This policy explains how Scheer Group Pty Ltd (ABN 52 685 462 159), trading as Feaso Cloud (“Feaso Cloud”, “we”, “us”), handles personal information. It covers:
- our website, feasocloud.com.au (the “website”);
- the Feaso Cloud app at https://feaso.cloud (the “app”), including sign-in, billing and the emails it sends; and
- feasibilities shared with people outside a customer’s organisation (an “external share”).
We follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). This policy is set out in the order of those principles.
1. Open and transparent management (APP 1)
We have practices, procedures and systems to handle personal information in line with the APPs, and we keep this policy up to date. You can ask for a copy of this policy in another form by emailing hello@feasocloud.com.au.
Who decides what goes into the app. Feaso Cloud is used by businesses (our customers, each an “organisation”). An organisation and its people decide what feasibilities, documents and other content they put into the app. Where that content contains personal information about other people (for example a vendor, a tenant or a joint-venture partner), the organisation is responsible for having the right to collect it and give it to us. We hold and process that content to provide the service to the organisation, as described in this policy.
2. Anonymity and pseudonymity (APP 2)
You can browse the website without telling us who you are. To use the app you need an account in your real name and a working email address, because sign-in, security codes and account emails depend on it. You can contact us with a general question without identifying yourself, but we may need to identify you to help with your account.
3. What personal information we collect (APP 3)
We collect only what we need to run the website and the app.
When you sign up or are invited
- Your name and email address.
- Your organisation’s name, and the plan you chose (Free, Pro or Team, and Team’s number of seats).
- That you agreed to the Terms of Service and this policy.
- A 6-digit code we email you to check the address (we store a protected form of it, not the code itself).
- If someone invites you, the inviter’s name and the role they offered you.
Your account and profile
- Your name, initials, email address, job title and phone number (both optional), profile photo (optional) and avatar colour.
- Your preferences and notification settings.
- When you were last active.
- Your role in your organisation (owner, admin or member).
Your organisation
- The organisation’s name, trading name, ABN, address, entity type and logos.
- The organisation’s plan, seats, trial dates and billing status.
Sign-in and security
- Your password, which we store only as a one-way scrypt hash.
- Your two-factor authentication secret (stored encrypted) and your recovery codes (stored as hashes).
- Your sign-in sessions, including the IP address and browser details (user agent) they were made from.
- Trusted devices: a name made from your browser and operating system (for example “Chrome on Windows”), the IP address, and when a code was last entered. We do not record your location.
- Counters for failed sign-ins and codes, used for lockouts. These are keyed by a protected value, not your email in plain text.
- When you choose a new password, we check it against a list of breached passwords. With the online check, only the first 5 characters of a one-way hash of the password leave our servers (Have I Been Pwned’s range service). Your password itself is never sent.
Billing (Pro and Team)
Payments are handled by Stripe. In Stripe Checkout you give your legal entity name, billing address, email, and optionally an ABN and a purchase order number, plus your card or other payment details. Your card details go directly to Stripe; we never see or store your full card number. We receive and store your Stripe customer and subscription identifiers, the plan, seats, renewal date and payment status.
Your feasibilities and other content
- Projects and feasibilities: names, numbers, addresses, inputs, assumptions, notes, scenarios, saved versions, templates, saved reports and change history (who changed what, and when).
- Joint-venture partner names and terms, tenant names and other details you enter.
- Supporting Documents: files you upload (for example PDFs, spreadsheets, Word files and emails). These may contain personal information about you or others.
- Project cover photos, organisation logos and profile photos (we remove photo metadata on upload).
- Reports and exports you create.
- Spreadsheets you give the AI Importer: their cells are read to fill in a new project and are not kept afterwards. We keep only the file’s name, when it was read and how much it used.
External shares
When a member shares a feasibility with someone outside their organisation, we collect the recipient’s name and email address from the member. We then email the recipient a link and, when they open it, a 6-digit code. We record when the share was last opened.
