1. About This Policy
This Privacy Policy explains how Global Matrix Group Australia Pty Ltd ("we", "us", "our") collects, uses, stores, and discloses your personal information when you use the BTAG application, website (btag.cloud), and related services ("Services").
We are bound by the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). This policy is designed to comply with our obligations under that Act.
You need an account to use BTAG, so we need your name and email. Anonymous use is not available (APP 2).
When you create an account, you are asked to review this Privacy Policy before proceeding. This policy serves as our collection notice under APP 5.
2. What Personal Information We Collect
2.1 Information You Provide Directly
| Category | Data Collected | When |
|---|---|---|
| Account Information | Email address, first name, last name, password (stored as one-way hash, never plaintext) | At signup |
| Profile Information | Mobile phone number, username (both optional) | When you update your profile |
| Two-Factor Authentication (optional) | Only if you choose to turn on two-factor authentication: the secret key that links your authenticator app to your account (stored encrypted), and your recovery codes (we keep only a scrambled one-way copy of each code, never the code itself) | When you set up two-factor authentication, or ask for new recovery codes |
| Business Information | Legal business name, ABN or ACN, country | When creating a Business account |
| Content | List names, item descriptions, notes, task details | When you create lists and items |
| Photos and Files | Images and documents you upload | When you attach files to items |
| Feedback | Bug reports, feature requests, screenshots, device info, app version | When you submit feedback |
| Waitlist Registration | Email address, selected plan tier | When you join the waitlist |
| Referral Information | Referral code usage, signup source | When you use a referral link |
2.2 Information We Collect Automatically
| Category | Data Collected | Purpose |
|---|---|---|
| Authentication Data | IP address, device type, browser type | Security, fraud prevention |
| Two-Factor Sign-In Checks | When you sign in with two-factor authentication on: the IP address and browser of that sign-in, its time, and how many wrong codes were entered | Completing your sign-in securely, limiting code guessing |
| QR Code Scan Logs | IP address, device type, timestamp. Location data is only collected if the list owner has turned on proximity restrictions, and the scanner is notified first. | Access control, usage reporting |
| Login Attempt Logs | Email used, IP address, success/failure, timestamp. This includes wrong two-factor codes, and wrong passwords or codes entered when setting up or changing two-factor authentication | Brute force protection |
| Usage Statistics | Per-account counts (items created, logins, last activity) | Service improvement |
| AI Credit Usage | Credits consumed, feature used, timestamp | Billing, usage tracking |
2.3 Information We Generate
| Category | Data Generated | Purpose |
|---|---|---|
| Image Fingerprints | A digital fingerprint of your photo, generated and stored entirely within Australia. It cannot be reversed back into the original image. | Powering visual search ("find items that look like this") |
| Text from Photos | Text read from your photos, like serial numbers or labels (only when you request it) | Text-based search of photo content |
| Thumbnails | Compressed preview images of your uploads | Faster loading in the app |
2.4 Information We Do NOT Collect
- We do not use third-party analytics tools (no Google Analytics, Mixpanel, or similar trackers)
- We do not serve advertising or share data with advertisers
- We do not collect biometric data. If you enable biometric login, that data stays on your device
- We do not store credit card numbers. Payment processing is handled entirely by Stripe
- We do not collect date of birth or age information
- We do not collect your home or business address
3. How We Use Your Personal Information
| Purpose | Why We Can |
|---|---|
| Providing the Service: creating your account, storing your lists and items, generating QR codes, enabling search | APP 6 (it's why you signed up) |
| Authentication and Security: verifying your identity, protecting against unauthorised access | APP 6, APP 11 (keeping your account safe) |
| Photo Search: creating image fingerprints for visual search; reading text in photos when you ask | APP 6 (core feature) |
| Service Improvement: understanding usage patterns, identifying bugs, improving features | APP 6 (related to providing the service) |
| Customer Support: responding to your feedback and bug reports | APP 6 (you contacted us) |
| Referral Program: crediting users who refer friends | APP 6 (you opted in) |
| Communication: sending service-related notifications | APP 6 (keeping you informed) |
| Legal Compliance: responding to lawful requests from authorities | APP 6 (required by law) |
We only use your personal information for direct marketing where you have agreed to it — for example when you join our waitlist — and you can opt out at any time. See section 8.5, Opt Out of Communications, below.
