Privacy Policy

EthicalHub Pty Ltd (ABN 87 677 816 732) runs the website at ethicalhub.co and the EthicalHub platform at app.ethicalhub.co. We’re based in Melbourne, Victoria.

EthicalHub is food safety compliance software for food manufacturers and other food businesses, and for the food safety consultants who work with them. In this policy, “we”, “us” and “our” mean EthicalHub Pty Ltd.

We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Questions? Email hello@ethicalhub.co.

This policy explains how we collect, use, store and disclose personal information when you:

• visit ethicalhub.co, fill in a form, or book a call with us
• create or use an account on the EthicalHub platform, as a business owner, team member or consultant
• are invited to EthicalHub, for example as a team member, a consultant, or a supplier asked to upload a certificate
• contact us by email, phone or through the platform
• receive emails from us, including marketing emails you’ve opted into

It doesn’t cover other websites or services we link to. Those have their own privacy policies.

Information you give us

Information collected automatically

• Usage and log data: pages and features used, actions taken, timestamps, error logs
• Device data: IP address, browser, operating system, approximate location from your IP address
• Audit trail: who created, changed or signed off each record in your account. This is part of what makes your records trustworthy at audit.
• Website analytics: how visitors use ethicalhub.co, through Google Analytics (see section 10)

Information from others

• If someone invites you to EthicalHub, they give us your name and email so we can send the invitation.
• Stripe tells us whether a payment succeeded. It doesn’t share your card details.

We use personal information for the purpose we collected it, for related purposes you’d reasonably expect, or as the law allows. Specifically, to:

• Run the platform: store your records, send reminders and alerts (such as expiring supplier certificates), generate audit packs and reports, and manage your account and subscription
• Read documents you upload: when you upload a document such as a supplier certificate, we may use an AI service to read it and fill in details such as the expiry date for you to check
• Support you: answer questions, fix problems and handle complaints
• Keep the platform secure: detect and investigate misuse, fraud and security incidents
• Improve EthicalHub: understand which features are used and where things go wrong, mostly using combined or de-identified data
• Communicate: send service emails, invoices and important changes. We send marketing emails only if you’ve opted in, and every one has an unsubscribe link.
• Meet legal obligations: such as tax record-keeping and responding to lawful requests

People in your account

Team members you invite can see and change records according to the role you give them. The account owner controls who has access and should remove people who leave.

Your consultant

If you connect a food safety consultant to your account, or accept a consultant’s invitation, that consultant can see your records for the sites they’re connected to, so they can review them and sign off actions. You can disconnect a consultant at any time. Consultants use EthicalHub under their own professional obligations to you.

Suppliers you invite

If you ask a supplier to upload a certificate through EthicalHub, they see only the upload request: your business name and what you’ve asked for. They don’t see your other records.

Share links and exports

If you export an audit pack or create a link to share a document, anyone you give it to can see what it contains. Share these carefully.

Our service providers

The companies that help us run EthicalHub, listed in section 6. They act on our instructions and must protect your information.

When the law requires it

We may disclose information if required or authorised by law, for example to a court, the Australian Taxation Office, police, or a food safety regulator such as the Department of Health, Safe Food Victoria or a local council. Where the law allows, we’ll tell you first. We don’t share your records with your auditor or regulator unless you do it yourself or the law requires it.

If our business changes hands

If EthicalHub is sold or restructured, your information may transfer to the new owner. We’ll tell you beforehand, and they must protect it to the same standard.

These are the main companies that process personal information for us. We review this list when it changes.

Our website, ethicalhub.co, is also hosted by a third-party web hosting provider. For more detail about any provider, email hello@ethicalhub.co.

Your account and food safety records are stored in Sydney, Australia, with Supabase.

Some information is processed overseas, mainly in the United States, when:

• Stripe processes a payment
• Resend delivers an email to you
• a document you upload is sent to Anthropic to be read, which means that document’s contents are processed in the United States
• Google Analytics records a visit to our website

When information goes overseas, we take reasonable steps to make sure the provider protects it in a way consistent with the Australian Privacy Principles, including through contracts.

After these periods, we delete personal information or de-identify it so it no longer identifies anyone.

• Information is encrypted in transit (HTTPS) and at rest.
• Passwords are stored as secure hashes. We can’t see your password.
• Access rules in the database limit each user to the accounts and sites they’re allowed to see.
• Our own access to production systems is limited to the people who need it.
• The database is backed up automatically.
• Security events are logged and reviewed.

Security is shared. Use a strong, unique password, give team members only the access they need, and remove people promptly when they leave. If you think your account has been accessed without permission, email hello@ethicalhub.co with “Security incident” in the subject line.

No system is completely secure, but we take reasonable steps to protect your information from misuse, loss and unauthorised access.

You can block or delete cookies in your browser settings. To stop Google Analytics measuring your visits, use Google’s opt-out browser add-on. Blocking sign-in cookies will stop you signing in to the platform.

We don’t ask for sensitive information, such as health information. But some food safety records can include it. For example, a staff illness or exclusion log under your food safety program may record that someone was unwell.

• Only record what your food safety program requires.
• We use this information only to provide EthicalHub to you, and only people in your account (and a consultant you connect) can see it.
• We don’t use it for marketing or analytics.

EthicalHub is a business tool for adults. It isn’t designed for people under 18, and we don’t knowingly collect personal information about children. If you think a child has given us personal information, contact us and we’ll delete it.

• Access: ask what personal information we hold about you, and get a copy
• Correction: ask us to fix information that’s wrong or out of date. You can update most details yourself in your account settings.
• Deletion: ask us to delete your information, subject to what the law requires us to keep
• Export: export your food safety records from the platform, for example as an audit pack
• Opt out: unsubscribe from marketing emails at any time
• Complain: to us, or to the Office of the Australian Information Commissioner (see section 16)

To make a request, email hello@ethicalhub.co with “Privacy request” in the subject line. We’ll check your identity and respond within 30 days. There’s no charge.

If you’re a team member and your information is in a business’s account, we may refer your request to that business, because it controls its account.

If a data breach happens, we’ll act quickly to contain it and assess the risk. If it’s likely to cause serious harm, we’ll notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and tell you what we’re doing and what you can do.

We’ll update this policy when the law, our platform or our providers change. For important changes, we’ll email account owners at least 14 days before the change takes effect. The effective date at the top of this page always shows the current version. Earlier versions are available on request.

Contact us first. Email hello@ethicalhub.co with “Privacy complaint” in the subject line. Tell us what happened and what you’d like us to do. We’ll acknowledge it within 2 business days and aim to resolve it within 30 days.

If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992