When you use the website and app
- IP addresses, used for request limits, abuse limits on sign-ups and sign-in lockouts.
- Server logs: the route requested, a request id, the time and, once you are signed in, your user id. Passwords, codes, tokens and cookies are removed from logs.
- Error reports (see Sentry in section 9), which we scrub of personal information before they are sent.
- Website analytics (see section 15, Cookies).
When you contact us
Your name, email address and anything you tell us.
4. How we collect it, and unsolicited information (APP 3 and APP 4)
We collect personal information:
- from you, when you sign up, sign in, fill in your profile, use the app or contact us;
- from your organisation, when an owner or admin invites you, or an owner changes your email address;
- from a member of an organisation, when they share a feasibility with you as an external recipient;
- from Stripe, about payments and subscriptions; and
- automatically, from your browser and device when you use the website or app.
If we receive personal information we did not ask for (for example in an uploaded document or an email to us), we keep it only if it relates to our service or your account, and otherwise destroy or de-identify it where it is lawful and reasonable to do so. Content an organisation uploads is held as part of that organisation’s account.
5. Notice of collection (APP 5)
This policy is our notice of collection. The sign-up page, the invitation page and the trial link page link to it, and ask you to agree to the Terms of Service and this policy before an account is made. If you do not give us the information we need, we cannot create your account or provide the service.
6. How we use personal information (APP 6)
We use personal information to:
- create and run your account and your organisation’s workspace;
- sign you in securely, including two-factor authentication, trusted devices, lockouts and password resets;
- send emails the service needs: sign-up codes, welcome emails with a temporary password, invitations, security notices (a new device, a lockout, a recovery code used, a password change), share links and codes, trial reminders, billing and payment notices, and notifications you have turned on;
- take payments, manage subscriptions, seats and trials, and apply the plan your organisation is on;
- run calculations, produce reports and exports, scan uploaded files for malware and make previews;
- keep master copies of saved feasibility versions (section 8);
- prevent abuse, fraud and unauthorised access, and keep the service secure;
- find and fix errors and keep the service available;
- improve the product, including testing changes to the calculation engine;
- answer your questions and give support; and
- meet our legal obligations.
We use and disclose personal information only for the purpose we collected it for, a related purpose you would reasonably expect, or as the law allows or requires.
We do not sell personal information.
7. Who we disclose it to (APP 6)
- People in your organisation. Members see each other’s names and roles, and the change history shows who made each change. Owners see members’ two-factor status.
- External share recipients. A share contains a frozen copy of the shared feasibility, including the names it shows and the organisation’s trading name. A share made from a joint-venture partner’s perspective never shows another partner’s name or terms.
- Our service providers (section 9), who process information for us under their terms with us.
- Professional advisers such as our lawyers and accountants, where needed.
- Authorities, where the law requires it or allows it (for example to a court, regulator or law enforcement agency).
Supporting Documents are never included in external shares or in exports.
7A. Direct marketing (APP 7)
We send emails needed to run your account and the service. We do not currently send marketing emails. You can turn off optional notifications in Settings › Notifications in the app.
8. Service providers and overseas disclosure (APP 8)
The app and its data are hosted in Sydney, Australia. Some of our service providers are based overseas or may store or process data outside Australia.
