Privacy policy
Stereon is operated by Kavan Mehta, a sole trader trading as Stereon (ABN 23 329 101 017) ("Stereon", "we", "us"). Stereon provides freight planning and dispatch-evidence software to businesses. This policy explains how we handle personal information, meaning information about an identifiable individual, in providing that service. As a small business Stereon may not yet be bound by the Privacy Act 1988 (Cth), but we voluntarily handle personal information in line with the Australian Privacy Principles (APPs).
1. Our role
Most of the information in Stereon belongs to our customers: their freight records, plans and dispatch evidence. For personal information inside those records we act on the customer's behalf and under our agreement with them. For information about the people who use Stereon (account holders) we handle it as described here.
2. What we collect
We collect only what the service needs.
| From | What | Why |
|---|---|---|
| You, when you create an account | Name, email address, and a sign-in identifier. Your password is held by our sign-in provider, not by Stereon. | To authenticate you and attribute your actions |
| Your organisation's administrator | Your organisation membership and role | To decide what you may do |
| Your use of the service | The actions you take, with time, a request identifier, reasons you enter and your role at that moment (the audit trail); names you enter into records, such as an operator on a load-out | Evidence of who decided what, which is the core purpose of the product |
| Freight records | Measurements and their source, which may include the name of the person who captured them; drawings and 3D scans you upload, which may incidentally contain names or images | To describe freight and where each fact came from |
| Documents you choose to analyse with AI | An engineering drawing or specification sheet you upload and choose to analyse, which may contain names in title blocks | To propose dimensions and weight for you to review |
| Billing | Your organisation's plan, billing contact and subscription status. Card details are entered on and held by our payment provider, Stripe; Stereon never sees or stores card numbers. | To provide paid plans |
| Your device and browser | IP address and browser details in server logs; session tokens stored in your browser | Security, diagnostics, keeping you signed in |
We do not intentionally collect sensitive information. We do not use personal information for advertising and we do not sell it.
Scans and drawings. A 3D scan or a photographed drawing can incidentally capture people or personal details. Please avoid this; if it happens, tell your administrator and we will help remove the file where our record-keeping obligations allow.
3. How we collect it
Directly from you when you sign up and use the service, from your organisation's administrator, and automatically from your browser.
4. How we use and disclose it
To provide, secure and support the service; to send you service emails (sign-up confirmation, a welcome, invitations, password resets and billing notices); to record attributable decisions for your organisation; to diagnose faults; and as required by law. Within your organisation, colleagues with the relevant permission can see your name against the actions you took. People in other organisations cannot, with one deliberate exception: an authorised user may create a read-only share link for a decided plan, for example for a driver. Anyone holding that link can view a frozen snapshot of that plan, which may include names recorded on it. A share link is a credential: it can be revoked at any time and expires after 30 days.
AI drawing analysis. Only if you choose to analyse a drawing with AI is that document sent to Anthropic's Claude API. The result is a proposal: nothing is written to an asset unless you confirm it.
We do not use personal information to make automated decisions that significantly affect an individual's rights or interests.
We use service providers that host or operate parts of the service:
| Provider | Purpose | Location |
|---|---|---|
| Railway | Application servers and file storage | Singapore |
| Neon (on Amazon Web Services) | Database and sign-in | Singapore |
| Stripe | Payments, subscriptions, invoices and tax | Australia and United States |
| Anthropic (Claude API) | Optional AI drawing analysis, only when you choose it | United States and other Anthropic locations |
| Google (Gmail) | Sending service emails | United States and other Google locations |
| Google Fonts | Loading the typefaces used by our pages | Global |
5. Overseas disclosure
Your personal information is stored and processed outside Australia. Our application servers, database and sign-in service are in Singapore. Payment information is handled by Stripe, service emails are sent through Google, and drawings you choose to analyse with AI are processed by Anthropic; each may process information in the United States. We take reasonable steps to ensure these providers protect personal information in a way consistent with the APPs.
6. Security
Each customer's data is isolated from every other customer's in the database itself, every access requires authentication, and permissions are enforced on our servers. Completed evidence records are designed to be append-only: a correction is recorded as a later entry rather than by silently rewriting the historical record. We hold no formal security certification.
7. How long we keep it
We keep customer operational and evidence records for as long as the customer relationship requires, because their value is that they do not change. Temporary files, such as abandoned imports and old export packages, are removed periodically. When personal information is no longer needed we take reasonable steps to destroy or de-identify it, subject to record-keeping obligations. You can ask us to delete information and we will handle the request directly.
8. Access and correction
You can ask for the personal information we hold about you, and ask us to correct it, by contacting our Privacy Officer at stereon.invites@gmail.com. We will respond within 30 days. Where the information is part of an evidence record (for example, your name on a dispatch decision), we will correct the account it links to and record a correction, rather than rewrite the historical record, and we will explain this if it applies.
9. Data breaches
We assess any suspected data breach and notify affected customers where appropriate. Where the Notifiable Data Breaches scheme applies to Stereon, we will also notify the Office of the Australian Information Commissioner and affected individuals as it requires.
10. Complaints
Send a complaint to our Privacy Officer at stereon.invites@gmail.com. We will acknowledge it within 5 business days, investigate, and give you a written response within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
11. Changes
We will update this policy when what we collect, or where it is processed, changes, and date each version.