Privacy Policy

Effective: 24 September 2026
Last updated: 24 September 2026

1. Who we are

This Privacy Policy explains how RePass Cloud Pty Ltd (“RePass Cloud”, “we”, “us” or “our”) collects, holds, uses, discloses and protects personal information in connection with websites, software, applications, APIs, publications, online services and other products that we operate and that link to this policy (collectively, the “Services”).

Corporate details:

RePass Cloud Pty Ltd
ABN: 74642243801
ACN: 642243801
Business location: Findon, SA 5023, Australia
Email: hello@repasscloud.com
Contact: https://repasscloud.com/contact/

Services that may link to this policy include RePass Cloud’s corporate website, How-To-Use-AI.com, Aethon Jobs, Cinturon360, software utilities, publications and other tools we develop or operate.

Some products have a separate privacy notice because they handle information in a way that is materially different from a normal public website. A product-specific privacy notice supplements this policy and prevails for that product to the extent of a genuine inconsistency.

2. Our privacy approach

The extent to which the Australian Privacy Act 1988 applies to a particular RePass Cloud activity depends on the law and the circumstances of that activity.

Whether or not RePass Cloud is legally required to comply with every Australian Privacy Principle for every activity, we intend to use the Australian Privacy Principles as a baseline for responsible handling of personal information, subject to any stricter requirement that applies in a particular jurisdiction or to a particular Service.

Nothing in this policy limits rights that a person has under applicable privacy, consumer or other laws.

3. The information we may collect

The information we collect depends on which Service you use and how you interact with us.

3.1 Identity, account and contact information

This may include:

name;
email address;
telephone number where required by a Service;
organisation or business name;
job title or role;
account or user identifiers;
account permissions and role assignments;
authentication identifiers supplied by an identity provider;
postal, billing or delivery address; and
information needed to administer an account or business relationship.

3.2 Customer and user content

Some Services allow customers or users to submit, upload, create or store information.

The content and personal information in that material depend on the Service and the customer’s use of it. Where RePass Cloud processes information on behalf of a business customer, the business customer may determine the purposes for which that information is collected and used, and additional contractual or privacy terms may apply.

3.3 Orders, billing and payments

For purchases, licences, subscriptions or other paid Services, we may collect or receive:

purchaser or billing name;
email and contact information;
billing and delivery details;
product, plan, licence or service purchased;
order and transaction identifiers;
amounts, currencies and tax information;
payment status;
refunds, reversals and chargebacks;
fraud or risk information; and
transaction records required for reconciliation, accounting or support.

Payment providers such as Stripe may process payment-card details directly. Where provider-hosted or provider-supplied payment functionality is used, RePass Cloud does not intentionally store full payment-card numbers.

3.4 Website, device and technical information

When a person accesses a Service, we or our infrastructure providers may process information such as:

IP address;
date and time;
requested URL and request metadata;
browser and device information;
operating system;
network information;
approximate country or region derived from an IP address;
session, authentication or security identifiers;
application, API, audit and security logs;
error and diagnostic information;
performance and availability telemetry;
anti-abuse, fraud and security signals; and
similar technical information reasonably required to operate and protect the Service.

Different Services have different logging and retention settings. A product-specific privacy notice may state shorter or longer retention periods.

3.5 Communications and support

If you contact us, we may collect:

your contact details;
the content of your message;
attachments you provide;
support or diagnostic information;
complaint or dispute information; and
records of our communications with you.

General contact forms are not intended for passwords, API keys, payment-card details, unnecessary confidential information or sensitive personal information.

3.6 Mailing lists and marketing

Where a Service offers a mailing list or marketing subscription, we may collect:

name, if requested;
email address;
subscription status;
date, time and source of signup;
the wording or version of the consent presented;
confirmation or double-opt-in status;
unsubscribe or suppression status; and
delivery, bounce, open or link-interaction information if the selected mailing service provides and we enable those features.

We do not sell or rent subscriber lists for another business’s independent marketing.

