EBBE (ABN 85 078 685 199) ("EBBE", "we", "us") operates the EBBE Signal platform ("Signal", the "Platform"). This Privacy Policy explains how we collect, use, store, disclose and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1. Who we are
EBBE is the Data Controller for personal information collected through Signal. Our registered office is 2/330 The Entrance Rd, Erina NSW 2250. You can contact our Privacy Officer at privacy@ebbe.com.au.
2. What personal information we collect
We collect only what we need to provide and improve Signal:
- Identity & contact: name, work email address, organisation name.
- Authentication: hashed password (bcrypt), Google account identifier if you sign in with Google.
- Usage data: opportunities, action items, goals, scoring inputs, narrative notes and other content you enter into Signal.
- Technical: IP address, browser type, timestamps, audit log of significant actions (logins, exports, record changes).
- Optional: organisation logo and other branding assets you upload.
We do not collect: government identifiers, banking details, health information, or marketing-tracking cookies (we use essential cookies only).
3. How we use it (APP 6 – Use & disclosure)
- To create and maintain your account and organisation workspace.
- To provide Platform functionality (scoring, dashboards, exports, calendar, etc.).
- To send essential service emails (security alerts, account changes).
- To detect and respond to security incidents and fraud.
- To meet our legal obligations.
We do not sell, rent or trade personal information.
4. Cookies & tracking
Signal uses only essential cookies required for authenticated sessions (httpOnly, Secure, SameSite). We do not use third-party analytics, advertising trackers or behavioural cookies.
5. Data storage & residency (APP 8 – Cross-border disclosure)
Signal is currently hosted on Google Cloud Platform infrastructure in the United States (us-central). EBBE is actively working with our hosting provider to migrate the production environment to an Australian region(australia-southeast1, Sydney). Until that migration is complete, personal information may be processed and stored outside Australia. We rely on Google Cloud's contractual, technical and organisational safeguards (including encryption at rest and in transit) and we take reasonable steps to ensure overseas recipients do not breach the APPs.
For the latest hosting status, see our Security & Trust page.
6. Security (APP 11)
We protect personal information through:
- Encryption in transit (HTTPS/TLS 1.2+ for all traffic).
- Encryption at rest (managed by our cloud provider).
- bcrypt password hashing; passwords are never stored in plain text.
- Brute-force protection (account lockout after repeated failed login attempts).
- Multi-tenant data isolation by organisation.
- Role-based access controls and httpOnly session cookies.
- Two-factor authentication (TOTP), audit logs and session timeout — scheduled features, see Roadmap on the Security page.
7. Data retention
We retain personal information for as long as your account is active and for a reasonable period after closure to meet legal, accounting or reporting requirements (typically up to 7 years). When you delete your account, we destroy or de-identify personal information within 30 days unless required by law to retain it.
8. Your rights (APP 12 & 13)
- Access: you may request a copy of personal information we hold about you.
- Correction: you may ask us to correct inaccurate information.
- Deletion: you may request deletion of your account and data.
- Complaint: if you are unhappy with how we handle your information, contact our Privacy Officer first; if unresolved, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Email privacy@ebbe.com.au to exercise any of these rights. We will respond within 30 days.
9. Data breach notification
EBBE complies with the Notifiable Data Breaches (NDB) scheme. If a data breach is likely to result in serious harm, we will notify affected individuals and the OAIC as soon as practicable.
10. Children's privacy
Signal is intended for use by professionals at not-for-profit organisations. We do not knowingly collect personal information from children under 16.
11. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified via in-app banner or email at least 14 days before they take effect. The "last updated" date at the top of this page reflects the current version.
12. Contact us
EBBE — Privacy Officer
2/330 The Entrance Rd, Erina NSW 2250
Email: privacy@ebbe.com.au