Privacy Policy

This policy explains how Calibre Forum (ABN 32 737 926 202, a sole trader business in Australia) collects, uses and discloses personal information through this website, the owner app and the staff survey. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 and, for New Zealand users, the Privacy Act 2020.

Two roles

When an employer buys Calibre Forum and invites its team, the employer decides who is invited and why. For the staff roster and survey responses, we act on the employer's behalf to run the service. For owner accounts, payments and website visits, we decide how the information is used.

What we collect

Owner and admin accounts: name, email address, organisation name, industry, approximate size and which people have access.
Staff roster: the email addresses of people the employer invites, the group they are in (owner, manager, staff or IT) and optionally a job title or name entered by the employer.
Survey responses: the answers a person gives, stored against their group and submission time, not against their name or email. Answers can include free text, which may contain personal information if a person chooses to write it.
Payments: handled by Stripe. We receive confirmation of purchase, plan and billing details such as the customer's name and email, but not card numbers.
Messages: what you send through the contact form.
Website use: cookies and similar technologies set by Google Analytics and Google Tag Manager on this marketing website, such as pages viewed and device type. These are not used on the survey, the app or the report. Our pages also load fonts from Google Fonts and, in the survey and app, a software library from a public content network, which means your device's address is visible to those services.

Why we use it

To run the survey, produce the report and email it to owners and admins.
To send invitations, sign-in codes and service emails.
To take payment and keep records the law requires.
To answer questions, provide support and fix problems.
To understand how the website is used and improve it.

We do not sell personal information, and we do not use survey responses for advertising.

Who we share it with

We use service providers to run Calibre Forum: Supabase (database and sign-in, hosted in Sydney), Netlify (hosting), Stripe (payments), Resend (email delivery), Anthropic (drafting some report wording from finished scores, organisation name and industry only), Baby Love Growth (writing blog articles, with no visitor, customer or survey information) and Google (website analytics). Some of these providers operate outside Australia, including in the United States, so personal information such as email addresses can be handled overseas. They may use the information only to provide their services to us. See Security and privacy for what each provider does.

We may disclose information where the law requires it or to protect people from serious harm.

How long we keep it

We keep account, roster and survey data while an account is active so owners can open their reports. You can ask us to delete an organisation's data or your own personal information. We keep some records, such as payment records, for as long as the law requires.

Your choices and rights

You can ask to access or correct personal information we hold, or to have it deleted, using the contact page and choosing "Privacy or data request". If your information is in a staff survey, we may need to refer you to your employer, because survey responses are not stored against names. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or, in New Zealand, the Office of the Privacy Commissioner (privacy.org.nz).

Cookies

This marketing website uses Google Analytics and Google Tag Manager to count visits. You can block these cookies in your browser settings or use a browser extension that blocks analytics. They do not run in the survey, the owner app or the report.

Security

We use reasonable measures to protect personal information, described on our security page. If we become aware of an eligible data breach, we will notify affected organisations and, where required, the regulator.

Changes

We will update this page when our practices change and show the date at the top.