3.7 Contractors, suppliers and professional relationships

We may hold names, business details, contact information, contracts, invoices, payment information, tax or business identifiers and correspondence concerning contractors, suppliers, advisers, authors, contributors, reviewers and other professional relationships.

3.8 Events, surveys, promotions and public interactions

Depending on the activity, we may collect registration details, responses, feedback, competition entries, eligibility information, public social-media interactions, reviews, comments and information supplied by a participant.

3.9 Sensitive information

We do not intentionally request sensitive information as part of our ordinary corporate website, sales, marketing or general support activities.

If a person voluntarily supplies sensitive information that was not requested, we will use it only to the extent reasonably necessary to understand or respond to the matter, meet a legal or record-keeping requirement, or address a genuine legal, security or safety issue. Where it is not reasonably necessary, we will avoid unnecessary copying or distribution and will delete or redact it where reasonably practicable.

A product that genuinely requires different handling will publish additional information.

4. How we collect information

We may collect information:

directly from you;
from your organisation or an authorised administrator;
automatically when you use a Service;
from payment, hosting, security, identity, fulfilment, retailer, communications or other service providers;
from business partners or contractors;
from public sources where reasonably necessary for a legitimate business activity; and
from another person where they are authorised to provide it.

We try to collect only information reasonably necessary for the relevant activity.

5. Why we use information

Depending on the Service and the relationship involved, we may use personal information to:

provide, operate and maintain Services;
create and administer accounts;
authenticate users and manage permissions;
fulfil orders and provide downloads, licences or physical products;
process and reconcile payments, refunds and returns;
communicate about an account, order, product or Service;
provide customer service and technical support;
respond to enquiries, complaints and privacy requests;
operate mailing lists and send communications that a person has requested or that we are otherwise permitted to send;
record and honour marketing preferences and unsubscribe requests;
secure Services and infrastructure;
detect spam, bots, fraud, abuse, unauthorised access and security threats;
investigate incidents, disputes and chargebacks;
maintain audit, security and operational records;
monitor reliability, availability and performance;
improve products, content and business operations;
administer contractors, suppliers, contributors and commercial relationships;
perform accounting, taxation, reconciliation and statutory record keeping;
administer events, surveys, promotions and competitions;
establish, exercise or defend legal rights;
comply with applicable laws and lawful requests; and
support a genuine business sale, restructure or transfer where legally permitted and subject to appropriate protections.

We do not use every category of information for every purpose. Use depends on why the information was collected and which Service is involved.

6. Analytics, cookies and similar technologies

Different RePass Cloud Services use different technologies.

A Service may use:

cookies or local storage required for authentication, sessions, security or preferences;
infrastructure analytics and security telemetry;
website analytics; and
advertising or marketing technologies where they are specifically implemented and lawfully used.

Where non-essential cookies, tracking or similar technologies require consent or an opt-out mechanism under applicable law, the relevant Service will provide the required control before or when those technologies are used.

A site-specific notice may state that analytics or advertising technologies are not used on that site. A Service should not be assumed to use a particular analytics provider merely because another RePass Cloud site uses it.

7. AI-assisted features and automated processing

Some RePass Cloud products may use artificial intelligence or automated techniques to assist with tasks such as search, classification, matching, summarisation, ranking or workflow support.

Where a Service uses personal information in an AI-assisted feature, the applicable product documentation or privacy notice should explain any materially significant use.

Unless a Service expressly states otherwise, RePass Cloud does not intend to use personal information to make solely automated decisions that produce legal or similarly significant effects on an individual without any human or other appropriate review.

8. When we disclose information

We may disclose relevant information to:

cloud hosting, infrastructure and database providers;
identity and authentication providers;
payment processors and financial institutions;
email and mailing-list providers;
security, fraud-prevention and monitoring providers;
analytics providers where a Service uses them;
ecommerce, licensing, retailer, marketplace, distributor, printer, print-on-demand, fulfilment, courier and postal providers;
professional advisers, accountants, auditors and insurers;
contractors and suppliers who need information to perform their work;
business customers where the Service is operated on their behalf or according to their instructions;
regulators, courts, government agencies or law-enforcement authorities where disclosure is required or authorised by law; and
a genuine purchaser or successor in connection with a business sale or restructure where legally permitted and appropriately protected.

