Privacy policy

Current · governs the whole document

Every entry below is tagged v1.0, because this is the first published release of the document. When practice changes, the entry that describes it moves to v1.1 and onwards, the effective date at the top moves with it, and the wording that was replaced is kept so the two can be read side by side.

Entries stand alone. There is no reading order and no clause that only makes sense after four earlier ones. A cross-reference points at an entry number rather than at a paragraph you have to go and count.

Publisher

SCRIPTSHIFT TECHNOLOGIES PTY LTD, ACN 698 500 542, ABN 21 698 500 542, an Australian proprietary company in Western Australia

Covers

This website, the mailbox at hello@scriptshift.cc, and the release tooling the company builds

Does not cover

Anywhere an outbound link takes you, and any account you hold with somebody else

Written to

Australian law. Entry 26 deals with readers elsewhere

Current · governs the whole document

The Privacy Act 1988 (Cth) is the instrument. The Australian Privacy Principles sit in Schedule 1 of that Act, and this document cites them by number so that any claim made in an entry can be checked against the principle it rests on rather than taken on trust.

APP 1.3 requires an APP entity to keep a clearly expressed and current policy describing how it manages personal information. Entries 1 to 28 are that policy. The commitment to handle everything described here under the APPs is a standing one, made by the company, and it is what each entry below is written against.

Two further statutes are cited where they bite. The Spam Act 2003 (Cth) governs commercial electronic messages and appears at entry 11. The Australian Consumer Law, which is Schedule 2 to the Competition and Consumer Act 2010 (Cth), governs the conduct promises in the terms of use rather than anything in this record.

Current · applies to scriptshift.cc

Serving a page writes one log line at the hosting layer. The line is produced by the provider that answers the request. No script of ours writes it, reads it back, or adds a field to it.

Log lines sit on the provider's own rotation, currently under 30 days, and then age out. They are not exported to us, not searchable by identity, and not joined to anything else in this record. Where a line could reasonably identify a person it is personal information under the Privacy Act 1988 (Cth), and this entry is the notice for it.

Current · applies to hello@scriptshift.cc

One mailbox, read by the people who write the tooling. Nothing on this site collects an address any other way, and there is no form anywhere on it.

Held

Sender address, display name, subject, message body, attachments, and the routing headers a mail system attaches on the way

Used for

Answering the message, and keeping the thread coherent if it runs on. APP 6.1(a) covers that as the primary purpose

Kept

24 months past the final reply. A thread that turns into a complaint moves to the 7 year row in entry 17

Never done

No newsletter, no mailing list, no lead scoring, no matching your address against a third party dataset

An attachment is opened where the reply needs it read, and not otherwise. Anything sent that the reply did not need goes out with the thread at the end of its retention window.

Current · applies to the release tooling

This is the entry with the most at stake in it, so it is stated flat.

The tooling runs on a machine you control: a laptop, or the build runner that already holds your deployment credentials. A release file declares the inputs its run depends on — cloud credentials, API tokens, database URLs, signing keys — and the tooling reads those inputs out of the process environment at the moment of the run.

Sent to us

Nothing. No server of ours sits anywhere on that path

Written to disk

Nothing by the tooling. A value exists in the process environment for the length of the run and goes when the process does

Printed by the plan step

Input names, and whether each one resolved. Never the value behind a name

Kept in the run record

Action name, start time, finish time, exit status. Not arguments, not values, not environment contents

The residual risk belongs in the same entry as the design. A program running with credentials in reach can put one somewhere it should not go, and no architecture removes that possibility. The declared input list exists so that the set of reachable secrets is small and visible. The plan step prints names because a name in a build log is harmless and a value is not. The run record holds timing rather than arguments for the same reason. That narrows what a defect could expose; it does not promise there is no defect.

The second route is the one people actually trip over. Pasting a log, an environment file or a whole release file into an email puts whatever it contains into our mailbox. When that happens the reply says so, names the value that was exposed so you can rotate it, and the message is deleted from the mailbox and from the sent folder once you confirm you have what you need. A copy is not kept for reference.

Current · APP 2

Reading this site identifies you to nobody. There is no account, no sign up, no login and nothing to create.

Correspondence can run under a pseudonym. A question about the working rule can be answered to a pen name at a forwarding address, and it will be. Two things break that, both for the same reason: a request under entry 19 to see what is held, and a request under entry 18 to delete it, since either one needs us to know which thread is yours before acting on it. APP 2.2(b) contemplates exactly that situation.

