1. Introduction
1.1 This Privacy Policy explains how Spectrus (Spectrus, we, us or our) collects, uses, discloses and otherwise handles personal information in connection with the Spectrus websites, applications and services (the Service).
1.2 We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where they apply to our handling of personal information, the General Data Protection Regulation of the European Union and of the United Kingdom (together, the GDPR), the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act (the CCPA) and other applicable United States state privacy laws, and other applicable data protection laws.
1.3 In this Policy, personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, and includes personal data as defined under the GDPR. Terms such as Service, Deck, Prospect and Your Content have the meanings given in our Terms of Service.
1.4 This Policy forms part of, and should be read together with, our Terms of Service and our Cookies Policy. By accessing or using the Service, or by providing personal information to us, you acknowledge the practices described in this Policy. If you do not agree with this Policy, you should not use the Service.
2. Who this Policy applies to, and our role
2.1 This Policy applies to personal information we handle about: (a) account holders, being the individuals and businesses that register for and use the Service (Customers); (b) Prospects and deck viewers, being the individuals whose information a Customer inputs into the Service, and the individuals who open or interact with a public Deck page; and (c) visitors to our websites.
2.2 Our role depends on the information concerned:
(a) For personal information about our Customers, and personal information collected through the general operation of our websites and Service, we are the controller (in APP terms, the entity that determines how the information is handled).
(b) For personal information about Prospects that a Customer inputs into the Service, and for the generation of a Deck from it, we act as a processor on behalf of, and on the instructions of, the Customer, who is the controller of that information and is responsible for it. Our Terms of Service require the Customer to have the right to provide that information and to have obtained any consent required by law.
(c) For engagement information collected on public Deck pages, our systems perform the collection using cookieless and anonymous methods, as described in clause 4. We do not use cookies or session recording on public Deck pages. The Customer determines the sending and distribution of the Deck and remains the controller of, and responsible for, the prospect information it provides and its own compliance with applicable laws.
3. The personal information we collect
3.1 Information we collect from Customers. When you register for or use the Service, we may collect: (a) identity and contact information, including your name and email address; (b) authentication information, including your password in hashed form, identifiers associated with your Google sign-in if you use it, and information relating to any multi-factor authentication you enable; (c) account and security information, including your internet protocol (IP) address, device and browser information, and approximate location derived from your IP address, which we use for account security and to show you the devices on which you are signed in; (d) billing information, which is collected and processed by our third party payment provider, noting that we do not store your full payment card details; (e) the content you submit to the Service, being Your Content, which may itself contain personal information, including personal information about Prospects, and logos, images, reviews and testimonials; (f) usage information about how you use the Service, including Decks generated and Credits used; and (g) the content of communications you send to us, including support requests.
3.2 Information about Prospects and information collected on Deck pages. In connection with a Customer's use of the Service, we handle: (a) information a Customer inputs about a Prospect, such as a name, a website address, or a link to a public profile; (b) information generated by the Service's automated research of publicly available sources about a Prospect, which is used to prepare a Deck; and (c) engagement information collected when a public Deck page is opened or interacted with, which may include the fact and time of an opening, the time spent viewing, the sections viewed and the depth of viewing, whether the Deck was viewed to the end, and interactions with links, including any booking link.
3.3 Location information on Deck pages. When a public Deck page is opened, we may derive an approximate, city level location from the IP address of the request. For engagement information, we do not store the visitor's IP address with the engagement record. Any IP address is processed transiently for this purpose, and separately for security and abuse prevention. We keep location to a city level, and we do not link locations across separate openings or use them to identify an individual.
3.4 Cookies, analytics and session recording. We use cookies and similar technologies, analytics, and session recording on our marketing website, as described in clause 4. We do not use these technologies on public Deck pages, which are cookieless. Where these technologies are not strictly necessary, we use them only in accordance with clause 4.
3.5 Information collected automatically. When you use our websites and the Service, we and our service providers may automatically collect technical information, including IP address, device identifiers, browser type, operating system, referring pages, and information about your interactions, using cookies, server logs and similar technologies.
3.6 Information from third parties and public sources. We may collect personal information from third parties, including our service providers, and from publicly available sources when the Service researches a Prospect. Where a Customer provides us with personal information about another individual, the Customer is responsible for ensuring it is entitled to do so.
3.7 Sensitive information. We do not seek to collect sensitive information (as defined in the Privacy Act), and you should not submit sensitive information, or enter it into a Deck page. If you provide sensitive information to us, you consent to us handling it for the purpose for which it was provided.
4. Cookies, analytics and session recording
4.1 We use cookies and similar technologies, analytics and session recording as described in our Cookies Policy, which forms part of this Policy. In summary, our signed-in application uses only strictly necessary cookies, our marketing website at spectrus.io uses analytics and session recording (including Microsoft Clarity) subject to consent where required by law, and our public Deck pages are cookieless and are not session recorded. Please see our Cookies Policy for full details and for how to manage your choices.
5. How and why we use personal information
5.1 We use personal information for the following purposes: (a) to provide, operate and maintain the Service, including to create, host and display Decks and to research Prospects; (b) to authenticate users and keep the Service and accounts secure, and to detect, prevent and address fraud, abuse and security incidents; (c) to measure and report engagement with Decks, and to provide analytics to Customers; (d) to process payments and administer Credits, plans and accounts; (e) to respond to your enquiries and provide support; (f) to communicate with you about the Service, including transactional and service messages, and, where permitted, product and marketing communications in accordance with clause 10; (g) to operate, analyse, improve and develop the Service, including in aggregated or de-identified form; and (h) to comply with our legal obligations and to establish, exercise or defend legal claims.