We disclose only the information reasonably necessary for the relevant purpose.

We do not sell personal information as a business model and do not sell mailing-list details.

9. Cloudflare, Stripe and other important providers

Cloudflare

RePass Cloud uses Cloudflare services for some websites and applications. Depending on the Service, this may include DNS, CDN, reverse proxy, TLS, security, Workers, databases, observability, analytics and Turnstile.

Cloudflare may process request metadata, IP addresses, security signals and other technical information needed to provide those services.

Cloudflare privacy information:
https://www.cloudflare.com/privacypolicy/

Cloudflare subprocessors:
https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services/

Stripe

Where Stripe is used for direct payment processing, Stripe may process payment, transaction, billing, technical, fraud, dispute and risk information. Stripe may act in different privacy roles depending on the activity.

Stripe privacy information:
https://stripe.com/au/privacy

Stripe privacy centre:
https://stripe.com/au/legal/privacy-center

Other providers

We also use or may use providers for email, accounting, communications, fulfilment, storage, backups, security and other business functions. The providers used for a particular product may change as systems change. Material product-specific providers and data-location information should be stated in the relevant product notice where necessary to understand that processing.

10. Overseas handling

RePass Cloud is based in Australia, but internet, cloud, payment, support and other service providers may process or make information accessible in other countries.

Depending on the Service and provider, information may be processed in Australia, the United States, European countries, the United Kingdom, Ireland and other locations used by the provider or its subprocessors.

When we use an overseas provider, safeguards may include:

reviewing the provider’s privacy and security information;
using applicable service and data-processing terms;
reviewing data-location and subprocessor information where available;
limiting disclosure to information reasonably required for the service;
using encrypted connections for transmission;
applying access controls and account security;
restricting contractor access;
removing access when no longer required; and
using available contractual international-transfer safeguards where required.

A site-specific notice may identify additional countries or more precise data-location arrangements.

11. International privacy laws

If privacy law outside Australia applies to a particular RePass Cloud activity, we will handle requests and processing according to the rights and requirements that apply to that activity.

This may include rights of access, correction, deletion, restriction, objection, portability, withdrawal of consent or rights relating to certain targeted advertising or data-sharing activities.

Where GDPR, UK GDPR or another law requires a stated legal basis for processing, the applicable basis must be assessed for the particular activity. Depending on that activity, a lawful basis may include consent, performance of a contract, compliance with a legal obligation or a properly assessed legitimate interest.

Nothing in this section represents that every overseas privacy law applies to every RePass Cloud Service.

12. Marketing communications

Where we send commercial electronic messages, we use consent or another basis permitted by applicable law and provide an unsubscribe mechanism.

An unsubscribe request made through an automated mechanism is intended to take effect promptly. A manually submitted request will be actioned as soon as practicable and no later than 5 business days after receipt.

We may keep a minimal suppression record after unsubscription so that the address is not accidentally added back to marketing. A suppression record may include the email address or a suitable non-reversible representation, suppression status, date and method of withdrawal and limited consent-history information. It is not used to send marketing.

13. Retention

We retain information for periods appropriate to the reason it is held.

Our general approach includes:

contact and ordinary support records: normally up to 2 years after the matter is resolved, unless another retention requirement applies;
order, transaction, refund, chargeback and related business records: generally up to 5 years after the relevant transaction or final resolution, or longer where required for an unresolved dispute, tax, accounting or legal matter;
accounting and taxation records: for the period required by applicable Australian law;
marketing consent records: while subscribed and, where reasonably required, limited consent-history records for up to 5 years after withdrawal;
suppression records: for as long as reasonably necessary to prevent accidental re-mailing while the relevant mailing list is operated;
security incident records: generally up to 5 years after closure, or longer where an active legal, regulatory, insurance or enforcement matter requires it;
backups: according to the documented lifecycle of the relevant system, with a target maximum of 90 days where that is the configured business backup model; and
product-specific application data and logs: according to the retention schedule published or agreed for that product.

