Privacy Policy

1. Who we are

1.1 OptiWMS is run by Electron Code Pty Ltd (ABN 94 628 569 120), an Australian company based in New South Wales ("we", "us", "our").

1.2 This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It covers our website at https://www.optiwms.com, the OptiWMS dashboard at https://app.optiwms.com, our OptiWMS app, and our emails.

1.3 Contact us about privacy at [email protected].

2. Two kinds of information

2.1 Information we handle for ourselves. This is information about people who visit our website, ask for a trial, contact us, or have a login to OptiWMS, and about the businesses that are our customers. We decide how it is used.

2.2 Information we handle for merchants. Merchants use OptiWMS to run their warehouses. Their data includes personal information about their own customers (the people who buy from them) and their staff. We handle that information on the merchant's behalf and under the merchant's instructions, as set out in our Terms of Service. The merchant decides what to collect and what it is used for, and the merchant's own privacy policy applies to it.

2.3 If you bought something from a store that uses OptiWMS and have a question about your order information, please contact that store first. If you contact us, we will pass your request to the store, and help them respond.

3. What we collect

3.1 Website visitors. Pages you visit, links you click, which of our forms you submit and the options you chose in them (never what you type into them), your approximate location (derived from your IP address), browser and device type, and how you arrived at the site. This is collected by Google Analytics (section 8). Our hosting and security provider, Cloudflare, also processes your IP address and request details to deliver the site and protect it from attacks.

3.2 Trial requests. When you ask for a free trial we collect your name, email address, business name, the plan you are interested in, your store platform and store address (optional), whether you want guided onboarding, a message (optional), your browser's time zone, and your IP address.

3.3 Contact, book-a-call and support messages. Your name, company (optional), email address, the topic, your message and your IP address. For messages sent from the Help menu in the dashboard: your email address, organization and role, your message, the dashboard page you were on, and your browser and device type.

3.4 People with a login to OptiWMS. Your email address, a securely hashed version of your password (we never store the password itself), your role and permissions, which organizations and warehouses you can access, when you last signed in, when your phone or tablet last checked in while you were working, your dashboard preferences, and an activity record of what you did in the Service (for example which orders you picked or packed and when). We do not ask for your name.

3.5 Our customers' business and billing details. Business name, the administrator's contact details, plan, order volumes, and, once online billing is live, billing address, ABN or tax ID, and payment history. Card details are entered on Stripe's payment page and held by Stripe. We do not see or store full card numbers.

3.6 Merchants' customer information (handled for merchants). For each order a merchant ships through OptiWMS: the customer's name, email address, phone number, delivery address, delivery instructions, the items ordered and their value, and tracking details. Also shipping labels and pack photos, which can show a delivery address and the contents of a parcel. For returns, the details of the return.

3.7 Merchants' supplier contacts (handled for merchants). Supplier contact names, email addresses, phone numbers and business addresses that merchants enter for purchasing and receiving.

3.8 Technical information. IP addresses and request details in our server and security logs (for example when sign-in attempts are throttled), and records of which device is connected as the OptiWMS app or a mobile picking device.

3.9 We do not intend to collect sensitive information (such as health information) and ask merchants not to enter it in OptiWMS.

4. How we collect it

4.1 Directly from you, when you fill in a form on our website, email us, sign up, or use OptiWMS.

4.2 From the merchant you work for, when they create your login.

4.3 From the services a merchant connects to OptiWMS. For example, when a merchant connects Shopify, WooCommerce or BigCommerce (or eBay, when available), we receive their orders, including their customers' details, from that service. When a merchant connects Shippit, Starshipit or ShipStation, we receive labels and tracking updates from it.

4.4 Automatically, through cookies (section 8) and server logs, when you use our website or OptiWMS.

4.5 If you do not give us the information we ask for, we may not be able to set up a trial, reply to you, or give you access to OptiWMS. You can browse our website without telling us who you are. You cannot use OptiWMS itself anonymously, because each login is tied to an email address.

5. Why we use it

5.1 We use the information we handle for ourselves to:

• (a) set up and run trial and paid accounts;
• (b) let people sign in, reset their passwords and receive account emails;
• (c) reply to questions and support requests, and deliver guided onboarding;
• (d) bill our customers and keep tax records;
• (e) keep the Service and its users secure, including detecting abuse and repeated trials;
• (f) understand how visitors use our website, so we can improve it and measure our advertising; and
• (g) meet our legal obligations.

5.2 We use the information we handle for merchants only to provide the Service to that merchant: to receive and fulfill their orders, create labels and send the details their shipping platform needs, update their sales channels, show their reports, provide support they ask for, and keep the Service secure. We do not use it for our own marketing, and we do not sell it.

