SEVEN: PRIVACY POLICY

Gregory Thomas Dobson trading as Seven ABN 77 474 138 379

Version 1.1 (DRAFT) Last updated: 9 August 2026

Seven is a hosted task and work management application operated by Gregory Thomas Dobson trading as Seven ("Seven", "we", "us"). This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you use Seven, our website at seventasks.net, and related services.

We are committed to handling personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we apply that standard to our handling of your information irrespective of whether we are at any given time an organisation bound by that Act.

1. The two roles we play

Seven handles personal information in two distinct ways, and different parts of this policy apply to each.

Information we hold about you as our customer. This includes your account details, your billing records and information about how you use the application. We decide how this information is handled, and this policy governs it in full.

Information you put into Seven about other people. Seven lets you record details of clients, colleagues, suppliers and other contacts in contact records, task descriptions, comments, messages and uploaded files. We hold that information on your behalf and handle it only as needed to run the service and as you instruct. You decide what to collect, why, and how long to keep it, and you are responsible for meeting your own privacy obligations to those individuals. Sections 2.3, 6 and 9 explain how we treat it.

2. What we collect

2.1 Information you give us

  • Name, email address, username and display name.
  • Organisation and role, where you provide them.
  • Account credentials. Passwords are stored only as a cryptographic hash and are never stored or visible in readable form.
  • Billing information, handled by our payment provider. We receive a customer reference and subscription status; we do not receive or store your card number.
  • Correspondence you send us, including support requests.

2.2 Information generated by your use of Seven

  • The content you create: tasks, task groups, boards, workspaces, comments, messages, contact records, project records, schedules and uploaded files.
  • Activity records showing actions taken in your account, used to provide audit trails, notifications and support.
  • Technical information including IP address, browser and device type, and access timestamps, recorded in server logs.
  • Web analytics data about the pages you visit within our website and application, collected through Google Analytics as described in section 11.

2.3 Information about third parties that you provide

Where you record details of another person in Seven, that information is held in your account. We do not use it for our own purposes, do not disclose it except as described in section 6, and delete it when you delete it or when your account is closed.

You must not upload sensitive information within the meaning of the Privacy Act 1988 (Cth), health information, government-issued identifier numbers, or payment card data to Seven. The application is not designed to hold information of those kinds.

3. Why we collect it

We use personal information to:

  • create and administer your account and authenticate your access;
  • provide the application and its functions, including tasks, boards, messaging, files, contacts, scheduling and reporting;
  • process payments and manage subscriptions;
  • send you service communications such as security notices, billing notices and material changes to this policy;
  • respond to your support requests;
  • monitor for, investigate and respond to security incidents, abuse and breaches of our terms;
  • maintain, troubleshoot and improve the application; and
  • comply with our legal obligations.

We may generate aggregated, de-identified statistics about how the application is used, in a form that does not identify you, your organisation or any individual, and use those to operate and improve the service.

We do not use your content to train machine learning models, and we do not sell personal information to anyone.

4. Direct marketing

We may send you occasional emails about new features or changes to Seven. Every such message includes an unsubscribe link, and you can opt out at any time by using it or by contacting us. Opting out of marketing does not stop service communications about security, billing or terms, which we need to send you while your account is open.

5. Where your information is stored

Seven runs on hosting infrastructure provided by Hostinger. Hostinger does not operate a data centre in Australia. Your account information and content are therefore stored and processed on servers located outside Australia.

We will publish the current server region in our Security and Compliance Statement and give notice before changing it. Before disclosing personal information to an overseas recipient we take reasonable steps, as required by Australian Privacy Principle 8, to satisfy ourselves that the recipient handles it in a manner consistent with the Australian Privacy Principles, including by relying on that provider's contractual data protection commitments.

By using Seven you consent to your information being stored and processed outside Australia on this basis. If offshore storage is not acceptable for your circumstances, please contact us before creating an account or uploading data, because we may not be able to accommodate an Australian-only storage requirement at this time.

6. Who we share it with

We share personal information only as follows.

Service providers. We use a small number of third parties to run Seven. They are permitted to handle information only to provide their service to us, and are bound by their own contractual and legal obligations. They are listed in our Security and Compliance Statement and Sub-processor Schedule, published alongside this policy. We will give at least 30 days' notice before adding a new provider that will handle your content.

Other users in your workspace. Where you use Seven with a team, the content you create in shared workspaces, boards and messages is visible to the other members of that workspace, and your name and display details are visible to them.

Your organisation. Where your account was created under an organisational subscription, the account administrator for that organisation may access, export and delete content in the organisation's workspaces, including content you created.

