Privacy Policy

Last updated 7 Nov 2026

This policy explains how Junction Software (we, us) handles personal information. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you are in the EU or UK, we also handle your information in line with the GDPR as set out below.

1. Two kinds of information

About our customers and visitors. When you visit our website, sign up or use the service, we collect information about you. We decide how it is used, and this policy covers it.

Held for our customers. Businesses using the service store information about their own customers, staff and suppliers in it, such as names, addresses, emails, phone numbers and orders, often brought in from Shopify or Xero. For that information the business is in charge and we handle it on their behalf and on their instructions. If you are one of their customers, please contact that business first.

2. What we collect

• Sign-up and account details: your name, business name, email, phone, store address, and what you tell us about your business;
• Login and security details: your email, a scrambled (hashed) copy of your password, two-step login settings, the devices and internet addresses you sign in from, and sign-in attempts;
• Billing details: billing email and plan. Card details are handled by our payment provider and we never see the full number;
• Activity: what is done in the service and by which login (the history), page load times and errors, so we can keep it secure, fix problems and make it faster;
• Messages you send us.

We don't use advertising trackers or sell personal information.

3. Why we use it

To run, secure, support and improve the service; to approve accounts, bill and contact you about your account; to prevent misuse and fraud; and to meet our legal obligations. We'll only send you marketing if you agree, and you can stop it at any time.

For EU and UK visitors, our lawful bases are: performing our contract with you; our legitimate interests in running a secure, working service; your consent where we ask for it; and legal obligations.

4. Where it is stored

The service and its database are hosted in Sydney, Australia. Some of the providers we use may handle information overseas, mainly in the United States, under their own security and privacy commitments. We take reasonable steps to make sure they protect it.

5. Who we share it with

Only with providers who help us run the service, and only what they need:

• Vercel (hosting) and Neon (database), Sydney;
• Resend (email sending);
• Stripe (card payments), once connected;
• Twilio (text messages), where a customer turns them on;
• Google (sign-in to Google services, Calendar and Drive), where a customer connects them;
• Shopify, Xero, QuickBooks and other services you choose to connect, under their own terms.

Our pages load the Poppins font from Google Fonts, which sees your internet address when it sends the font.

We may also disclose information where the law requires it, to protect our rights or safety or others', or to a buyer of our business, who must keep this policy.

6. How long we keep it

Account and business data: while your account exists, and read only after you cancel, until you ask us to delete it. Sign-in attempts and page load times: up to 30 days. Error logs: up to 60 days. The activity history: while your account exists. Billing records: as long as tax law requires, usually 5 years.

7. Keeping it safe

Every person has their own login. Passwords are stored hashed, two-step login is required for everyone, wrong passwords lock an account, and each business can only see its own data. Data is encrypted in transit and at rest. No system is perfectly secure, so we can't promise information will never be accessed without permission.

8. If something goes wrong

If a data breach is likely to cause serious harm, we will tell the affected businesses and people, and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. Where we hold information for a business, we'll tell that business promptly so it can meet its own obligations.

9. Your choices

You can ask to see or correct the personal information we hold about you, or ask us to delete it, by emailing help@junctionsoftware.com.au. We'll reply within 30 days. EU and UK visitors can also object to or restrict how we use it, ask for a copy in a portable form, and withdraw consent.

10. Complaints

Email help@junctionsoftware.com.au and we'll respond within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or, in the EU or UK, to your local data protection authority.

11. Changes

We may update this policy. The date at the top shows when it last changed, and we'll email account admins about significant changes.