A site-specific notice may state a materially different period. We do not intentionally restore deleted personal information from backups except where necessary for genuine disaster recovery, and backup copies expire through the applicable lifecycle.

14. Security

We use security measures appropriate to the nature of the information and the systems involved. Measures may include:

authenticated administrative access;
access controls and least-privilege permissions;
HTTPS/TLS for network transmission;
established infrastructure and payment providers;
keeping secrets and credentials out of publicly accessible source code;
software and dependency updates;
security, audit and operational logging;
anti-abuse, bot and rate-limiting controls;
backups and recovery arrangements where required;
restricting contractor access; and
incident investigation and response procedures.

No system can guarantee absolute security.

15. Data breaches

Suspected privacy or security incidents are escalated to the business owner or designated privacy/security administrator.

Where required, we will investigate, contain and remediate an incident, preserve relevant evidence, assess the information and people affected, coordinate with service providers and determine whether notification is required.

Where the Australian Notifiable Data Breaches scheme or another mandatory notification law applies, we will make notifications required by that law.

16. Access, correction, deletion and other requests

You may contact us to:

ask what personal information we hold about you;
request access to or a copy of personal information;
request correction;
request deletion where offered or legally required;
withdraw marketing consent;
ask about overseas handling; or
make a privacy complaint.

Where another privacy law gives you additional mandatory rights, we will consider those rights where that law applies.

Identity verification

Verification will be proportionate to the sensitivity and risk of the request.

Where possible, we use information already held, such as confirming from the email address associated with a record, sending a code or link to an existing contact address, or confirming limited transaction information.

Government-issued identity documents are not normally requested and will only be considered where less intrusive verification is insufficient.

Timing

We aim to:

acknowledge a privacy request or complaint within 5 business days; and
provide a substantive response within 30 calendar days where reasonably practicable, or sooner where applicable law requires.

A request may be limited where permitted or required by law, including where identity cannot be reasonably verified, another person’s rights would be affected, legal privilege applies, or information must be retained for taxation, accounting, fraud prevention, dispute, security, regulatory or legal purposes.

No fee is ordinarily charged merely for making a privacy request.

17. Children

Individual Services may set different minimum ages.

Our ordinary corporate and business Services are not directed to young children. If a Service permits users under 18, the product-specific notice should explain any age-specific handling that materially differs from this policy.

Where we learn that personal information from a child has been collected in circumstances where it should not have been collected, we will take reasonable steps to delete it, subject to any lawful retention requirement.

18. Complaints

Privacy complaints should be sent in writing to hello@repasscloud.com and should include enough information for us to understand and investigate the issue.

We aim to acknowledge a complaint within 5 business days and provide a substantive response within 30 calendar days where reasonably practicable.

Where the Office of the Australian Information Commissioner has jurisdiction, an eligible complainant who remains dissatisfied may contact the OAIC after giving us a reasonable opportunity to address the complaint:

https://www.oaic.gov.au/

Other regulators may have jurisdiction depending on the person’s location and the issue.

19. Changes to this policy

We may update this Privacy Policy as our Services, providers or legal obligations change.

The current policy will be published with its effective or last-updated date.

For a material change that could reasonably affect how people understand our collection, use, disclosure, overseas handling, retention or protection of personal information, we may also publish a prominent notice and, where appropriate, notify affected customers or subscribers directly.

A change to this policy does not by itself authorise us to use information already collected for a materially incompatible new purpose. Where fresh consent is required, we will obtain it before that new use.

20. Contact

RePass Cloud Pty Ltd
ABN 74642243801
ACN 642243801
Findon, SA 5023
Australia

Email: hello@repasscloud.com
Contact: https://repasscloud.com/contact/