Privacy & Data Protection

Last updated: 3 November 2026

1. About This Policy

This policy explains how CastleSoft Pty Ltd (ABN 83 069 597 860) (“CastleSoft”, “we”, “us”) collects, uses, discloses and protects personal information. CastleSoft Pty Ltd is responsible for your personal information and is its “controller” under the GDPR and UK GDPR.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and with the other privacy laws that apply to the people we serve, including:

Australia: the Privacy Act 1988 (Cth), the APPs (including the automated decision transparency requirements in APPs 1.7 to 1.9, from 10 December 2026), the Notifiable Data Breaches scheme, and the Spam Act 2003 (Cth) for electronic messages.
Singapore: the Personal Data Protection Act 2012 (PDPA), including its Do Not Call provisions.
European Union: the General Data Protection Regulation (GDPR) and the ePrivacy Directive.
United Kingdom: the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
United States: the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other applicable state privacy and data breach notification laws.
Other regions: laws such as Canada’s PIPEDA and Japan’s APPI, where they apply.

These laws differ, and we apply each one on its own terms. Our Data Protection Officer can be contacted at privacy@castlesoft.com.au or by post at CastleSoft Pty Ltd (ABN 83 069 597 860), Newcastle NSW 2300, Australia.

2. Personal Information We Collect

We collect only the personal information we need, including:

Contact and business details, such as your name, email address, phone number, organisation and role, when you contact us or work with us.
CastleSoft ID account information, such as your name, email address, sign-in and two-step verification settings, and usage preferences.
Information provided for our services, including content that you or your organisation give us to process through our software or AI agents.
Website usage information collected through Google Analytics (see section 11).

We collect information directly from you, from your organisation when we provide services to it, and from service providers such as Google Analytics. We do not ask for sensitive information (such as health, racial or ethnic origin, or biometric information) unless it is needed for a service and you have consented, or the law permits it. When we process personal information on behalf of a client, for example in a CastleSoft Health project, we act on that client’s instructions under our agreement with them.

Where it is lawful and practicable, you can deal with us anonymously or using a pseudonym, for example when making a general enquiry.

3. How We Use It and Our Legal Bases

We use personal information to:

Provide, support and improve our software and services, including personalising features. For the GDPR, this relies on the performance of our contract with you or your organisation, or on our legitimate interests.
Respond to enquiries and manage client relationships, relying on our legitimate interests or steps taken at your request before entering a contract.
Keep our systems secure, prevent misuse and maintain audit records, relying on our legitimate interests and our legal obligations.
Meet our legal, tax and regulatory obligations, relying on legal obligation.
Measure website use, relying on your consent in the European Economic Area, the United Kingdom and Switzerland, and on our legitimate interests elsewhere.

Where we rely on consent, you can withdraw it at any time, including through your CastleSoft ID settings or our cookie settings. Where we rely on legitimate interests, we balance them against your rights and you can object. Your data is never sold or shared for advertising, and we do not build advertising profiles.

4. AI Agents and Automated Decisions

We use AI agents and AI models to support our work, including drafting, analysis, customer support triage and software development. They may process personal information contained in the material they work with, under the same security, access and logging controls as the rest of our systems. Depending on the work and the client’s requirements, these models run locally on our own hardware in Australia, or are provided by the external AI providers listed in section 5, in some cases receiving only de-identified information (see section 6).

Human oversight is used for critical decisions. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. Decisions with significant legal, financial, employment, security or patient-care implications are reviewed and approved by an appropriately qualified or authorised person before action is taken. If this ever changes, we will update this policy and tell you how to request human review.

How computer programs support decisions: some of our computer programs, including AI agents, may use personal information to do things that are substantially and directly related to making decisions that could significantly affect your rights or interests. A person still makes these decisions, but a program’s output can be a key factor, so we describe them here:

Recruitment: summarising job applications against our published selection criteria, which can inform who progresses. This can use application details, work history and contact details.
Complaints, refunds and privacy requests: sorting and routing requests to the right person, which can affect how and when they are handled. This can use contact details, the content of your request and purchase details.
Security: flagging unusual activity in system logs for investigation, which can lead to a decision to restrict access to a system or account. This can use log records, IP addresses and account details.
Billing: preparing invoices and payment records that can inform decisions about an account. This can use billing and payment details.
Client projects: software we build or operate for clients can support decisions such as healthcare claims, appointment scheduling and patient data analysis. This can use patient, claim and appointment details, including health information. The client is usually responsible for these decisions and for explaining them in its own privacy policy, and decisions with patient-care implications are approved by an appropriately qualified person.