5.2 Legal bases (where the GDPR applies). Where we act as a controller and the GDPR applies, we rely on the following legal bases: performance of a contract with you; our legitimate interests in operating, securing, improving and marketing the Service, where these are not overridden by your interests; your consent, including for non-essential cookies, session recording and, where required, marketing, which you may withdraw at any time; and compliance with legal obligations. Where we act as a processor for a Customer, the Customer is responsible for the legal basis for the processing, and we process the information on the Customer's documented instructions.
6. When we disclose personal information
6.1 We may disclose personal information to:
(a) Service providers and sub-processors that help us provide the Service, under obligations of confidentiality and data protection, including providers of artificial intelligence and computing (including Anthropic), hosting and computing infrastructure (including Vercel), database, authentication and storage services (including Supabase and Cloudflare), email delivery and forwarding (including Resend), sign-in services (including Google), geolocation services, payment processing (including our payment provider), website analytics and session recording (including Microsoft Clarity), and, where a Customer uses them, scheduling and booking providers.
(b) The relevant Customer. Where we handle information about a Prospect or a deck viewer on behalf of a Customer, we make engagement information and related data available to that Customer.
(c) Our professional advisers, and other parties, where reasonably necessary to obtain advice or to establish, exercise or defend legal rights.
(d) A purchaser or successor of our business, in connection with a sale, merger, reorganisation or similar transaction, subject to appropriate confidentiality protections.
(e) Law enforcement, regulators, courts and government authorities, where required or authorised by law, or to protect the rights, property or safety of any person.
6.2 We do not sell personal information, and we do not share personal information for cross context behavioural advertising, as those terms are used in the CCPA and other United States state privacy laws.
6.3 The Service is provided by Hybrid Acquisition Pty Ltd, and references in this Policy to Spectrus, we, us and our are references to Hybrid Acquisition Pty Ltd.
7. Overseas disclosure and international transfers
7.1 We and our service providers store and process personal information on infrastructure located in the United States, and personal information may be disclosed to, or accessed from, other countries in which we or our service providers operate.
7.2 By using the Service, you acknowledge and, where required, consent to the disclosure of your personal information to recipients located outside Australia, including in the United States. Where the GDPR applies to a transfer, we take steps to ensure an appropriate level of protection for the information, including by relying on an adequacy decision, or by putting in place standard contractual clauses or another lawful transfer mechanism.
8. How we store and protect personal information
8.1 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including through access controls, authentication measures, and encryption of information in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
8.2 You are responsible for keeping your account credentials secure, as set out in our Terms of Service.
9. How long we keep personal information
9.1 We keep personal information for as long as it is needed for the purposes described in this Policy, including for as long as your account is active, and after that as required to comply with our legal obligations, resolve disputes and enforce our agreements. We may retain information in aggregated or de-identified form.
9.2 As described in our Terms of Service, deletion of an account results in the loss of its Decks, public links and associated engagement data. We may retain copies in routine back-ups for a limited period, and where required or permitted by law.
10. Direct marketing and communications
10.1 We send transactional and service communications relating to your account and the Service. You cannot opt out of these while you hold an account, because they are necessary to provide the Service.
10.2 We may also send you product and marketing communications about the Service. Where we do, we will do so in accordance with the Spam Act 2003 (Cth), the APPs and, where applicable, the GDPR, and you may opt out at any time using the unsubscribe function in the message or by contacting us. Where your consent is required to send such communications, we will obtain it first.
11. Your privacy rights and choices
11.1 Access and correction. You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, by contacting us using the details in clause 15. We will respond as required by the Privacy Act. We may need to verify your identity, and in some cases we may decline a request as permitted by law, in which case we will give you reasons.
11.2 Additional rights where the GDPR applies. Where the GDPR applies to our handling of your personal information as a controller, you may also have the right to erasure, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it, without affecting the lawfulness of processing carried out before the withdrawal.
11.3 Prospects and deck viewers. Where we handle personal information about a Prospect or deck viewer on behalf of a Customer, the Customer is the controller of that information. If you are a Prospect or deck viewer and wish to exercise your rights, you should contact the Customer that sent or distributed the Deck. If you contact us, we will refer your request to the relevant Customer, or assist that Customer to respond, as appropriate.
11.4 Cookies and session recording. You can manage cookies and withdraw consent to non-essential technologies, including session recording, as described in our Cookies Policy.
11.5 United States state privacy rights. If you are a resident of California or of another United States state with an applicable privacy law, you may have rights to know or access the personal information we hold about you, to request its deletion or correction, to opt out of any sale of personal information or any sharing of personal information for cross context behavioural advertising, and to not receive discriminatory treatment for exercising your rights. As stated in clause 6.2, we do not sell personal information and do not share it for cross context behavioural advertising. You may exercise your rights, including through an authorised agent where permitted, by contacting us using the details in clause 15, and we will verify and respond to your request as required by applicable law. Where offered, you may also use an opt-out preference signal as described in our Cookies Policy.
12. Children
The Service is intended for business and professional use and is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.
13. Third-party sites and services
Our websites, the Service and Decks may contain links to, or integrate with, third-party websites and services. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.
14. Changes to this Policy
We may update this Policy from time to time. The current version is the version published in the Service, and it takes effect when posted. Where a change is material, we will take reasonable steps to notify you. Your continued use of the Service after a change takes effect indicates your acknowledgement of the updated Policy.
15. How to contact us and make a complaint
15.1 If you have a question about this Policy, wish to exercise a privacy right, or wish to make a complaint about how we have handled your personal information, you can contact us at support@spectrus.io.
15.2 If you make a privacy complaint, we will acknowledge it and respond within a reasonable time. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. If you are in the European Union or the United Kingdom, you may also have the right to lodge a complaint with your local data protection authority.