4. How We Store and Protect Your Information
4.1 Where Your Data Is Stored
Your data is stored on Oracle Cloud Infrastructure servers in Australia.
4.2 Security Measures
| Measure | Detail |
|---|---|
| Passwords | Your password is scrambled using industry-standard encryption. We cannot read it. |
| Login Sessions | Login sessions use short-lived encrypted tokens that expire automatically. |
| Two-Factor Authentication | Optional. With it on, signing in needs your password and a 6-digit code from an authenticator app, or one of your single-use recovery codes. A code cannot be used twice. The app's secret key is stored encrypted, and recovery codes are kept only as scrambled one-way copies. Turning it on or off signs you out everywhere else you are signed in, and we email you when it is turned on or off, when a recovery code is used to sign in, and when support resets it at your request. If you lose both your authenticator app and your recovery codes, you can ask BTAG support to turn it off, and we will check who you are first. |
| Encryption in Transit | All connections are encrypted, including internal database connections. |
| Encryption at Rest | Your data is encrypted when stored. Even if someone accessed the server, they couldn't read it. |
| Secrets Management | Passwords and signing keys are stored in a secure vault. No secrets in our source code. |
| Account Isolation | Every request is checked to make sure you can only access your own data. |
| Login Protection | Too many failed login attempts, including wrong two-factor codes? We temporarily block further attempts to protect your account. |
4.3 Data Breach Response
We take the security of your data seriously. We follow industry best practices, regularly update our systems, and actively monitor for threats. If, despite our efforts, your data is compromised, we will notify you and the Australian Information Commissioner as required by law.
5. Third-Party Services
We share limited data with the following third-party services, solely to operate the BTAG service:
| Service | Data Shared | Purpose | Data Residency |
|---|---|---|---|
| Oracle Cloud Infrastructure | Photos, files, database records | Cloud hosting and storage | Australia |
| Text Extraction Service | Image content (only when you request text reading) | Reading text from your photos | Australia |
| Stripe | Payment details collected directly by Stripe. We may share your email address with Stripe to associate payments with your account. | Payment processing | Stripe's infrastructure (see Section 10) |
| Atlassian Jira | Bug report title, description, screenshot (if attached) | Issue tracking | Atlassian Cloud (see Section 10) |
If you turn on two-factor authentication, you choose which authenticator app to use; it is not one of our services. The QR code you scan during setup includes your email address, which the app shows as the name of your BTAG account. Some authenticator apps back up their entries to their maker's servers. BTAG sends nothing to the app's maker.
We do not sell, rent, or trade your personal information to any third party.
6. Cookies and Local Storage
BTAG is a web application and mobile app. We do not use traditional tracking cookies.
| Storage Type | What We Store | Purpose |
|---|---|---|
| Secure device storage | Authentication tokens, user ID, tenant ID, biometric preference | Keeping you logged in between sessions |
| Local storage | Recent search queries | Convenience (showing your recent searches) |
We do not use cookies for advertising, analytics, or cross-site tracking.