You can ask for more information about any of these uses, ask a person to review a decision, or challenge a decision, by contacting privacy@castlesoft.com.au. We will respond within 30 days.

5. Who We Disclose It To

We disclose personal information only as needed to the following kinds of recipients:

Cloud hosting and infrastructure providers: Microsoft Azure, Amazon Web Services and Google Cloud.
AI platform and model providers: Microsoft Foundry, Anthropic, OpenAI and Google, including through OpenRouter, which routes requests to model providers. We use Google’s models through OpenRouter to create images and video from public and brand content, and do not use this route for customer, client or website visitor personal information.
Email and productivity services: Microsoft 365.
Website analytics: Google Analytics.
Professional advisers, such as lawyers, accountants and auditors.
Regulators, courts and law enforcement, where the law requires or permits it.

Our service providers may use personal information only to provide services to us, under contracts that require them to protect it.

6. Overseas Disclosure and International Transfers

Some of these recipients are located, or store information, outside the country where it was collected. The countries where your personal information is likely to be disclosed or stored include Australia, Singapore and the United States, and, depending on the hosting region of a service, member states of the European Union and the United Kingdom.

Australian-only processing: on request, we process personal information in Australia:

Local AI models: the work is done by AI models running locally on CastleSoft-controlled Apple silicon hardware in Australia, so the information is not sent to external AI providers or disclosed overseas for that processing.
De-identification before external AI: where the work needs more powerful commercial AI models, identifying details are first removed or replaced in Australia, so only information that does not identify individuals leaves Australia. Any means of re-identifying the information stays in Australia.

Under the GDPR and UK GDPR, information that has been de-identified in a way that can be reversed (pseudonymised) can still count as personal data, so the safeguards below continue to apply to it.

Before we disclose personal information to an overseas recipient, we take reasonable steps, as required by Australian Privacy Principle 8, to ensure the recipient handles it consistently with the APPs, principally through binding contractual terms.

When personal information is transferred out of the European Economic Area, the United Kingdom or Switzerland, we rely on an adequacy decision where one applies. Otherwise we use the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or the Swiss equivalent, with additional safeguards where needed. When transferring personal data out of Singapore, we ensure the recipient is bound to a standard of protection comparable to the PDPA. You can ask our Data Protection Officer for more information about these safeguards.

7. How Long We Keep It

CastleSoft ID accounts: up to 12 months after account inactivity, unless the law requires longer.
Client project information: for the term of our agreement and any period it specifies.
AI logs: AI prompts and outputs for up to 90 days, and records of AI workflow actions, which do not include prompt or output content, for up to 12 months. We keep them longer only where a client agreement or the law requires it, or for an active security incident or legal matter. External AI providers may also keep requests for limited periods under their own terms.
Business and financial records: for as long as Australian law requires, generally five to seven years.
Website analytics: up to 14 months in Google Analytics; analytics cookies expire after 13 months.

When information is no longer needed, we securely delete or de-identify it.

8. Information Security (Aligned with ISO 27001)

Our information security practices are aligned with the ISO 27001 standard. While we are not ISO 27001 certified, we follow its controls and practices to secure your data across desktop, mobile, web, cloud, wearables, and IoT. All data is protected with AES-256 encryption and TLS 1.2 or higher, with TLS 1.3 preferred, and CastleSoft ID accounts require two-step verification. Strict access controls prevent unauthorised access, including backdoors. Weekly automated security audits, performed by our AI agents, help ensure ongoing compliance and resilience.

Software bills of materials: we are introducing signed software bills of materials (SBOMs) for new CastleSoft software releases. An SBOM records the components a release contains, so we can check them for known vulnerabilities and licence issues. This is part of our preparation for the EU Cyber Resilience Act. Customers can ask for the SBOM for a release, once one is available, under a non-disclosure agreement. To report a security concern, see our security contact details.