| Provider | What it does for us | Personal information involved | Where |
|---|---|---|---|
| DigitalOcean (App Platform, Managed PostgreSQL, Spaces) | Runs the app, its database, file storage (Supporting Documents, exports, photos, logos) and encrypted nightly backups | All information held in the app | Sydney, Australia (region syd/syd1). DigitalOcean is a United States company and may access or process data from outside Australia for support and operations. |
| Cloudflare | DNS for our domains; the network in front of the app (DigitalOcean’s App Platform runs behind Cloudflare); Cloudflare Turnstile, a check that a person (not a bot) is filling in the website’s sign-up and contact forms | IP addresses, request details, browser and device signals (Turnstile) | Global network; may store or process data outside Australia (e.g. the United States) |
| Stripe | Payments, subscriptions, invoices, the Customer Portal | Billing name, email, address, ABN, purchase order number, payment details, payment history | May store or process data outside Australia (e.g. the United States) |
| Resend | Sends the app’s emails | Names, email addresses, organisation names, and the content of emails (codes, temporary passwords, links, notices) | May store or process data outside Australia (e.g. the United States) |
| Sentry | Error reporting for the app | Error messages, scrubbed of email addresses, ids and tokens. No request details, cookies, user identity or IP address are sent. | May store or process data outside Australia (e.g. the United States) |
| Better Stack | Checks that the app is up and alerts us | None of yours: it calls only the app’s health check. (It holds our own on-call contact details.) | May store or process data outside Australia (e.g. the United States) |
| Google Analytics | Website analytics (feasocloud.com.au only, not the app) | Pages viewed, device and browser details, IP address; cookie identifiers if you accept analytics cookies | May store or process data outside Australia (e.g. the United States) |
| Have I Been Pwned | Breached-password check when you choose a password | None: only the first 5 characters of a one-way hash of the password | |
| Website host | Hosts feasocloud.com.au | IP addresses and request logs | Cloudflare’s global network; may store or process data outside Australia (e.g. the United States) |
| Email inbox provider | Our hello@feasocloud.com.au mailbox | Whatever you send us | |
| Anthropic (the Claude API) | The AI Importer: reads a spreadsheet you choose and fills in a new project from it | The spreadsheet’s contents, which may include names and other details you entered in it. Not your account details. | United States |
ASX is a data source only: the app reads the 3-month BBSW rate from ASX’s website. We send ASX no personal information.
So, personal information may be disclosed to recipients in the United States and other countries where these providers operate. We take reasonable steps so that these providers handle personal information consistently with the APPs, mainly through their contractual terms and data protection commitments.
10. Government identifiers (APP 9)
We do not use government identifiers (such as tax file numbers) to identify people. An organisation’s ABN is held as business information.
11. Quality of personal information (APP 10)
We take reasonable steps to keep personal information accurate, up to date and complete. You can update your name, job title, phone and photo in Settings › Profile. Your email address is changed by an owner of your organisation (a link is sent to the new address to confirm it). Owners update the organisation’s details, and billing details are updated in Stripe’s Customer Portal.
12. Security of personal information (APP 11)
We protect personal information with measures including:
- hosting in Sydney, with traffic encrypted in transit (TLS) and the database connection verified against its certificate;
- two-factor authentication for every account, lockouts after repeated failed attempts, and emails to you about security events;
- passwords stored only as scrypt hashes; authenticator secrets encrypted; recovery codes, link tokens and sign-up codes stored only as hashes;
- each organisation’s data separated in the database by row-level security, with separate database logins for sign-in, sharing, exports and master copies;
- uploaded files scanned for malware before anyone can open them, and previews rendered safely;
- short-lived signed links for downloads;
- encrypted nightly backups (AES-256-GCM); and
- error reports and logs stripped of passwords, codes, tokens and other personal details.
No system is completely secure. If we have a data breach likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.
How long we keep personal information
We keep personal information only as long as we need it for the purposes in this policy or the law requires. Then we delete or de-identify it.
