ArcusOffice Privacy Policy

Effective date: 4 November 2026

This Privacy Policy explains how Arcus Cloud Computing Pty Ltd (ABN 21 689 646 955, ACN 689 646 955) ("Arcus Cloud Computing", "we", "us", or "our") handles information in connection with ArcusOffice (the "Service"), our cloud-based customer relationship management (CRM) service. It applies to the Service only. Our separate website Privacy Policy applies to the Arcus Cloud Computing website.

Who we are

ArcusOffice is built and operated by Arcus Cloud Computing Pty Ltd (ABN 21 689 646 955, ACN 689 646 955), an Australian private company registered in New South Wales, Australia. You can contact us about this policy, your information, data requests or support:

• Email: michael@arcuscloudcomputing.com.au
• Online: through our Contact Us page
• Phone: 0482 954 654 (within Australia) or +61 482 954 654 (outside Australia), 8:00am to 5:00pm AEST Monday to Friday

Information the Service processes

ArcusOffice is used by business customers ("customer organisations"). We process two kinds of information:

• Customer data - the business records a customer organisation and its users put into ArcusOffice, such as accounts, contacts, leads, tasks, events, cases, jobs, quotes, invoices, notes, emails composed in the Service and file attachments. This can include personal information about the customer organisation's own customers and contacts.
• User account data - information about the people who use ArcusOffice on behalf of a customer organisation, such as name, email address, login credentials (passwords are stored only as secure hashes), role, organisation membership, preferences and basic usage and security logs (for example sign-in times and an audit trail of changes to records).

For customer data, the customer organisation decides what information is entered and how it is used. We act as a processor (service provider) for that customer data: we handle it only to provide, secure and support the Service for that organisation, as instructed by it and as set out in this policy and the ArcusOffice Terms of Service. If you are a contact of one of our customer organisations and have a question about your information, please contact that organisation first; we will assist it to respond.

How we use information

• To provide, operate and maintain the Service for customer organisations and their users.
• To authenticate users, keep accounts secure and keep each organisation's data separate from other organisations.
• To send emails that users compose or schedule in the Service, and system emails such as invitations and password resets.
• To provide support, fix problems and improve the reliability of the Service.
• To comply with the law.

We do not sell customer data or user account data, and we do not use it for advertising.

Google user data

ArcusOffice offers an optional feature that lets a customer organisation send email from ArcusOffice through its own Gmail or Google Workspace account. This section explains how ArcusOffice handles information received from Google.

• What we request: ArcusOffice requests only the Google OAuth scope https://www.googleapis.com/auth/gmail.send. This scope allows ArcusOffice to send email on the account's behalf. It does not allow ArcusOffice to read the mailbox.
• When we request it: only when an organisation administrator chooses to connect a Gmail or Google Workspace account to ArcusOffice. If no account is connected, ArcusOffice receives no Google user data.
• How we use it: solely to send emails that the organisation's users compose or schedule in ArcusOffice.
• What we do not do: ArcusOffice does not read, store or index mailbox content, and does not access Google contacts or calendars.
• How we store it: the OAuth tokens issued by Google are stored encrypted and are used only for sending email.
• How to revoke access: you can revoke ArcusOffice's access at any time from your Google Account at https://myaccount.google.com/permissions, which removes ArcusOffice's access immediately. You can also email michael@arcuscloudcomputing.com.au to have the stored connection removed from ArcusOffice. Stored Google OAuth tokens are deleted on request, and whenever the organisation's data is deleted.
• Sharing: Google user data is not sold, is not used for advertising, and is not shared with anyone except as necessary to provide this email-sending feature or where required by law.
• AI and machine learning: Google user data is not used to develop, improve or train artificial intelligence or machine learning models.

ArcusOffice's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Storage and hosting

Application data is stored in a PostgreSQL database on hosted infrastructure operated by Arcus Cloud Computing. Each customer organisation's data is kept separate using row-level tenant isolation, so that one organisation cannot access another organisation's records.

File attachments uploaded to the Service are stored encrypted in Amazon Web Services (AWS) S3 in the Sydney (ap-southeast-2) region.

Where a customer organisation chooses to connect a third-party service (for example Google for email sending, or accounting software in future), information needed for that connection is exchanged with that provider and is also handled under that provider's own privacy terms.

Security

We take reasonable steps to protect information from misuse, loss, and unauthorised access, modification or disclosure. These include:

• encryption of data in transit (HTTPS);
• encryption of stored file attachments and of sensitive credentials such as OAuth tokens;
• tenant isolation between customer organisations;
• role-based access controls within each organisation, and restricted administrative access on our side; and
• audit logging of changes to records.

No system is completely secure. If we become aware of a data breach that is likely to result in serious harm, we will notify affected customer organisations and, where required, the Office of the Australian Information Commissioner.

Cookies

The Service uses essential cookies needed to sign you in and keep your session secure, and a cookie or browser setting that remembers your display theme preference. The Service does not use advertising cookies. If you block essential cookies, you will not be able to sign in.

Retention and deletion

• We keep customer data and user account data while the customer organisation's account is active.
• An organisation administrator can request an export or deletion of the organisation's data at any time by emailing michael@arcuscloudcomputing.com.au.
• When an organisation's account is closed, or we receive a deletion request, we delete the organisation's data from our live systems within 30 days. It is then purged from our backups within a further 90 days as those backups rotate, so it is fully removed within 120 days.
• Google OAuth tokens are deleted when the organisation's data is deleted, or earlier on request.
• We may keep limited records where we are required to by law, for example tax or billing records.

To request access, correction, export or deletion, please email michael@arcuscloudcomputing.com.au. If you are a user or contact of a customer organisation, we may refer your request to that organisation.

Australian Privacy Principles

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may request access to, or correction of, personal information we hold about you. If you have a complaint about how we have handled your personal information, please email michael@arcuscloudcomputing.com.au and we will respond within a reasonable time. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au.

Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date and, for significant changes, we will notify organisation administrators. Continued use of the Service after a change means the updated policy applies.

Contact

For questions about this policy or about ArcusOffice's handling of your information, please email michael@arcuscloudcomputing.com.au, use our Contact Us page, or call 0482 954 654 (within Australia) or +61 482 954 654 (outside Australia).

See also: About ArcusOffice | ArcusOffice Terms of Service