Privacy notice

This privacy notice describes how Inline Code Pty Ltd ("we", "us", "our") handles personal information collected through this website and our engagements. We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

What we collect

When you submit a form, subscribe to our newsletter, or take our maturity self-assessment, we collect: your name, work email address, company, role, the content of your enquiry, and any answers you provide to assessment questions. When you visit this website we collect: standard server log data (IP address, browser, pages viewed), and analytics data via Google Analytics 4 and Microsoft Clarity (anonymised).

Why we collect it

We collect personal information to respond to your enquiry, deliver services you request, send newsletter content if you have subscribed, and improve our website and content. We do not sell or rent personal information to third parties.

Where it is stored

Form submissions are processed via Web3Forms and routed to our internal email. Analytics data is stored by Google (Google Analytics 4) and Microsoft (Clarity). Newsletter subscribers may be stored in a managed email platform. Purchases of the Digital Employees Runbook are paid through Stripe, which receives and processes the payment and billing details you enter at checkout; we receive a record of the purchase. Some of these providers operate outside Australia. By submitting information you consent to this transfer.

InlineScan

InlineScan is our security reporting service. Where your organisation uses it, we handle the personal information below to provide the service to that organisation. What InlineScan stores is held in Amazon Web Services' Sydney region (ap-southeast-2), scoped to one customer account at a time, and narration is written by a language model hosted in Australia. We do not use it to train models. Some parts of the service are running today and some are not yet available, and each part below says which.

Signing in and using the service (running today)

Your name and work email address, which reach us from the sign-in provider your organisation uses, your role in your organisation's account, and an audit record of the actions you take, including the network address each came from.

Results you upload (running today)

Security scan results can name people. A Microsoft 365 export, for example, identifies users by their sign-in name or display name. What you upload is cleaned to plain text, and in a Microsoft 365, Google Workspace or Oracle Cloud export, names, addresses and directory ids are replaced before anything is stored, by the same rules a connected review of that provider uses, described below. It is stored as the findings a report is built from, and read only within your organisation's account.

Observing your domain (running today, only where you have consented)

Where your organisation has proven control of a domain, had it approved, and published a DNS record consenting to observation, InlineScan observes that domain from outside it: its public DNS records, its TLS certificate and protocol versions, and the response headers of its home page. This runs when a person in your account asks, and on a daily schedule. It is information about systems rather than people, though a public DNS record can name a person, for example an address that receives email reports. What is observed is stored as a result in your organisation's account. Removing the consent record stops further observation.

Testing an AI endpoint (running today, only where you ask)

When your organisation asks InlineScan to test an AI endpoint, the endpoint's replies are stored with the run, and a reply can contain personal information the endpoint can reach. An approver in your account can delete a run's replies. Any credential you supply for the endpoint is held only for the length of the run and is never stored.

Breached email monitoring (built, not yet switched on)

When this is switched on, an approver can ask Have I Been Pwned, a breach notification service operated by a third party, which addresses at a domain appear in the breaches it has loaded. The domain must be one your organisation has proven control of and had approved, whose proof is current, and which Have I Been Pwned has verified through its own DNS record. We send Have I Been Pwned the domain name, never an email address. The addresses it returns are shown once, to the approver who ran the search, and are never stored, logged or kept in any other form. What we keep is the number of addresses in each breach, and each breach's date and the kinds of data it exposed. Have I Been Pwned handles the domain name under its own terms and privacy policy.

Results InlineScan collects from a provider you connect (running today in pilot for Amazon Web Services and Microsoft 365; Google Workspace, Oracle Cloud and Google Cloud not yet available)

Where your organisation connects an Amazon Web Services account or a Microsoft 365 tenant, InlineScan reviews its configuration once a day with Prowler, an open-source security tool, through read-only access your own administrator grants in the provider's console. Your administrator can revoke that access at the provider at any time, without contacting us: the next review is then refused, and a review already under way can go on reading until it stops at its own time limit. Both connections are in pilot. Google Workspace, Oracle Cloud and Google Cloud connections are built and not yet available. Each review runs in InlineScan's own Amazon Web Services account in the Sydney region (ap-southeast-2). What it returns is stored there as the configuration findings a report is built from, within your organisation's account, read only within that account, and labelled as collected by InlineScan from a connected account.

Some of what a review reads is personal information: users' sign-in names and display names, whether each user has multi-factor authentication, the names and operating system versions of managed devices, and, for Amazon Web Services, the names of IAM users and the account's contact details. We treat directory and device reads as personal information under the Privacy Act. Findings are minimised before anything is stored. For Microsoft 365, every email address in a finding is replaced with "(a user)" and every directory object id in its text with "(an object id)"; in the findings of the checks that report on a named person, the person's display name is replaced with "(a user)" in the finding's name and wherever it appears in the finding's text (a display name shorter than three characters is removed from the name but can remain in the text, because replacing so short a string would also change other words), and their object id with a pseudonym, a one-way digest that stays the same from one review to the next; and for the checks whose text lists people, that text is not kept. For Amazon Web Services, a finding names the resource it is about as Prowler reports it, which can be an IAM user's name, and the account's contact details, which Prowler reads to compare them, are not carried into what is stored. Everything else in a finding is stored as Prowler reports it.

For Google Workspace, once it is offered, InlineScan will keep no user's name or email address from a review: an address in a finding will be replaced before anything is stored. Where you grant it read access to Google's endpoint management, it will keep only counts of devices by type, ownership and state, and no device's name, serial number, hardware identifier or user. It will keep the email address of the one administrator account you name for the connection, because it signs in as that account. We will update this notice before Google Workspace connections are offered.

For Oracle Cloud, once it is offered, findings will be minimised the same way before anything is stored: every email address in a finding will be replaced with "(a user)" and every user id in its text with "(an object id)"; in the findings of the checks that report on a named user, the user's name will be replaced with "(a user)" in the finding's name and in its text (a name shorter than three characters is removed from the name but can remain in the text), and their user id with a pseudonym. It will keep the tenancy, its home region and the user you create for InlineScan alone, which names no person, because it signs in as that user. We will update this notice before Oracle Cloud connections are offered.

For Google Cloud, once it is offered, findings will be minimised before anything is stored: every email address in a finding that is not a Google service account's, which is how a project's IAM findings name the people and groups holding a role, will be replaced with "(a user)". A service account names a workload, not a person, and is kept. It will keep the project id and the service account you create for InlineScan alone, which names no person, because InlineScan acts as that account. We will update this notice before Google Cloud connections are offered.

Cookies and tracking

We use first-party cookies for analytics and to improve site performance. We use the LinkedIn Insight Tag and the Meta Pixel to support retargeting where you have visited our site. You can disable third-party cookies in your browser. Where you use the LinkedIn or Meta opt-out controls, those preferences will be respected.

Your rights

You may request access to, correction of, or deletion of personal information we hold about you. Email mathew@inlinecode.com.au with your request. We will respond within thirty days.

Complaints

If you believe we have breached the Australian Privacy Principles, please raise it with us first via the email above. If unresolved, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Changes

We may update this notice. The "last updated" date at the top reflects the most recent revision.

This notice is a template and may need to be tailored to your specific data handling practices before publication. Inline Code is not a law firm, and this is not legal advice.