| Information | How long |
|---|---|
| A website sign-up not finished (code not checked, or not paid) | Deleted 24 hours after it was started or checked |
| A completed website sign-up record | Deleted after 30 days (the account itself stays) |
| Trial links | Work for 30 days, once |
| Sign-in sessions | 30 days with “Keep me signed in”, otherwise 12 hours; deleted after they expire |
| Sign-in code challenges | 10 minutes |
| Password reset links | Work for 60 minutes; deleted after a week |
| Temporary passwords | Work for 72 hours |
| Invitations | Work for 7 days |
| Trusted device records | Trusted for 30 days from the last code; the record (browser name, IP address) is kept so the device stays known |
| External shares | Work until they expire (30 days by default, at most 365) or are revoked |
| Supporting Documents | Until deleted; a deleted document can be restored for 30 days, then it and its files are permanently removed. Uploads never saved are removed after a day. |
| Nightly backups | Kept 35 days (the newest 7 are always kept); the database host’s own backups cover 7 days |
| A deleted person’s account | The name and initials stay in the organisation’s change history; the email is replaced and everything else is cleared |
| Billing records | As long as needed for tax and accounting law; Stripe keeps its own records under its terms |
| A closed account: an organisation whose paid plan ended at least 90 days ago (it is back on Free) and that nobody has signed in to for 90 days | Flagged for deletion, then deleted by Feaso. Master copies of saved versions are kept, without people’s names |
Changing to a lower plan, a cancelled subscription, a failed payment or the end of a trial never deletes anything: work beyond the new plan’s limits stays, read only.
13. Access to and correction of personal information (APP 12 and APP 13)
You can ask for access to the personal information we hold about you, or ask us to correct it, by emailing hello@feasocloud.com.au. We will check your identity first (for example by replying to your account’s email address), and respond within 30 days. We do not charge for a request. If we refuse, we will tell you why in writing and how to complain.
Much of the information is also in the app: your profile, trusted devices and sessions are in Settings, and an organisation’s content can be exported as its plan allows.
If your information is part of an organisation’s content (for example you are named in a feasibility or a document), we may refer your request to that organisation, since it controls that content.
You cannot delete your own account in the app. An owner of your organisation can delete it, or you can ask us.
14. Complaints
If you think we have mishandled your personal information, please email hello@feasocloud.com.au with the details. We will aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):
- Website: www.oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
15. Cookies
Cookies are small files a site stores in your browser.
Essential cookies in the app (feaso.cloud)
The app uses cookies it needs to work. They are httpOnly (scripts cannot read them) and Secure (sent only over HTTPS):
- Session cookie: keeps you signed in. It ends when you close the browser, or lasts up to 30 days if you tick “Keep me signed in”.
- Sign-in challenge cookie: holds your place for 10 minutes while you enter your authenticator code.
- Trusted device cookie: lets you skip the code on that browser for 30 days, if you choose “Trust this device”.
- Share session cookie: for an external share recipient, keeps that one shared link open for 12 hours after the emailed code is entered.
The app does not use analytics or advertising cookies. The app may also keep display preferences in your browser’s local storage.
Analytics cookies on the website (feasocloud.com.au)
The website uses Google Analytics, in Google’s Consent Mode, to understand how visitors use it (for example which pages are viewed and how visitors arrive). We use this information in aggregate to improve the website.
- Before you answer the cookie notice, or if you decline: Google Analytics sets no cookies. Each page you view sends Google a cookieless measurement (the page, when it was viewed, and your browser and device details, which Google receives with your IP address). Without a cookie these are not linked across pages or visits; Google uses them to estimate visitor numbers.
- If you accept: Google Analytics also sets cookies (such as
_ga) so it can recognise your browser on later visits. - Whatever you choose, Google’s advertising features stay off: no advertising cookies, no ad personalisation, and no data shared with Google for advertising.
Your choices
- You can change your answer at any time from “Cookie settings” at the foot of every page of the website. Declining removes the Google Analytics cookies.
- You can block or delete cookies in your browser settings. If you block the app’s essential cookies, you will not be able to sign in.
- You can opt out of Google Analytics on any site by installing Google’s opt-out browser add-on (tools.google.com/dlpage/gaoptout).
16. Children
Feaso Cloud is a business service and is not meant for anyone under 18.
17. Changes to this policy
We may update this policy, for example when we add a service provider or a feature. We will publish the new version on this page with its date. If a change is significant, we will also tell account owners by email before it takes effect.