Privacy policy
Plain-language summary. StoneSteady is a one-person Australian business that tests web applications. This policy explains what personal information I collect when you visit this site, email me, or buy an audit; why; which third-party tools touch it; where it goes; how long I keep it; and what rights you have. The short version: the site sets no cookies, I collect only what an audit needs, test logins never go through a form and are deleted when your report is delivered, and I never sell or share your information for marketing.
1. Who I am and what this covers
1.1 This policy is published by Monika Andrea Almasy, an Australian sole trader, ABN 44 137 669 949, trading as StoneSteady ("I", "me"). I am the entity you contract with and the entity responsible for the handling described here.
1.2 It covers personal information collected when you visit stonesteady.com, contact me by email or a booking link, buy an audit, fill in the intake form, or receive a report from me.
1.3 As a small business with turnover under three million Australian dollars, I may be exempt from the Privacy Act 1988 (Cth). I have chosen to handle personal information as if the Privacy Act and the Australian Privacy Principles (APPs) applied to me, because I hold client logins and payment details. I am bound by the Spam Act 2003 (Cth).
1.4 If you are in the European Union or the United Kingdom, see section 9.
2. What I collect
Plain-language summary. Almost nothing from visitors. From clients, what an audit needs: your contact details, your app's address, and test logins you create for me.
2.1 Website visitors. The site uses Cloudflare Web Analytics, which is cookieless, does not fingerprint visitors, and reports only aggregate page views. Cloudflare's edge network, which serves the site, processes the IP address and user agent of each request as any web host does. I do not see individual visitors.
2.2 Enquiries. If you email me or book a call, I receive your name, email address, what you write, and, for bookings, the details you enter in the booking form.
2.3 Clients. When you buy an audit: your name, email address, and billing details as collected by Stripe (I never see card numbers); the address of your application; the user flows to test; your confirmation that you are entitled to have the app tested; anything you tell me about the app; test logins you create for the audit, sent by email or a one-time link, never through the form; and, during testing, whatever your application shows to a logged-in test user.
2.4 Incidental information. While testing, I may see personal information that your application holds about its own users. I do not collect, copy, or keep it. Session recordings on the device-testing service and the walkthrough video show what the test account sees, which is why test data matters: please give me test accounts and test data, not real customer records. Device-testing recordings are deleted under that provider's retention period; the walkthrough video is kept with the report.
2.5 I do not collect sensitive information (health, biometric, political, and similar) and do not knowingly collect information from anyone under 18.
3. Why I collect it and how I use it
3.1 To deliver the audit you bought, communicate with you about it, and issue receipts and refunds.
3.2 To answer enquiries and hold intro calls.
3.3 To keep the business records Australian law requires (tax, consumer law).
3.4 To improve the service, using aggregate, anonymized information only (for example, the average number of findings per audit).
3.5 I do not sell personal information, do not share it for others' marketing, and do not send marketing email unless you have asked for it. Any marketing message I send will carry a working unsubscribe.
4. Third-party tools and overseas disclosure
Plain-language summary. Five providers touch your data, most of them in the United States. Each is listed with what it does and what it sees.
4.1 Stripe (Stripe Payments Australia Pty Ltd for the contracting relationship; global infrastructure, United States). Payment processing. Sees your name, email, billing address, card details, and the amount. I see the name, email, and amount, never the card. PCI DSS Level 1 certified; publishes a data processing agreement.
4.2 Cloudflare, Inc. (United States, global edge). Hosting, DNS, security, cookieless analytics, and routing of email sent to hello@stonesteady.com. Sees the technical details of requests to the site and the contents of email addressed to my domain in transit. Publishes a data processing addendum and standard contractual clauses.
4.3 Google (Google LLC, United States). The intake form (Google Forms), call booking (Google Calendar), and my mailbox (Gmail). Sees what you enter in the form (never logins; the form has no password field), your booking details, and our email correspondence, including the email in which you send test logins, which I move to my password manager on receipt and then delete. Google's business terms include a data processing addendum.
4.4 BrowserStack (BrowserStack Inc., United States; data centres in the United States, Ireland, the Netherlands, Germany, India and Australia, per its published data-centre list). Real-device and cross-browser testing. During a session, sees the address of your application and the test account used, and may record the session for my review. Publishes a data processing agreement and security documentation.