5.3 We send account and service emails (such as password resets, invitations and notices about your plan). We do not currently send marketing emails. If we start, we will only send them to customers and people who have asked for them, and every one will include a way to unsubscribe.

6. Who we disclose it to

6.1 Service providers. We use the providers below to run OptiWMS. They handle personal information only to provide their service to us.

6.2 Services a merchant connects. When a merchant connects a sales channel or shipping platform, we send it the information it needs, on the merchant's instructions. For example, we send a customer's name, phone number, delivery address, email address (where the platform notifies customers), delivery instructions and item details to the merchant's shipping platform so it can create a label, and we send tracking details back to the merchant's sales channel. These providers have their own privacy policies:

6.3 Others. We may also disclose personal information:

• (a) to our professional advisers (such as our accountant and lawyers), under a duty of confidentiality;
• (b) when the law requires it, or to a court, regulator or law enforcement body where the law allows;
• (c) to protect the safety or security of people, the Service or our customers' data; or
• (d) to a buyer of our business, who must keep handling it in line with this policy.

6.4 We do not sell personal information.

7. Overseas disclosure

7.1 Our servers and databases are in Australia.

7.2 Some of the providers in section 6 are based overseas or handle information overseas. The countries where personal information is likely to go are the United States, New Zealand, Ireland, Singapore and Canada. When a merchant connects a service, that service's own providers may also handle it in other countries, including India, the Philippines, Indonesia, Malaysia, Switzerland and the United Kingdom.

7.3 We choose providers that publish privacy commitments, and we take reasonable steps to make sure that overseas recipients handle personal information in a way that is consistent with the Australian Privacy Principles.

8. Cookies and similar technologies

8.1 On our website (www.optiwms.com). We use Google Analytics, which sets the cookies _ga and _ga_<ID> to tell visits apart and remember sessions. Google says these last up to two years. Google Analytics uses your IP address to work out your approximate location. You can block these cookies in your browser settings, or install Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout. The website sets no other cookies of its own. Our fonts are served from our own website, so loading a page does not contact Google Fonts.

8.2 In the dashboard (app.optiwms.com). We use one sign-in cookie, called accessToken, to keep you signed in. It is marked HttpOnly and Secure, so scripts on the page cannot read it and it is only sent over encrypted connections. Your browser removes it when you sign out or close the browser. When a merchant installs OptiWMS from Shopify, we set a short-lived cookie (optiwms_shopify_install) to link the installation to their account; it is removed when the installation finishes. The dashboard also stores a few settings in your browser's local storage, such as your chosen printer station and whether scan sounds are on. We do not use advertising or analytics cookies in the dashboard.

9. Storage and security

9.1 We hold personal information in our databases and file storage on servers in Australia, and in encrypted backups (section 10).

9.2 The steps we take include:

• encrypted connections (HTTPS) for our website, dashboard and API;
• passwords stored only as bcrypt hashes;
• sign-in throttling and generic error messages to slow down password guessing;
• database-level separation, so one merchant's account cannot read another's data;
• encryption of the credentials merchants give us for their connected services (AES-256-GCM);
• pack photos served only to signed-in users of the merchant's account;
• nightly backups of our databases and stored files, encrypted with AES-256 before they leave our server; and
• access to production systems limited to the people who need it to run the Service.

9.3 No system is completely secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. Where the breach affects information we handle for a merchant, we will tell the merchant without undue delay.

10. How long we keep it

A merchant can ask us to delete their account sooner. We also act on redaction requests that Shopify sends for a store's customers, by removing the customer's name, email address, phone number and address from the affected orders.

11. Access and correction

11.1 You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We may need to confirm your identity first.

11.2 We will respond within 30 days. We do not charge for a request. If we refuse, we will tell you why in writing and how to complain.

11.3 People with a login can see and update most of their own details in the dashboard, or ask their organization's administrator.

11.4 If your request is about information we handle for a merchant (for example, your delivery details on an order), we will pass it to the merchant and help them respond.

12. Complaints

12.1 If you think we have mishandled your personal information, please email [email protected] with the details. We will acknowledge your complaint within 5 business days, look into it, and reply in writing within 30 days.

12.2 If you are not satisfied with our response, or we have not replied within 30 days, you can complain to the Office of the Australian Information Commissioner: https://www.oaic.gov.au, phone 1300 363 992.

13. Changes to this policy

13.1 We may update this policy. The current version and its effective date are always at https://www.optiwms.com/privacy. If a change materially affects how we handle information about our customers or their users, we will also email the account administrators before it takes effect.

14. Contact

Electron Code Pty Ltd (ABN 94 628 569 120)

Email: [email protected]