Privacy Policy

Hiperflow Pty Ltd (“ConsultOps”, “we”, “us”) provides practice-management software for design consultancies. This Privacy Policy explains how we collect, hold, use and disclose personal information through our websites, applications, support and related services (“Services”).

We aim to handle personal information consistently with the Australian Privacy Principles in the Privacy Act 1988 (Cth). Where a customer organisation provides information about its staff, clients or contacts, that organisation controls why the information is entered and who may access it. ConsultOps processes that information to provide the Services and also handles account, security and service-administration information for its own operational purposes.

Depending on how you use ConsultOps, we may collect:

• Account and identity information, including name, work email address, authentication identifiers, workspace membership, role and permissions.
• Organisation and professional information, including business details, branding, team information, client and contact details, proposals, projects, phases, capacity plans, time records, billing records and communications.
• Files and content you or authorised users upload, generate, send or share through the Services.
• Billing information, including subscription plan, payment status, Stripe customer and subscription identifiers, and limited transaction details. ConsultOps does not store complete payment-card numbers.
• Integration information when you connect Xero or another supported service, including connection identifiers, authorisation tokens, tenant details, accounting contacts, accounts and invoice data needed to perform requested actions.
• Technical and usage information, including IP address, browser and device information, dates and times, pages or features used, referral source, campaign parameters, diagnostics, security events and service logs.
• Communications, including support requests, feedback, email preferences, delivery status and records of operational or client emails sent through ConsultOps.

Please do not provide sensitive information unless it is necessary for your use of the Services and your organisation is authorised to do so.

We collect information directly from you when you create an account, use the Services, upload content, connect an integration, contact us or respond to communications. We also receive information from your workspace owner or colleagues, people who communicate with a ConsultOps customer, and service providers such as Clerk, Stripe, Xero, Resend, Umami and Replit.

If you provide personal information about another person, you must be authorised to do so and, where required, tell them about this policy. If we cannot collect information needed to create or secure an account, process a subscription or provide a requested feature, we may be unable to provide that part of the Services.

We use personal information to:

• provide, operate and support accounts, workspaces, proposals, projects, planning, time, billing and client-communication features;
• authenticate users, apply permissions, protect accounts, prevent misuse and investigate security or reliability issues;
• process subscriptions and payments, administer trials and maintain billing records;
• perform actions you request through Xero and other integrations;
• send invitations, service notices, trial guidance, support replies and customer-directed communications, and record delivery or engagement status where available;
• measure product and marketing performance, understand feature use and improve the Services;
• comply with legal obligations, enforce our Terms and protect the rights, safety and property of ConsultOps, customers and others; and
• create aggregated or de-identified information that does not reasonably identify an individual.

We do not sell personal information or use customer content for third-party advertising.

ConsultOps and its providers use cookies, browser storage and similar technologies that are necessary to authenticate users, maintain secure sessions, remember interface settings, preserve selected learning or workflow state, and protect the Services. Clerk may set authentication and security cookies.

We use Umami analytics to measure visits and important product or marketing events. We may also store campaign parameters, the landing path and referring host in session storage so a sign-up can be attributed to the relevant campaign. ConsultOps does not use this Umami analytics data for third-party behavioural advertising.

We use Meta Pixel to measure advertising performance, visits and actions such as guided-walkthrough enquiries and completed trial registrations. Meta may receive technical information about your browser or device and use cookies or similar technologies under its own privacy terms.

You can control cookies through your browser. Blocking essential cookies or clearing browser storage may prevent sign-in or cause preferences and locally stored progress to be lost.

We disclose personal information only as reasonably necessary to provide and protect the Services, follow your instructions, complete a transaction, comply with law or manage our business. Our principal service providers and subprocessors include:

We may also disclose information to professional advisers, insurers, regulators, courts, law enforcement, a purchaser or successor in a business transaction, and other parties where you direct or consent to the disclosure. Service providers may process information under their own privacy policies as well as contractual obligations owed to ConsultOps.

Hiperflow Pty Ltd is an Australian company, but the cloud and software providers listed above may store or process personal information in Australia, the United States and other countries where they or their subprocessors operate. Those countries may have privacy laws different from Australian law.

We take reasonable steps appropriate to the circumstances to require providers to protect information and use it only for the relevant service. Provider locations can change as their infrastructure and subprocessor arrangements change. Contact us if you need current information relevant to a particular disclosure.

We use reasonable administrative, technical and organisational safeguards designed to protect personal information. These include authenticated access, role and permission controls, encryption in transit, restricted production access, protected provider credentials, logging, backups and security monitoring. Customer files are stored with access controls and time-limited access mechanisms where appropriate.

No internet transmission or storage system is completely secure. You are responsible for protecting your credentials, using appropriate workspace permissions, reviewing recipients before sending information and notifying us promptly of suspected unauthorised access.

We retain personal information for as long as reasonably necessary to provide the Services, maintain security and business records, resolve disputes, enforce agreements and meet legal, accounting and tax obligations. Retention depends on the type of information and why it is held.

Workspace owners may delete records through available product controls and may request workspace closure or deletion. When information is deleted, it may remain for a limited period in backups, security logs, email-delivery records or records we must retain by law. We delete or de-identify information when it is no longer reasonably required, subject to these exceptions and any unresolved legal or security need.

You may request access to personal information we hold about you or ask us to correct inaccurate, out-of-date, incomplete, irrelevant or misleading information. We may need to verify your identity and may refuse or limit access where permitted by law, in which case we will generally provide written reasons.

You can update some account and workspace details in ConsultOps. Workspace content may be controlled by the customer organisation that provided it, so we may refer a request to that organisation. You can opt out of non-essential trial emails using the unsubscribe link. We may still send security, billing and service messages necessary to administer your account.

The Services are intended for business users aged 18 or over. We do not knowingly offer accounts to children. If you believe a child has provided personal information to ConsultOps, contact us so we can investigate and take appropriate action.

To ask a privacy question, request access or correction, or make a complaint, email info@hiperflow.co. Please describe the issue and provide enough information for us to investigate. We will acknowledge and respond within a reasonable period.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au/privacy/privacy-complaints.

We may update this policy as the Services, providers or legal requirements change. We will publish the revised policy with a new effective date and provide reasonable notice of material changes where appropriate. Your use of the Services remains subject to the policy then in effect.

This policy should be read with our Terms and Conditions.