7. How Long We Keep Your Data
| Data Type | Retention Period | What Happens After |
|---|---|---|
| Account information | While your account is active | Erased when you ask us to delete your account (see 8.4) |
| Lists, items, photos | While your account is active | Deleted items sit in the Recycle Bin for 7 days, or are removed immediately if you empty it yourself |
| Recycle Bin items | 7 days after deletion, or immediately if you empty it | Automatically purged by a nightly job, or on demand |
| Generated export files | 3 days after generation | Automatically purged. The underlying data is unaffected |
| Authentication tokens | 7 days (refresh), 15 min (access) | Automatically expired and invalidated |
| Two-factor authentication data | While two-factor authentication is on | Deleted when you turn it off, when support resets it at your request, or when your account is deleted. New recovery codes replace the old ones straight away |
| Unfinished two-factor setup | Until you finish setting up, or your account is deleted. Starting again replaces it | Once you finish, it is kept as two-factor authentication data (row above). Otherwise deleted when your account is deleted |
| Two-factor sign-in checks | Until your next sign-in | Replaced each time you sign in. Deleted when you turn two-factor authentication off, when support resets it, or when your account is deleted |
| Transaction and payment records | As long as tax and company law requires | Retained for legal compliance, then deleted |
| QR code scan logs, including location | Retained while the tag is in use | Kept for access control and security |
| Waitlist registrations | Until you sign up or request removal | Deleted upon request |
8. Your Rights Under the Australian Privacy Principles
8.1 Access Your Information (APP 12)
You can request a copy of the personal information we hold about you. We will respond within 30 days. There is no charge for making a request, but we may charge a reasonable fee for providing access if the request requires substantial effort.
8.2 Correct Your Information (APP 13)
If your personal information is inaccurate, incomplete, or out of date, you can update your profile directly in the app (name, email, phone) or contact us to correct information you cannot update yourself.
8.3 Complain About a Breach of Privacy
If you believe we have breached your privacy, you can:
- Contact us at support@btag.cloud
- We will investigate and respond within 30 days
- If unsatisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
8.4 Request Deletion
You can ask us to delete your account by raising an Account Deletion request in the app, or by emailing support@btag.cloud. We will verify the request is from you, then act on it within 30 days. Deletion is permanent and cannot be undone.
We remove your personal details from our systems, and delete the content of any account you own.
We keep payment records for as long as tax and company law requires. Copies may remain in our backups for a short time. Everything else follows the retention table in section 7.
8.5 Opt Out of Communications
You can opt out of non-essential communications at any time by emailing support@btag.cloud with "unsubscribe" in the subject line, or by using the unsubscribe option your email app offers on our messages. We action unsubscribe requests within 5 business days.
8.6 Withdraw Consent
Some features (like location-based access restrictions) require your permission. You can turn them off at any time in the app or by contacting us. Turning off a feature stops future data collection for that feature. Data already collected is kept as set out in the retention table in section 7, except where that table says turning the feature off deletes it (for example, two-factor authentication). Some features may not work without the relevant permission.
9. Children's Privacy
You must be at least 16 to use BTAG. We do not knowingly collect personal information from anyone under 16. If you believe a child under 16 has created an account, contact us at support@btag.cloud and we will delete it.
10. Cross-Border Disclosure
All personal information is stored and processed in Australia. We do not transfer personal information overseas except in the following limited circumstances:
- Atlassian Jira: Bug reports you submit may be stored on Atlassian's servers, which may be outside Australia. Atlassian is security-certified (ISO 27001). See Atlassian's privacy policy.
- Stripe: If you make a payment, Stripe processes it on their global servers. Stripe meets the highest payment security standards (PCI DSS Level 1). See Stripe's privacy policy.
We take reasonable steps to ensure these services handle your data consistently with Australian privacy law (APP 8).
11. Changes to This Policy
We may update this policy from time to time. When we make material changes, we will update the "Last Updated" date at the top of this page and notify you via in-app notification or email. For changes that expand how we collect or use your personal information, we will seek your explicit consent before those changes take effect. For other minor updates, continued use of the Services after notification constitutes acceptance.
We encourage you to review this policy periodically.
12. How to Contact Us
If you have questions about this policy, email us at support@btag.cloud.
13. Definitions
| Term | Meaning |
|---|---|
| BTAG | A QR code tag linked to a list of items in the BTAG application |
| Account | Your account in BTAG. Business users may have multiple people under one account. |
| Workspace | A space within your account that holds your lists, items, and files |
| Image Fingerprint | A digital summary of a photo used for visual search. It cannot be turned back into the original image. |