Legal and safety. We may disclose information where required by law, court order or a lawful request from a regulator or law enforcement agency, or where reasonably necessary to protect the rights, property or safety of any person.

Business transfer. If the business operating Seven is sold or transferred, information may transfer with it. We will give you at least 30 days' notice before that happens.

We do not sell personal information, and we do not disclose it to advertisers or data brokers.

7. How we protect it

We apply technical and organisational measures appropriate to the size of the service, including encrypted connections, hashed password storage, authenticated and scoped access controls, rate limiting, and activity logging. Our Security and Compliance Statement describes these in more detail.

We take security seriously, but no online system can be guaranteed secure. You also have a part to play: use a strong and unique password, keep your devices secure, and remove access for people who no longer need it.

8. Data breaches

If we become aware of unauthorised access to, or disclosure or loss of, personal information, we will assess it promptly. Where the incident is likely to result in serious harm, we will notify affected individuals and, where applicable, the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme. Where the affected information was held on behalf of a customer organisation, we will notify that organisation without undue delay and in any event within 72 hours of becoming aware, and assist it in meeting its own obligations.

9. How long we keep it

We keep personal information only as long as we need it.

  • Account and content: for as long as your account is open. After your account is closed, content is retained for 30 days so you can complete an export, then deleted from live systems. Copies may persist in backups for up to a further 90 days before being overwritten in the ordinary backup cycle.
  • Content you delete yourself: removed from live systems on deletion, subject to the same backup cycle.
  • Billing and transaction records: retained for the period required by taxation and corporations law, currently at least five years.
  • Server and security logs: retained for a limited period for security and troubleshooting purposes, then deleted.

10. Your rights

You may ask us to:

  • give you access to the personal information we hold about you;
  • correct information that is inaccurate, out of date or incomplete;
  • delete your account and the information associated with it; or
  • stop sending you marketing communications.

Contact us using the details in section 13. We will respond within 30 days. We will ordinarily provide access without charge, and where a request is complex we will tell you in advance if a reasonable cost applies. In the limited circumstances where we cannot give access or make a correction, we will explain why in writing.

Where your request concerns information held in another customer's account (for example, if an organisation using Seven holds your contact details), we will refer your request to that customer, who is the appropriate party to deal with it, and we will assist them in responding.

11. Cookies, storage and tracking

Seven uses browser local storage to keep you signed in between visits, and cookies where required for session and security purposes. These are necessary for the application to function; clearing them will sign you out.

Analytics. We use Google Analytics 4 to measure how our website and application are used, so that we can see which pages people visit, how they arrive, and where the service is confusing or slow. It runs on every page, including pages inside the application once you are signed in. Google Analytics sets its own first-party cookies (named _ga and _ga_*) to distinguish one visitor from another across visits.

What it receives is limited to standard web measurement data: the page address and title, the referring page, approximate location derived from your IP address, and your browser, device and language settings. It does not receive the content you create in Seven. Page addresses inside the application do not contain the names of your boards, tasks, contacts or files, and we strip single-use security tokens from the address before it is reported. Google acts as our service provider for this purpose and is listed in our Security and Compliance Statement and Sub-processor Schedule.

You can prevent analytics data being collected by installing Google's browser opt-out add-on at tools.google.com/dlpage/gaoptout, or by using your browser's tracking protection or an equivalent blocker. Doing so does not affect your ability to use Seven.

We do not use advertising cookies, we do not run advertising or remarketing features in Google Analytics, we do not permit third-party advertising trackers on the application, and we do not use analytics data to build a profile of you for any purpose other than operating and improving Seven.

12. Third-party links and integrations

Seven may link to external sites, and may offer optional integrations with third-party services. Where you choose to activate an integration, information may be exchanged with that service under its own terms and privacy policy. We are not responsible for the privacy practices of third parties, and we encourage you to read their policies before connecting them.

13. Contact and complaints

For any question, request or complaint about privacy, contact us:

Seven Gregory Thomas Dobson trading as Seven ABN 77 474 138 379 18 King Albert Avenue, Tanilba Bay NSW 2319

Email: support@seventasks.net Phone: +61 438 850 930 Web: seventasks.net

We will acknowledge a complaint within five business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au, by telephone on 1300 363 992, or by writing to GPO Box 5218, Sydney NSW 2001.

14. Changes to this policy

We may update this policy from time to time. The current version is always published at seventasks.net with the date of last update shown at the top. Where a change is material, we will notify you by email or in the application before it takes effect.