Legal
Privacy Policy
SlashTech Australia Pty Ltd · Last updated 30 October 2026
01Who this is about
This policy explains how SlashTech Australia Pty Ltd handles personal information in SlashFlow — the workspace a firm signs into, the portal that firm’s clients are invited to, and the emails the service sends.
It should be read with our terms of service. Where a firm has signed a separate data processing agreement with us, that agreement governs.
02Controller or processor: which one we are
This is the most important thing on the page, because it decides who can answer a question about your data.
| The data | Who decides | Our role | Who you ask |
|---|---|---|---|
| Service account, subscription contacts, logins and platform security records | The firm, with SlashTech Australia Pty Ltd | We are the controller | Us |
| Workspace records about staff and clients: contacts, projects, pay, leave, documents, time and invoices | The firm, alone | We are a processor acting on the firm's instructions | That firm |
| A client portal user's login and activity in the portal | The firm that invited them | We are a processor | That firm |
03What we collect, and why
From a firm and its staff
| Category | Examples | Why |
|---|---|---|
| Identity and contact | Name, work email, position, phone | To create an account, authenticate a person, and address them correctly |
| Authentication | Password hash, session records, sign-in link tokens | To sign a person in and keep the session secure. Passwords are hashed and never stored or readable in plain text. |
| Work records | Clients, projects, engagements, time entries, documents, invoices | Because this is the product. The firm decides what goes in. |
| Audit and security | Who did what and when, IP addresses on security-relevant actions, rate-limit counters | To investigate an incident, to meet a firm's own audit needs, and to stop abuse |
| Operational diagnostics | Error reports when something breaks | To find and fix defects. See Sentry in section 06. |
From a client portal user
Your name and email, given to us by the firm that invited you; the credentials you set; and a record of what you did in the portal — documents you opened, approved or signed, and messages you sent where the firm has that feature.
From the marketing site
If you join the early-access waitlist, we keep your name, email, company, team size and anything you chose to write in the free-text field. We use it to run the waitlist and for nothing else. It is not added to any other mailing list and is not passed to anyone. Ask us to remove it at any time at privacy@slashflow.com.au.
04What we do not do
- We do not sell personal information, and never have.
- We do not use your data to advertise to you or to anyone else.
- We do not use one firm’s data to serve another firm.
- We do not run per-user behavioural analytics in the product. There is no third-party analytics tag on the signed-in application.
- We do not read a firm’s documents except where support requires it and they ask.
05Keeping it separate, and keeping it safe
Each firm’s data is separated at the record level, and every query the application makes is scoped to the firm the signed-in person belongs to. Reaching another firm’s data is not a matter of guessing an address.
Alongside that:
- Everything is encrypted in transit (TLS), and at rest by the storage providers below
- Passwords are hashed with bcrypt; we cannot read them
- Uploaded files are held in private storage and served only through an endpoint that checks who is asking first
- Access inside our team is limited to the people who need it to operate the service
- Security-relevant actions are recorded in an audit log
No service can promise it will never be breached, and we do not. If a breach affects your data we will tell the affected firm, and where the law requires it the relevant regulator, without undue delay.
06Who else touches it
The application supports the providers below. Active providers, regions and optional integrations depend on the deployment and the firm's configuration.
| Provider | What for | What it holds |
|---|---|---|
| Amazon Web Services | Configured hosting, file storage, logs, encryption and backups | Application records and files handled by the configured AWS services |
| Neon | The database | All application records |
| Upstash | Rate limiting and short-lived caching | Counters, scoped business results, team/capacity information, authorisation facts and workspace settings |
| Resend | Sending email | Recipient address, message content and any permitted attachments |
| Sentry | Error reporting | Diagnostics when something breaks, which can include the signed-in user's identifier |
| Vercel / Vercel Blob, where configured | Alternative hosting and file storage | Application requests and files handled by that deployment |
Ask us for the provider and location information applicable to your deployment. Optional accounting integrations and webhooks also send the configured business payload to their recipients when a firm enables them. Those recipients and permissions need their own review.
Beyond those, we disclose personal information only where the law requires it, or to a successor if the business is sold — in which case this policy continues to apply until you are told otherwise.
07Where it is held
AWS infrastructure configuration targets Sydney, but this alone does not establish that every copy is held only in Australia. Database, cache, email, diagnostics, alternate hosting, support access and integrations may involve other locations. Confirm the locations and arrangements for your deployment with us before relying on an Australian-only requirement.
08How long we keep it
A firm’s data is kept while its account is active, because that is the product: a record of work that is still being referred to.
Cancellation and deletion are separate actions. A firm should arrange available exports before losing access and submit deletion requests through its authorised owner. Closing an account does not by itself prove that all records and copies have been erased. Legal holds and applicable record-keeping duties must be considered before deletion.
Recovery copies, file versions, audit/security records and provider-held copies can have different retention and disposal processes. Locked backups cannot necessarily be erased immediately; their configured retention and any restored-data restrictions must be accounted for. We have not set fixed retention periods for every category of data, and we would rather say so than publish a number we do not hold ourselves to. If your firm needs specific periods committed to in writing, raise it with us and it can go in your agreement.
09Your rights, and how to use them
Subject to the roles in section 02, you can ask to see the personal information we hold about you, have it corrected, have it deleted, or object to how it is used.
If you are a firm’s staff member, ask your firm’s administrator first — most of it they can do themselves. Otherwise write to privacy@slashflow.com.au.
If a firm invited you into a portal, ask that firm. We will pass a request on if you cannot reach them and assess the request against the firm's authority and applicable obligations. We verify identity and scope before providing information.
We will respond within a reasonable time. If you are not satisfied with how we have handled a privacy matter, tell us first so we can put it right — and you can escalate to the privacy regulator in your jurisdiction.
10Cookies
The application sets only what it needs to work: a session cookie so you stay signed in, and short-lived cookies for security checks. There are no advertising cookies and no third-party tracking cookies.
Blocking the session cookie will stop you signing in, because it is the mechanism by which you stay signed in.
11Changes, and contact
We may update this policy. Where a change materially affects how we handle personal information, we will tell affected firms before it takes effect. The date at the top is when it last changed.
Privacy questions and requests: privacy@slashflow.com.au.