Yellow Ace Pty Ltd (ABN 69 673 978 946, ACN 673 978 946) ("Yellow Ace", "we", "us") is an Australian software consultancy and software-as-a-service provider based in Perth, Australia. We operate the website at yellowace.com, a client portal, and a CRM/CMS platform we provide to clients as a service.
Contact for privacy matters: our Privacy Officer, through the contact form at yellowace.com/contact.
This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where we serve clients or individuals in other jurisdictions, section 13 explains how overseas privacy laws (such as the GDPR) apply.
2. Our two roles: our data vs. your data
We handle personal information in two distinct capacities:
As the organisation responsible (controller) for information about our website visitors, people who enquire with us, our clients' staff who use our portal, and our own team. This policy covers that information.
As a service provider (processor) for content and data that our clients put into the CMS and CRM services we host for them: for example, content published to a client's own website. We process that data on the client's instructions under our agreement with them. The client's own privacy policy governs it; if you have questions about data a client holds in a Yellow Ace service, contact that client.
3. Personal information we collect
We collect only what is needed for each interaction. We do not buy data about you, and we do not sell personal information.
3.1 If you visit our website
We use no advertising trackers and no tracking cookies, and the site sets no cookies at all. We do measure how our public pages are used, in a form that cannot identify anyone: see section 3.1.1.
Your browser stores small preferences locally on your device (your light/dark theme choice, and, if you sign in, your sign-in session; see section 6). These stay in your browser and are not used to track you.
Our hosting infrastructure (Amazon CloudFront and Amazon API Gateway) automatically records standard access logs: your IP address, browser user agent, the pages and resources requested, and timestamps. We use these solely for security, debugging, and capacity monitoring. Edge access logs are kept for 90 days; API access logs for up to 6 months.
Everything the pages need in order to render (fonts, images, stylesheets and scripts) is served from our own domain. Browsing the site makes no request to any other company, and no other company learns that you visited. The single exception is our contact form, which is protected by Google reCAPTCHA: see section 3.2.
3.1.1 Anonymous page measurement
We count how often each public page is viewed, how long it stays on screen, how far down it is scrolled, and roughly whereabouts on the page people click. We use this to work out which pages are worth writing and which are being ignored.
It is built so that there is nothing in it to identify:
We do not keep that message. It is added into running totals for that page on that day and then discarded, so what we hold is a count rather than a record of a visit: there is no entry in it that is you, and no way for us (or anyone who obtained the data) to work backwards to one. The totals are deleted automatically after about 13 months.
we set no cookie and store nothing on your device for it;
we assign no visitor, session or device identifier of any kind, and we do not fingerprint your browser;
your browser sends one short message when you leave a page, carrying only the page address, the number of seconds the page was visible, how far you scrolled, click positions rounded to a coarse grid, and a count of how long your mouse pointer rested in each square of that same grid. The pointer is sampled twice a second: we record which squares it paused in and for how many samples, never the path it took between them, and the movements themselves are discarded in your browser and never sent. It carries nothing else, and nothing in it is linked to you, to your other visits, or to any enquiry or account you may have with us;
your IP address is not part of it (our infrastructure logs that separately, for security, as described above).
3.2 If you send us an enquiry
Our contact form collects your name, email address, company (optional), the type of project you select, and your message. We record the time of submission. We do not record your IP address or device details against your enquiry.
Your enquiry is stored in our CRM and also emailed to our staff so we can respond. When we reply, our response is sent to the email address you gave and quotes your original message; a copy of the reply (with the responding staff member's name) is kept with your enquiry.
The form is protected by Google reCAPTCHA. When you submit, Google receives your IP address and browser information to verify you are human; we send Google only the verification token, and we do not store it.
3.3 If you or your employer become a client
Your portal account: first and last name, email address, phone number (optional), job title (optional), your role and permissions, and the identifier that links your account to our sign-in provider (Microsoft Entra External ID). You can update your name, phone, and job title in the portal yourself.
Information provided by your colleagues or employer: an account owner or administrator at your organisation may invite you by entering your name and email address before you have ever signed in. Our clients may also record their organisation's contact people in their client profile (including a primary contact's and a contract manager's name, email, and phone number) along with billing details (billing name, billing/invoice email, billing address, ABN/ACN) and workplace details (work address and access notes). If your details appear here, they were provided by your organisation for the purpose of us delivering services to it.
Communications: messages you exchange with us through the portal (with your name and the time sent), our replies, and notes our staff make about client interactions (calls, emails, meetings) so we can serve you consistently.
Bookings and payments: engagement bookings, scheduling preferences, and manual payment records (amount, currency, status, invoice reference). We do not collect or store credit card or bank account numbers; there is no online payment processing in our systems.
3.4 Sign-in information
Authentication is handled by Microsoft Entra External ID. Your password (or your Google, Microsoft, Apple, or Facebook sign-in, if you use social sign-in) is handled entirely by Microsoft and the provider you choose; we never see or store passwords. From your sign-in we receive your name, email/username, and account identifier, which we match to your portal account.
3.5 Our team
We publish our team members' names, titles, photos, biographies and skills on our website, and the names and titles of bookable team members are shown in our booking availability view. Business-card pages for individual team members include their work contact details. Internally we record team availability, including leave.