4.5 AI assistants (Anthropic, PBC, United States). I may use AI coding assistants to help write test scripts and format reports. I do not enter your test logins, your customers' personal information, or your billing details into them, and I use accounts with training on inputs turned off.
4.6 Because these providers are outside Australia, personal information is disclosed overseas within the meaning of APP 8. I take reasonable steps, through the providers' published data protection terms and by sending each provider only what its job needs, to ensure it is handled consistently with the APPs.
4.7 I may also disclose personal information where the law requires it, or to professional advisers (accountant, lawyer, insurer) under confidentiality.
5. How I hold and protect it
5.1 Client information lives in my Google mailbox, in Stripe, and on an encrypted Mac with a password manager. Test logins arrive by email or a one-time link, are moved to the password manager the same day, and the email is deleted at that point. They are stored only in the password manager for the length of the audit.
5.2 Measures include full-disk encryption, unique passwords with multi-factor authentication on every account above, per-client test accounts, and no retention of logins after delivery.
5.3 No method is perfectly secure. If a data breach is likely to cause serious harm, I will notify you promptly and, where the Notifiable Data Breaches scheme applies to me, the Office of the Australian Information Commissioner.
6. How long I keep it
| Category | Kept for |
|---|---|
| Test logins | Deleted when the report is delivered. Please also disable the accounts. |
| Intake form responses | 12 months after delivery, then deleted. |
| Reports, videos, and client correspondence | At least 5 years, as required for Australian business and tax records. |
| Payment records (Stripe) | At least 5 years, as required for tax records. |
| Enquiries that do not become audits | 12 months after last contact. |
| Booking details | 12 months after the call, then deleted from my calendar. |
| Analytics | Aggregate only; no personal information is retained. |
7. Your rights
7.1 You may ask what personal information I hold about you, ask me to correct it, or ask me to delete it. Email hello@stonesteady.com. I respond within 30 days and do not charge for reasonable requests. I may need to confirm your identity first.
7.2 Deletion has limits: records the law requires me to keep (reports, payment records) are kept for the required period and deleted after.
7.3 You may deal with me anonymously or under a pseudonym for general enquiries. An audit needs a real name and email for payment and delivery.
8. Cookies
The site sets no cookies and uses no local storage. Cloudflare Web Analytics runs without cookies. Stripe's checkout page, which you visit to pay, is operated by Stripe and governed by Stripe's own privacy policy.
9. Visitors and clients outside Australia
9.1 I work with clients in the United States, the United Kingdom, Australia, and elsewhere. This policy applies to all of them.
9.2 EU and UK. Where the GDPR or UK GDPR applies: my lawful basis for processing client data is performance of a contract (Article 6(1)(b)); for enquiries, legitimate interests in responding to you (Article 6(1)(f)). Transfers to me in Australia are necessary for the performance of your contract (Article 49(1)(b)). Transfers to the providers in section 4 rest on their standard contractual clauses or on the EU-US and UK-US Data Privacy Framework where the provider is certified. You have rights of access, rectification, erasure, restriction, portability, and objection, exercisable by email, and the right to complain to your supervisory authority. I do not have an EU or UK representative under Article 27; my processing of EU and UK data is occasional and low risk. If that changes, I will appoint one and update this policy.
9.3 United States. I do not sell or share personal information as those terms are used in US state privacy laws, and I do not use it for targeted advertising.
10. Complaints
10.1 If you think I have handled your information badly or breached this policy, email hello@stonesteady.com with what happened, when, and what you would like done. I acknowledge within 7 days and respond within 30.
10.2 If you are not satisfied, you may also raise it with the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, GPO Box 5288, Sydney NSW 2001.
11. Changes
I may update this policy when tools, services, or the law change. The current version is always at stonesteady.com/privacy, with its version number and date at the top. Clients with an audit in progress are told of material changes by email.
12. Contact
Monika Andrea Almasy, trading as StoneSteady, ABN 44 137 669 949
PO Box 233, Runaway Bay QLD 4216, Australia
hello@stonesteady.com