ShareAndGo

Privacy Policy

1. Who We Are

ShareAndGo is a product of Fintech Development Pty Ltd (ACN 655 608 969, ABN 78 655 608 969), an Australian company. When we say "we", "us", or "our", we mean Fintech Development Pty Ltd.

2. Information We Collect

We collect information you provide directly:

  • Account information (name, email address, organisation name)
  • Documents you upload to data rooms
  • Communications with our support team

We automatically collect:

  • IP addresses and browser information for security audit logging
  • Usage data (pages visited, features used) via Google Analytics
  • Document access times and durations for audit trails

3. How We Use Your Information

  • To provide and maintain the ShareAndGo service
  • To verify your identity when accessing data rooms
  • To generate tamper-evident audit trails for compliance
  • To send transactional emails (access invitations, verification codes)
  • To process payments via Stripe (we do not store card details)
  • To improve the service through aggregated, anonymised analytics

4. Where your data is held

We store your data in Sydney, Australia. Some services run outside Australia; the New Zealand section of this policy lists them. All data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Limited operational metadata is processed by vetted subprocessors, some located overseas, solely to deliver the service: outbound email via SendGrid (e.g. recipient email address, subject and message body of an invitation), SMS notifications via Twilio (recipient phone number), and payment processing via Stripe (billing details). These providers process that metadata overseas under data processing agreements and handle delivery and billing metadata only, never your document content. We disclose this cross-border processing so our APP 8 position is precise rather than absolute.

AI features (document OCR, summaries, tagging, PII detection, Q&A and semantic search) are performed by a cloud AI service in the Sydney region (australia-southeast1); we do not use your documents to train any model. If you connect an AI assistant, what it reads is sent to that assistant's provider, which may be outside Australia. You choose to turn this on, and it is off by default.

5. Data Sharing

We do not sell your personal information. We share data only with:

  • Service providers: Google Cloud Platform, Sydney (hosting, document storage, database, and a cloud AI service for OCR, search and summaries, all in australia-southeast1), SendGrid (email delivery), Twilio (SMS delivery), Stripe (payments), all bound by data processing agreements. We also use Google (Firebase Authentication) (sign-in, United States), Microsoft (sign-in with Microsoft, if you choose it, United States or Microsoft's other locations), Google Drive (importing files, only if you connect it, Google, United States), Cloudflare (website delivery and protection, Australian site only, global network), Google Analytics 4 (website usage analytics, marketing pages, United States), ManageYourTech (website visitor analytics, Australian marketing pages, Australia) and SignAndGo (NDA signing, if a room requires an NDA, Sydney, Australia). The full list is on our Subprocessors page
  • Data room participants: When you share a data room, invited participants can view documents you have granted them access to
  • Legal requirements: When required by Australian law or valid legal process

6. Data Retention

We keep your account data and your documents for as long as you have an account with us. That is deliberately not the same as "while your account is active": if your subscription lapses, or your trial ends, or you simply stop signing in, we do not delete anything. We keep your rooms, documents, folders and audit history exactly as you left them, so that they are intact if you come back. Work you paid for, or spent hours organising, is not something we take away because a payment stopped.

We do not currently offer a setting that deletes documents automatically after a period of time. Nothing is removed unless you ask us to remove it, we are required to remove it by law, or your account is closed or terminated under our Terms of Service. In that case your data is kept for 30 days so you can export it, and then permanently deleted.

Audit logs are retained for 7 years. Because an audit log is a record that a document was viewed rather than a copy of the document, it is kept even after the document itself is deleted.

You can ask us to delete your account and everything in it at any time, by emailing privacy@shareandgo.com.au. We will confirm what has been removed. Deletion is permanent and we cannot recover a deleted workspace for you afterwards, so we will always confirm before acting.

7. If You Were Invited to Someone Else's Data Room

Most people who use ShareAndGo were invited to a data room by someone else, such as a seller, an adviser, an accountant or a lawyer. If that is you, this section is the one that matters, because the person who invited you can see a detailed record of what you did in their room.

