Privacy Policy
Our commitment. At OSXP.AU, we believe privacy is a fundamental right — not a compliance checkbox. We collect only what we need, retain it only as long as necessary, and will never sell, rent, or share your personal information with third parties for commercial purposes.
1. Who we are
OSXP.AU (ACN pending) operates Footprint, an OSINT exposure monitoring platform. In this policy "we", "us" and "our" refers to OSXP.AU. Our registered address is in Victoria, Australia.
We are subject to the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We take our obligations under Australian privacy law seriously and go beyond minimum compliance where we can.
2. What information we collect
Account and contact information
- Name, work email address, phone number, job title
- Organisation name and primary domain
- Authentication credentials (stored securely via AWS Cognito — we never store passwords in plaintext)
Platform usage information
- Scan configurations and asset lists you provide
- Finding and alert history generated by scanning your nominated assets
- Log data including access times, IP addresses, and browser type
What we do not collect
- We do not install agents or software on your systems
- We do not access, collect, or store data from inside your network
- We do not collect payment card details directly (handled by our payment processor)
- We do not use tracking pixels, behavioural advertising, or sell data to advertisers
3. How we use your information
We use personal information only for the following purposes:
- Providing and improving the Footprint platform
- Communicating with you about your account, findings, and security alerts
- Responding to support requests
- Complying with legal obligations
- Preventing fraud, abuse, or unauthorised access
We will not use your information for any purpose that you would not reasonably expect, and we will always ask for your consent before using it in a new way.
4. OSINT data and your organisation's exposure
Footprint scans publicly available information — data that is already accessible on the internet. This includes certificate transparency logs, breach databases, public code repositories, internet-wide scan data, and dark web intelligence feeds.
We only monitor assets you have explicitly nominated and confirmed authority over. Findings generated are stored securely and are only accessible to authorised users within your organisation.
5. Data storage and security
- Location: All data is stored in AWS ap-southeast-2 (Sydney, Australia). We do not transfer personal data outside Australia without your consent.
- Encryption: Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Access controls: Strict role-based access controls limit who can access your data within our systems.
- MFA: Multi-factor authentication is available for all accounts and required for administrative access.
- Retention: We retain your data for the duration of your subscription plus 90 days. You may request earlier deletion at any time.
6. Disclosure of information
We do not sell, rent, trade, or otherwise disclose your personal information to third parties except in the following limited circumstances:
- Service providers: We use AWS (cloud infrastructure), Stripe (payments), and similar sub-processors. These are bound by confidentiality obligations and data processing agreements.
- Legal requirements: If required by Australian law, court order, or a government authority with lawful authority.
- Business transfer: In the event of a merger or acquisition, your data would be transferred subject to the same privacy protections described here.
In all cases, we disclose only the minimum information necessary.
7. Your rights
Under the Australian Privacy Principles, you have the right to:
- Access: Request a copy of the personal information we hold about you
- Correction: Request that we correct inaccurate or incomplete information
- Deletion: Request that we delete your personal information (subject to legal retention obligations)
- Portability: Request your data in a machine-readable format
- Complaint: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
To exercise any of these rights, contact us at privacy@osxp.au. We will respond within 30 days.
7a. Anonymity (APP 2)
Where practicable, you may interact with our marketing website anonymously without identifying yourself. However, to use the Footprint platform, you must create an account and provide identifying information as described above. We cannot provide the service on an anonymous basis.
7b. Unsolicited information (APP 4)
If we receive personal information that we did not solicit and could not have collected under APP 3, we will either destroy or de-identify that information as soon as practicable, provided it is lawful and reasonable to do so.
7c. Direct marketing (APP 7)
We do not use your personal information for direct marketing without your consent. If you have consented to receive communications from us, you may opt out at any time by clicking the unsubscribe link in any email or contacting us at privacy@osxp.au. We will action opt-out requests within 5 business days.
7d. Government identifiers (APP 9)
We do not collect, use, or disclose government-related identifiers (such as Tax File Numbers, Medicare numbers, or driver licence numbers) as a means of identifying individuals.
7e. Quality of information (APP 10)
We take reasonable steps to ensure that personal information we collect, use, or disclose is accurate, up-to-date, complete, and relevant. If you believe any information we hold about you is incorrect, please contact us at privacy@osxp.au and we will correct it promptly.
8. Cookies and tracking
Our marketing website uses no third-party tracking cookies or analytics services. The application uses only essential session cookies required for authentication. We do not use Google Analytics, Facebook Pixel, or similar advertising trackers.
9. Children's privacy
Footprint is a business security platform intended for use by adults in a professional capacity. We do not knowingly collect information from anyone under the age of 18.
10. Changes to this policy
We may update this policy from time to time. We will notify you of material changes via email or a prominent notice on the platform at least 14 days before changes take effect. Continued use of Footprint after the effective date constitutes acceptance of the updated policy.
11. Contact us
For privacy enquiries, requests, or complaints:
- Email: privacy@osxp.au
- Post: Privacy Officer, OSXP.AU, Victoria, Australia
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.