Current · APP 5

APP 5.1 requires notice at or before collection, or as soon as practicable afterwards. This document is that notice, and there is nowhere on this site where something is gathered out of its sight. APP 5.2 lists the matters a notice has to reach; each one is answered here with the entry that carries the detail.

Current · APP 4

Things arrive that were never sought. A curriculum vitae attached to a speculative application. A customer's staff roster inside a spreadsheet sent to illustrate a question. A screenshot with somebody's name along the top of it.

APP 4.1 requires a decision within a reasonable period about whether the material could have been collected under APP 3 in the first place, and APP 4.3 says what follows when the answer is no. The rule applied here is fixed. Where it could not have been collected under APP 3, it is destroyed, or de-identified where that is lawful and practicable. Where it could have been, it joins the rest of this record and is governed by the entry that would have applied.

Individual destructions are not announced one by one. Where the material was substantial, the person who sent it is told what became of it.

Current · APP 3.3

Sensitive information carries its own definition in section 6 of the Privacy Act 1988 (Cth): health and genetic material, racial or ethnic origin, political opinions and memberships, religious or philosophical beliefs, sexual orientation and practices, criminal record, and biometric material used for identification.

None of it is sought here. No field on this site asks for any of it, no process in the company needs it, and no entry in this record collects it. Where a category of it turns up inside a message anyway, entry 8 governs what happens next, and the answer is deletion rather than filing.

Current · APP 6

Whatever an entry above collects is used for the purpose that entry states, and for nothing beyond it. That is the primary purpose in APP 6.1 terms, and it is deliberately narrow so that the boundary is easy to inspect.

APP 6.2 lists the situations in which a further use becomes permissible. Four of them could ever arise here, and they are written out rather than gestured at:

• A related purpose you would reasonably expect. Reading an earlier thread to answer the follow-up you just sent is the whole of what this covers here.
• Where you have consented to the further use, in words, in the thread itself.
• Where an Australian law, a court order or a subpoena requires or authorises it.
• Where a permitted general situation under section 16A applies, which in practice means a serious and imminent threat to somebody's life, health or safety.

A demand from law enforcement is answered against the power it claims, on a valid instrument, and not on the strength of a telephone call. Where we are permitted to tell the person concerned that a disclosure happened, we tell them.

Current · APP 7 and the Spam Act 2003 (Cth)

There is no marketing list in this company and no campaign tooling to run one with. An address that arrives in the mailbox is used to answer that thread. Replying to a message you sent is not a commercial electronic message, so the Spam Act 2003 (Cth) consent and unsubscribe machinery does not arise on it.

If a list is ever started, the version number on this entry rises before the first message goes out rather than after. Joining would be by an explicit action taken by the person joining, every message would carry a working unsubscribe honoured inside five working days, and an address given for support would not be moved across to it.

Current · applies to entries 3 and 4

Two suppliers stand between a reader and this company, and both of them are on the path because something has to carry the traffic.

Neither is engaged to analyse anything, profile anybody or build an audience. Neither has any part of a customer deployment, because none of that reaches us at all under entry 5. Adding a third supplier to this path is a change to this entry, and the entry moves before the supplier does.

Current · APP 8 and section 16C

APP 8.1 keeps an entity accountable for what an overseas recipient does with information disclosed to it, and section 16C makes an act by that recipient an act of the discloser. That accountability cannot be handed off, and this entry does not attempt to hand it off.

What crosses a border

Request log lines held at whichever edge location answered you, and the contents of the mailbox on the mail provider's infrastructure

Where it lands

Principally the United States, plus the edge location nearest the reader at the moment of the request

On what footing

Contract terms with each supplier requiring handling consistent with the APPs, and an assessment of a supplier before it is put on the path at all

What is never sent

Anything about a customer deployment, its hosts, its variables or its release file, since none of it arrives here to be sent

Writing to hello@scriptshift.cc is itself a cross-border transmission the moment the message leaves your machine. Saying that plainly is worth more than a paragraph of reassurance about safeguards, because it tells you something you can act on before you press send.

Current · APP 9

Tax file numbers, Medicare numbers, driver licence numbers, passport numbers and the rest of the APP 9 category are not collected, are not adopted as an identifier of anybody in any record described here, and are not accepted as proof of identity under entry 19. A message that offers one gets a reply asking that it not be sent again.