We record, and show to the owner of that room:

  • The email address you were invited with, and the times you entered the room
  • Every document you opened, and how long each one was open for
  • Which documents you were given access to and never opened
  • An engagement score from 0 to 100, with a label such as Hot or Cold, calculated from how many documents you opened, how long for, how much of the room you covered and how recently. The room owner sees invited parties ranked by it
  • Your activity contributes to a short plain-English summary of the room’s overall engagement, written by an AI model for the room owner. That summary describes the room, not you individually
  • The network address you connected from
  • If you export a whole room, or request a copy of a document without its watermark, that request is recorded. We do not record printing, and we do not separately record opening a single document for download beyond the view itself

We tell you this before you enter a room, not afterwards: you are shown a notice describing what is recorded and you have to accept it to continue. You can also read your own record at any time from inside the room. It is the same information the owner sees about you, presented to you.

We collect this because a data room exists to give its owner an auditable record of who saw what, which is frequently a legal or transactional requirement for them. We do not use it for our own marketing, we do not sell it, and we do not use one room's activity to target you in another.

How long we keep it, and what we can and cannot do about it. You do not have an account with us, so the retention rules in section 6 do not describe your position and we should say what does. Your record belongs to the data room you were invited to, and it is kept for as long as that room is, plus the 7 years that audit logs are retained for. It is deleted when the room owner deletes the room or closes their account.

You can ask us about it at any time at privacy@shareandgo.com.au, and we will tell you what is held and correct anything that is wrong. We will not promise to erase your activity from a room’s audit trail, and you are entitled to know why: that trail is the record the room exists to produce, our customer may be required to keep it, and removing one participant’s entries would make it an unreliable record for everyone else in the transaction. If you ask us to, we will pass your request to the room owner and tell you that we have. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

8. Your Rights

You have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate information
  • Request deletion of your personal information
  • Complain to the Office of the Privacy Commissioner (privacy.org.nz)

9. Cookies

We use essential cookies for authentication and session management. We use Google Analytics (GA4) for anonymised usage analytics. We do not use advertising or tracking cookies.

10. Contact

For privacy enquiries, contact us at privacy@shareandgo.com.au

Your personal information and New Zealand's privacy law

New Zealand's Privacy Act 2020 applies to the personal information we handle for New Zealand customers. This section explains what that means for you and what you can ask of us. The rest of this policy applies to you too.

Where your personal information is held

We store your documents, records and files in Sydney, Australia, and your account details are held in Sydney too. Some services run outside Australia: sign-in (United States), payments (United States), AI assistants you choose to connect (their providers, in the United States or other countries), text messages (United States), sending email (Australia or the United States), and support access (from Australia).

We're an Australian company. We protect what we hold in Australia under our own policies and Australia's Privacy Act 1988, which protects personal information in ways comparable to New Zealand's law. Other companies that handle personal information for us outside New Zealand must protect it under their contract with us. Our New Zealand website uses Google Analytics on its public marketing pages to understand how visitors find and use the site. It records the pages viewed, the site you came from, your device and browser type and your approximate location. It never runs inside the app or on any page that carries a link or code, and it uses no advertising features. Google processes this information in the United States.

Who is responsible for what

For your own account details (your sign-in, profile, organisation, team members and billing), we are responsible for your personal information.

For what you put into ShareAndGo, such as documents and data rooms, and for the people you share it with, we hold that information on your behalf and use it only to provide ShareAndGo to you. You are responsible for having the right to add and share it. If someone asks us about information you control, we pass the request to you.

Seeing and correcting your personal information

You can ask to see the personal information we hold about you, or ask us to correct it, by writing to our privacy contact below. We'll confirm who you are first and answer within 20 working days. We don't charge for these requests. You can correct most of your account details yourself in Settings.

If something goes wrong

If a privacy breach is likely to cause serious harm, we'll tell the people affected and New Zealand's Privacy Commissioner as soon as we practicably can. If it affects information we hold on your behalf, we'll tell you without undue delay.

Questions and complaints

Write to our privacy contact with any question or complaint. We'll acknowledge it within 5 business days and answer within 20 working days. If you're not satisfied with our answer, you can complain to New Zealand's Office of the Privacy Commissioner at privacy.org.nz.

Privacy contact

Privacy officer: Andy Carey. Contact: privacy@support.myandgo.com.au.

Fintech Development Pty Ltd · Level 1, 18-20 Knuckey Street, Darwin NT 0800, Australia · ACN 655 608 969 · ABN 78 655 608 969