9. Your Rights

Wherever you are, you can ask to access the personal information we hold about you and ask us to correct it, and ask about or challenge a decision described in section 4. Depending on where you live, you may also have the right to:

EU, UK and Swiss residents: have your data erased, restrict or object to its processing (including for direct marketing), receive it in a portable format, withdraw consent, and not be subject to decisions based solely on automated processing.
Singapore residents: access and correct your personal data and withdraw consent.
California and other US state residents: know what we collect, and request deletion or correction. We do not sell or share personal information for targeted advertising, we honour Global Privacy Control signals, and we will not discriminate against you for exercising your rights.

To make a request, contact privacy@castlesoft.com.au. We will verify your identity, respond within 30 days, and in most cases act on your request free of charge. If we cannot agree to a request, we will explain why and how you can complain.

10. Data Breaches

In the unlikely event of a data breach, we act promptly to contain it and reduce any harm, and we notify regulators and affected individuals within the timeframes each applicable law requires, including:

Australia: under the Notifiable Data Breaches scheme, we assess a suspected breach within 30 days and, if it is likely to result in serious harm, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable.
Singapore: under the Personal Data Protection Act 2012 (PDPA), we assess a suspected breach within 30 days and notify the Personal Data Protection Commission (PDPC) within 3 calendar days of determining it is notifiable, and affected individuals where it is likely to result in significant harm.
European Union: under the GDPR, we notify the relevant supervisory authority within 72 hours of becoming aware of a breach, and affected individuals without undue delay where there is a high risk to them.
United Kingdom: under the UK GDPR and the Data Protection Act 2018, we notify the Information Commissioner’s Office (ICO) within 72 hours, and affected individuals without undue delay where there is a high risk to them.
United States: we notify affected individuals and regulators as required by applicable state data breach notification laws, including California’s.

11. This Website and Cookies

This website uses Google Analytics 4 to understand how visitors use our site, such as which pages are viewed and the approximate region of visitors. Advertising and personalisation features are disabled, and we do not use this data to identify you. This website has no forms and does not collect any other personal information.

Google Analytics uses the cookies _ga and _ga_1CFM2LD04S, which we set to expire after 13 months. For visitors in the European Economic Area, the United Kingdom and Switzerland, these cookies are only set if you choose “Accept analytics”; until then, Google Analytics receives only anonymous, cookieless measurements. If your browser sends a Global Privacy Control signal, we treat it as a rejection. We store your choice in your browser for 12 months.

You can change or withdraw your choice at any time using “Cookie settings” at the bottom of every page. Rejecting deletes the Google Analytics cookies from your browser.

12. Complaints

Please contact our Data Protection Officer at privacy@castlesoft.com.au with any privacy question or complaint. We will respond within 30 days. If you are not satisfied with our response, you can contact the privacy regulator in your jurisdiction, such as the Office of the Australian Information Commissioner (oaic.gov.au), Singapore’s Personal Data Protection Commission, the UK Information Commissioner’s Office or your local EU data protection authority.

13. Changes to This Policy

We review this policy regularly, and the date at the top shows when it was last updated. If we plan a significant change that reduces your rights or expands how we use your personal information, we will tell you at least 30 days in advance via email, where we have your address, and on castlesoft.com.au. We may apply other changes sooner, including changes needed to meet a legal requirement, address a security risk or give you more information about our practices. We will tell you about significant changes of this kind when they take effect.

14. Accessibility and Equality

We design our websites and products to meet the WCAG 2.1 AA accessibility standard. If anything on this site is difficult to use, please contact us. Read our commitment to equality.

15. Terms of Use and Licensing

Our software is licensed under our Terms of Use, ensuring compliance with intellectual property laws. A 1-year limited warranty guarantees functionality as described (see our Terms of Use). CastleSoft® (Trademark No. 870506) and all software remain our property, with users granted non-exclusive licences. Disputes are resolved per our Terms.

Andrew Tierney
CEO – CastleSoft Pty Ltd