The ACN and the ABN printed at the foot of every page identify the company rather than a person, and APP 9 does not reach a company identifier.

Current · APP 10

Nearly everything in this record was typed by the person it describes, in an email they chose to send. That is the most accurate source available anywhere, and it is the only source used.

Nothing is enriched from an outside dataset, appended, inferred, scored or bought. There is no profile to drift out of date, because there is no profile. Where a correction is asked for under entry 20 the record itself is edited rather than annotated with a note that contradicts it.

Current · APP 11.1

APP 11.1 asks for steps reasonable in the circumstances. The circumstances here are a company of a few people with no customer database, no logged-in surface and no credential of yours in its possession. The measures are sized to that, and they are listed rather than summarised.

• Multi-factor authentication on the mail account, the domain registrar and every supplier console, with hardware-backed keys wherever the supplier accepts them.
• Transport encryption on every request to this site, with HSTS set so that a downgrade is refused by the browser rather than negotiated.
• A content security policy served with the pages, restricting what the site is permitted to load at all.
• Separate named logins per person on every console, with the lowest role that does the job. No shared account exists to be handed around.
• Full disk encryption on every machine that opens the mailbox, with automatic locking.
• No production credential belonging to a customer is held here, which removes the largest single item a company like this would otherwise have to defend. Entry 5 explains why that is structural rather than a policy choice.

These are reviewed when the shape of the company changes — a new supplier, a new machine, a new person — rather than on a calendar date chosen for the look of it.

Current · APP 11.2

APP 11.2 requires destruction or de-identification once information is no longer needed for a purpose permitted under the APPs. Needed is a judgement, so the judgement is written down here as a schedule with a clock on each row.

Backups lag deletion, and pretending otherwise would be the easiest lie on this page. A thread deleted today can persist inside a supplier's backup set until that set expires, and the outer bound on that is 90 days. Such a copy is never restored to answer a question, and it is never searched.

Current · applies to the mailbox

To have us delete your data, write to hello@scriptshift.cc with the word Delete at the front of the subject line. Nothing else is needed and the request costs nothing to make.

What goes

The thread, its attachments, and the copies in the sent folder, inside 30 days of the request

What stays

Only what a law requires be kept: a financial record still inside the period in entry 17, or a complaint file the company remains answerable for

How you are told

The reply names anything that had to stay and the provision that required it, instead of leaving you to infer it

Reversal

None. There is nothing to restore afterwards, which is the point of asking

Current · APP 12

Ask to see what is held by writing to the mailbox. There is no form to complete and no charge for making the request or for receiving the answer.

Proving it is you

Reply from the address the thread is held against, or quote a detail already inside it. Identity documents are not asked for, and under entry 14 would not be accepted

Time allowed

30 days, the period APP 12.4(b) sets for an organisation. Checking who you are happens inside that window

What arrives

The material as it is held, which for the mailbox means the messages themselves, unless you ask for another form and that form is reasonable

If it is refused

APP 12.3 lists the grounds. A refusal names which ground it stands on, in writing, and carries the route in entry 25

Current · APP 13

Say what is wrong and what it should say instead. APP 13.1 carries the obligation to correct, APP 13.5 sets the 30 days an organisation has to respond in, and the reply confirms what was changed.

Where we disagree that something is wrong, APP 13.4 allows you to require a statement to be associated with the record noting that you consider it inaccurate. That statement goes where anybody reading the record will meet it, not in a separate file. A refusal to correct is given with reasons and with the complaint route in entry 25 attached to it.

APP 13.2 requires that a recipient of the earlier version be told of a correction if you ask for that. The only parties who could ever be in that position are the two in entry 12.

Current · applies to the site and the mailbox

Nothing here is built for or aimed at children. The tooling is a command line program for people who deploy software as part of their work, and this site is a description of that program.

Age is not collected anywhere, so it is not verified anywhere. Where a person under 15 writes in, the reply goes back the way any other reply goes back, and no record beyond the thread itself is created. A parent or guardian who believes a child's information sits in this mailbox can ask under entry 18, and it is deleted without an argument about whether the child had capacity to send it.

Current · applies to the site, the mailbox and the tooling

No decision about a person is taken by a program in this company. Correspondence is read by people and answered by people. There is no scoring, no ranking and no model in the path between your message and its reply.

The second reader gate inside the tooling is worth naming here, because a gate sounds like a judgement. It compares an approval against an exact release file and refuses the run when the two do not match. It evaluates a file. It does not evaluate the person who approved it, and it holds nothing about them beyond the name they signed with.

