you can ask us for the following. Write to pez@pezpc.com.au.

• Access: a copy of what we hold about you, provided in a machine-readable form.
• Correction: your email and display name are editable from your profile; anything else, ask.
• Deletion: the profile page does this for you, subject to the retention above. Ask us and we will also remove feedback reports and any issues raised from them.
• Objection and restriction: tell us and we will stop the processing in question, or explain why we cannot and what your options are.
• Complaints: raise it with us first. If you are not satisfied, in Australia you can escalate to the Office of the Australian Information Commissioner at oaic.gov.au. In the UK that is the ICO; in the EU, your national data protection authority.

Where information is held

PezPC's own servers and database are in Australia, on hardware PezPC operates. There is no cloud hosting provider and no object storage service in the path.

Some of the processors below are overseas: Stripe holds payment information in the United States and elsewhere, GitHub holds feedback issues in the United States, and Cloudflare operates DNS infrastructure globally. Each is a disclosure of personal information outside Australia within the meaning of Australian Privacy Principle 8, and each is named below for that reason.

If there is a data breach

If we become aware of a breach affecting personal information we hold, we assess it and, where it is likely to result in serious harm, notify the affected people and the OAIC under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).

A breach inside your own PezNet install is yours to assess and notify: we have no access to that server and cannot detect it. If we find a security defect in the PezNet software itself, we publish a fix through the update channel and notify licence holders.

Standards and certifications

The status answers two questions at once, because they are genuinely separate. Do we meet it? Aligned means every control is met; partially aligned means some are not, and the linked page says which. Where a standard has its own scale, its grade is shown instead, which is why the Essential Eight reads as a maturity level rather than as an alignment. Has anyone independent said so? Standards with a certification scheme read certified or not certified; those without one read audited or not audited.

A green badge needs both: aligned and verified. Anything short of that is amber, whether the shortfall is a missing control or a missing certificate, so neither can hide behind the other. Blue means the standard does not bite because we architected the risk away, and Legal obligation, we comply marks a law, where there is nothing to certify. Where a standard's own criteria do not apply to how we operate, they count as aligned rather than against us.

One entry is neither of those things. Where somebody else runs an assessment programme and assesses the product themselves, the only honest thing we can publish is whether we hold an outcome from them. Those read Not assessed in grey, and grey means exactly that: no result, rather than a result we fell short of. We do not grade ourselves against a programme that has not assessed us.

ST4S, Safer Technologies 4 Schools, NSIP and Education Services Australia are named above only to identify the programme and the body that runs it. PezPC is not affiliated with, endorsed by, or assessed under ST4S.

Third parties

Everyone outside PezPC involved in running this service.

The policy for your own install

Every PezNet install serves its own privacy policy at https://<your domain or IP>/privacy, reachable without signing in. It covers what that server stores, who inside your organisation can see it, how long it is kept, and which integrations your administrator has turned on. It reads the install's live configuration, so it describes that server rather than making general claims.

The organisation running an install is the data controller for the records inside it. That policy names them, or, if they have not filled in their details yet, says so.