Privacy policy
Squirrelhog Pty Ltd (ABN 83 659 968 439, ACN 659 968 439) builds and operates the Onestop suite. We value and respect the privacy of the people we deal with, and we are committed to complying with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and other applicable privacy laws.
This policy explains how we collect, hold, use and disclose personal information in connection with your Onestop account and this website.
What this policy covers — and what it does not
This policy covers two things:
- the onestophub.com.au website; and
- your Onestop account — the single sign-in you use to reach Onestop products.
It does not cover the information you enter into an individual product. Each product has its own privacy policy, which governs the records you create in it:
- Onestop CPE privacy policy — CPD and training records
- Onestop QMS privacy policy — quality-management records
- Onestop Approve privacy policy — payroll sign-off records
Where this policy and a product's own policy differ on how that product handles its data, the product's policy applies to that product.
What is personal information?
"Personal information" means any information or opinion, whether true or not, about an identified individual or an individual who is reasonably identifiable. In general terms, this includes information that personally identifies you either directly (for example, your name) or indirectly.
What we collect for your Onestop account
An Onestop account exists to identify you and let you sign in. The information held for it may include:
- your name;
- your email address;
- your password, stored only as a cryptographic hash — never in a readable form;
- multi-factor authentication settings, such as an authenticator app or recovery codes;
- the third-party accounts you have chosen to sign in with (Google, Apple or Facebook) and the limited profile information those services return, typically your name, email address and profile image;
- sign-in and security activity, such as sign-in times, IP address, and the device and browser used; and
- which Onestop products your account has access to.
We do not ask for sensitive information (as defined in the Privacy Act) to create an Onestop account.
What we collect on this website
- Your cookie choice, stored on your own device so we do not ask again on every visit.
- Analytics (Google Analytics 4), but only if you accept, and with IP anonymisation on. If you decline, no analytics are loaded at all.
- Anything you choose to send us if you contact us by email.
We do not run advertising or marketing trackers on this site. See our Cookie policy for the full breakdown.
How we collect it
We collect personal information directly from you when you create an Onestop account, sign in, update your details, or contact us. We collect it from a third party when you choose to sign in with Google, Apple or Facebook — in that case the provider tells us the limited profile information listed above, so that you can re-use an existing account rather than create a new one. Some information, such as sign-in times and device details, is generated automatically when you use the account.
How we use it
- To create your account and let you sign in.
- To give you a single sign-in across the Onestop products you have access to.
- To send you account and security emails — address verification, sign-in codes, password resets and security alerts.
- To keep the account secure: detecting and preventing fraud, abuse and unauthorised access.
- To provide support when you ask for it.
- For internal administrative purposes and to improve our services.
- For marketing and research purposes, where you have consented.
Who holds your account information
Your identity and credentials for an Onestop account are held by Clerk (Clerk.com, United States), a specialist authentication provider. We do not store your password, and account credentials are kept separate from the records you create in the Onestop products.
Any additional account information we hold ourselves is stored in Australia, in the Sydney region of Amazon Web Services.
Disclosure to third parties
We may disclose personal information in circumstances you would reasonably expect, for example to:
- our service providers — our authentication provider (Clerk), our hosting and infrastructure provider (Amazon Web Services), our email delivery provider, and our analytics provider;
- a third-party sign-in provider you have chosen to use (Google, Apple or Facebook), to the extent needed to authenticate you;
- our professional services advisers; and
- anyone else where you have consented, or where the disclosure is required or authorised by Australian law or a court order.
We do not sell personal information.
Transfer of personal information overseas
Some of the providers above are based outside Australia, including in the United States. Where personal information is disclosed overseas we take reasonable steps to ensure appropriate security and privacy practices are maintained. Each Onestop product's privacy policy sets out the overseas disclosures that apply to that product's data.
How we protect it
- Encryption of data in transit and at rest.
- Credentials held by a specialist authentication provider, separate from product data.
- Multi-factor authentication available on your account — we recommend turning it on.
- Access restricted to personnel who need it to provide services to you.
- Standard technical measures including firewalls and anti-virus.
No system is completely secure. If we become aware of a data breach likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme.
Direct marketing
We may send you marketing communications about Onestop products, opportunities or events where you have requested or consented to receive them, in accordance with the Spam Act 2003 (Cth). You can opt out at any time using the unsubscribe link in any such email, by emailing us, or through your notification preferences.
Account and security emails — verification, password resets, security alerts — are not marketing and are not affected by your marketing preferences. We need to be able to send them to keep your account working and safe.
Retention
We keep your account information for as long as you have an Onestop account, and afterwards only for as long as we need it — for example to comply with a legal or record-keeping obligation, or to resolve a dispute. Records you have created inside an individual product are retained under that product's own terms and privacy policy, which may require them to be kept for longer.
Accessing, correcting and deleting your information
You can view and update most of your account details yourself when you are signed in. If you want to access or correct personal information we hold about you, contact us and we will usually respond within 5 business days. We may need to verify your identity first.
You can ask us to delete your Onestop account. Deleting the account removes your sign-in and the account information described above. It does not automatically delete records held inside an individual product — those are governed by that product's terms and privacy policy, and some may need to be retained to meet regulatory or contractual obligations. Tell us if you want those deleted too and we will explain what can be removed.
Links to third-party sites
This website links to sites operated by third parties, including the individual Onestop product sites and third-party sign-in providers. We are not responsible for the privacy practices of sites we do not operate. Please read their own privacy policies.
Inquiries and complaints
If you have a complaint about how we have handled your personal information, email rick@squirrelhog.com. We may require proof of identity and full details before we can process a complaint. Please allow up to 5 business days for a response.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
We may update this policy from time to time. The current version always appears on this page, with the review date shown at the top. Where a change materially affects how we handle your personal information, we will take reasonable steps to tell you.
How to contact us
Email: rick@squirrelhog.com
Post: Squirrelhog Pty Ltd, New South Wales, Australia
See also: Terms & conditions · Cookie policy