Current · Part IIIC, the notifiable data breach scheme

Part IIIC of the Privacy Act 1988 (Cth) creates the notifiable data breach scheme. A breach becomes notifiable where unauthorised access, unauthorised disclosure or loss is likely to result in serious harm to somebody, and remedial action has not removed that likelihood.

1. Contain, the same day. Rotate whatever can be rotated, revoke whatever can be revoked, and get the supplier involved where the exposure sits on their side of the line.
2. Assess. Section 26WH allows 30 days and expects reasonable expedition. The assessment records what was exposed, whose it was, and what harm is plausible rather than merely conceivable.
3. Remediate. Where remedial action removes the likelihood of serious harm, the scheme does not require notification, and the assessment records exactly why that conclusion was reached.
4. Notify. Otherwise a statement goes to the Commissioner under section 26WK and to each affected person under section 26WL, as soon as practicable after the conclusion is reached.
5. Keep the file. The assessment and its reasoning are retained for 7 years under entry 17, whichever way it concluded.

A notification will say what happened, when it was found, which kinds of information were caught up in it, what harm is plausible, what has been done since, and what the reader should do now — rotate a credential, or expect a message that impersonates this company.

To report a suspected problem, write with the word Security at the front of the subject line. A human answer comes the same or the next working day. A report made in good faith is answered by the people who wrote the code, never by a threat.

Current · cross-reference

Device storage lives in its own document because it changes on a different cycle from this one. The cookie notice lists every item that can be written, what puts it there, how long it survives and whether consent is required for it.

The summary for this record is short. Our own code writes nothing to your device. The hosting provider may set a challenge cookie in order to keep the site reachable. Fonts are fetched from an outside host, and the notice describes what that request discloses.

Current · two steps, in order

Step one. Write to hello@scriptshift.cc with the words Privacy complaint at the front of the subject line. Say what happened and what outcome would settle it. The answer arrives inside 30 days and names the entry above that governs the point, so that you can check the answer against the published practice rather than against a tone.

Step two. Take it to the Office of the Australian Information Commissioner. Post to GPO Box 5218, Sydney NSW 2001. Telephone 1300 363 992. The forms and the online route are at oaic.gov.au. The Commissioner can conciliate, can make a determination, and can require conduct to change. The Commissioner also generally looks for the organisation to have had its own chance at the matter first, which is what step one is for.

Nothing has to be signed before a complaint is answered here, and making one changes nothing else about how the company deals with you.

Current · applies outside the Commonwealth

This record is written to Australian law and that is the law it is built on. A site is readable everywhere, so the position elsewhere is stated rather than left as a shrug.

European Economic Area and the United Kingdom. The GDPR can reach a site read from there. The processing described in entries 3 and 4 is serving pages and answering mail, the basis for it is legitimate interests under Article 6(1)(f), and the interests weighed are running a website and replying to a person who wrote in. Access, rectification, erasure and objection are handled through entries 18, 19 and 20, because the work is identical whichever instrument is quoted.

Anywhere else. Write in and name the instrument you are relying on. It gets answered on its own terms rather than deflected with a sentence about jurisdiction.

Current · governs the whole document

The amendment procedure is itself an entry, so that it can be held to rather than assumed.

1. The version number on the amended entry rises. An edit that changes meaning always moves a number.
2. The effective date in the header at the top of the page moves to the date of the change.
3. A change that materially alters what is collected, kept or disclosed is described in a short note at the head of this page for 90 days.
4. The superseded wording is kept and is sent to anybody who asks for it.
5. A change that widens collection applies from its effective date onwards, not backwards over information already held.

There are no silent edits. A typo can be fixed without ceremony; a meaning cannot.

Current · the registrable facts

Legal name

SCRIPTSHIFT TECHNOLOGIES PTY LTD

Entity type

Australian proprietary company, Western Australia

ACN

698 500 542

ABN

21 698 500 542

Email

hello@scriptshift.cc, which reaches the people who wrote this page

Service of documents

Formal service goes to the office ASIC records against ACN 698 500 542. That record is the operative one and nothing on this site displaces it

Regulator

Office of the Australian Information Commissioner, GPO Box 5218, Sydney NSW 2001, telephone 1300 363 992, oaic.gov.au

This document

Version 1.0, effective 14 August 2026, 28 entries, all at v1.0