3.6 Testimonials
With permission, we publish testimonials that include the author's name, employer, role, photo, and quote.
4. How we collect and hold personal information
We collect personal information:
All application data is stored in Amazon Web Services (AWS) databases and storage in the Sydney, Australia region, encrypted in transit. Access is restricted to authorised Yellow Ace staff. Production data is backed up via point-in-time recovery.
directly from you: the contact form, the portal, messages you send us;
from your organisation: invitations, client profile details, contract contacts;
from our identity provider: Microsoft Entra External ID, when you sign in;
automatically: infrastructure access logs generated by hosting the website and APIs.
5. Why we collect, hold, use and disclose it
We use personal information to:
We do not use personal information for advertising or profiling, and we do not disclose it to anyone except the service providers in section 10 and where the law requires.
respond to enquiries and provide quotes;
provide, administer, and support our consulting engagements and SaaS services (accounts, permissions, bookings, scheduling, service-level monitoring);
communicate with you about your engagement, including email notifications when messages are sent or resolved;
keep billing and payment records;
maintain the security and reliability of our systems (access logs, monitoring, abuse prevention);
We use no cookies. Your browser's local storage holds:
You can clear these at any time via your browser. None are used for tracking, and our page measurement (section 3.1.1) adds nothing to this list: it stores nothing on your device at all.
your light/dark theme preference;
your sign-in tokens and last-used sign-in method (only if you sign in), managed by Microsoft's sign-in library, so you stay signed in between visits;
a short-lived note of what you were doing when redirected to sign in (session storage only).
7. Emails we send
We send transactional email only (via Amazon SES, from the yellowace.com domain): replies to your enquiry, notifications of portal messages and resolutions, and internal operational alerts. We do not send marketing email. Replies you send to our emails are received in our Microsoft 365 mailboxes.
8. Data quality, security and retention
Credentials are held by Microsoft, not us. Our systems use short-lived tokens and role-based permissions; administrative secrets are stored in AWS secret stores.
Traffic is encrypted in transit (TLS, HSTS). Data at rest sits in managed AWS services in Sydney.
We retain client records for the duration of the client relationship and for seven years afterwards, then remove the personal information from them. Enquiries that do not become engagements are deleted after 24 months. Infrastructure logs are retained as described in section 3.1.
**Invoices, receipts and payment records are an exception, and we keep them.** Tax and accounting law requires us to hold the financial record of what was sold and paid for, and that obligation does not end when you ask us to erase your information or when a relationship ends. So when we remove personal information, the paperwork that has to balance stays: the invoice, the receipt reference, the amount, the date, and which organisation it belonged to. We keep that and nothing more than that for the purpose, and we do not use it for anything else.
9. Data breaches
We take our obligations under the Notifiable Data Breaches scheme seriously. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by law.
10. Who we share personal information with
We disclose personal information only to the service providers that run our platform:
We may also disclose personal information where required by law or to protect our legal rights.
Provider | What they do for us | Where
Amazon Web Services | Hosting: databases, compute, file storage, email delivery, logging | Australia (Sydney); content delivery network edge servers in the US, Canada, Europe and Israel
Microsoft | Identity and sign-in (Entra External ID), business email (Microsoft 365), meeting booking (Microsoft Bookings) | Global (Microsoft-managed)
Google | reCAPTCHA on our contact form (see section 3.2) | Global (Google-managed)
GoDaddy | Domain name registration | United States
11. Overseas disclosure
Your personal information is stored in Australia. However, some of the providers above are overseas companies, and some processing happens outside Australia:
We choose providers that maintain recognised security certifications and contractual data-protection commitments.
website and API traffic passes through AWS content-delivery edge locations in the United States, Canada, Europe and Israel;
sign-in is processed by Microsoft, and contact-form verification by Google: both global, US-headquartered providers;
the fonts and images on the website are served from our own domain, by the AWS edge locations above, and not by any other company.
12. Access, correction, and complaints
Access and correction: you may request access to the personal information we hold about you, and ask us to correct it, by contacting our Privacy Officer through the form at yellowace.com/contact. Portal users can update their own name, phone number, and job title in the portal. We will respond within a reasonable period (our aim: 30 days) and will not charge for making a request.
Complaints: if you believe we have breached the Australian Privacy Principles, contact our Privacy Officer through the form at yellowace.com/contact with the details. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are unsatisfied with our response, you can complain to the OAIC: oaic.gov.au | 1300 363 992 | GPO Box 5288, Sydney NSW 2001.
13. Overseas visitors (GDPR and similar laws)
If you are in the UK or EEA, our processing of your data is generally based on: taking steps at your request before entering a contract (enquiries), performance of a contract (portal accounts and services), and our legitimate interests in securing and operating our systems (access logs). You have rights of access, rectification, erasure, restriction, portability, and objection: exercise them through the contact form at yellowace.com/contact.
14. Automated decision-making
We do not use personal information in computer programs to make decisions that significantly affect individuals' rights or interests. (Automated processes we run, such as service-level timers that alert our own staff, do not make decisions about you.)
15. Changes to this policy
We may update this policy from time to time. The current version will always be at yellowace.com/privacy with its last-updated date. Material changes affecting portal users will be notified via the portal or email.