Privacy Policy - thermasense

Southerndown Ventures Pty Ltd · Last updated: May 2026

1. About This Policy

This Privacy Policy describes how Southerndown Ventures Pty Ltd (ABN to be inserted) ("we", "us", "our"), trading as thermasense, collects, uses, holds and discloses personal information. Our registered address is 6/828 High St, Kew East VIC 3102, Australia.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy applies to the thermasense web dashboard (thermasense.com.au) and companion iOS application.

2. What Information We Collect

We collect personal information only to the extent necessary to provide the thermasense service. The categories of information we may collect include:

Account information — name, email address, username, and password (hashed) for staff and client portal users.
Usage and analytics data — pages visited, session duration, device type, browser, and approximate geographic region (country/state level, not precise location).
IoT device telemetry — temperature, humidity, battery level, and signal-strength (RSSI/SNR) readings transmitted by LoRaWAN sensors. This is operational/equipment data and does not typically constitute personal information.
Site and asset metadata — names of refrigeration sites and assets provided by your organisation for labelling purposes.
Technical log data — IP addresses, timestamps, and error logs retained for security and debugging purposes.

3. How We Collect Information

We collect information:

Directly from you when you create or update an account, or when your organisation sets up thermasense.
Automatically via cookies, analytics scripts, and server logs when you use the dashboard or iOS app.
From LoRaWAN sensors registered to your account, which transmit telemetry data over the network.

4. Why We Collect and Use Information

We use personal information to:

Provide, operate, and maintain the thermasense monitoring platform.
Authenticate users and manage account access.
Display sensor telemetry and generate alerts for temperature excursions.
Diagnose technical issues and improve platform reliability.
Respond to support enquiries.
Comply with legal obligations.

We do not use personal information for advertising or sell it to third parties.

5. Third-Party Service Providers

We engage the following sub-processors to operate the platform. Each is bound by their own privacy commitments and, where applicable, data processing agreements with us.

Provider	Purpose	Data location	Privacy reference
Supabase	Database (user accounts, sensor data, site metadata) and authentication	Australia (ap-southeast-2)	supabase.com/privacy
Amazon Web Services (AWS)	Cloud infrastructure; AWS IoT Wireless for LoRaWAN sensor registration	Australia (ap-southeast-2) where available	aws.amazon.com/privacy
Cloudflare	DNS, DDoS protection, and TLS termination	Global CDN; no persistent storage of personal data	cloudflare.com/privacypolicy
PostHog	Product analytics (session data, feature usage)	Australia (self-hosted or PostHog Cloud AU region)	posthog.com/privacy
Plausible Analytics	Cookieless web analytics (aggregate page views, no personal identifiers)	EU (no cookies or personal data collected)	plausible.io/privacy
Apple	iOS App Store distribution of the thermasense companion app	Global (Apple infrastructure)	apple.com/legal/privacy

We store data in Australia wherever practicable. Where a provider processes data outside Australia, we take reasonable steps to ensure it receives equivalent protection to the APPs.

6. Cookies and Analytics

The thermasense web dashboard uses:

Session cookies — strictly necessary for authentication. These expire when you close your browser or log out.
CSRF cookies — required for form security. No personal data is stored in these cookies.
PostHog — may set a first-party analytics cookie to track product usage within the dashboard.
Plausible Analytics — cookieless; no tracking pixels or identifiers are set.

We do not use advertising cookies or cross-site tracking technologies.

7. Disclosure of Personal Information

We will not disclose personal information to third parties except:

To the sub-processors listed in Section 5 for the purposes described.
Where required or authorised by Australian law (e.g., a court order or regulatory request).
With your express consent.
In the event of a business transfer (e.g., merger or acquisition), subject to the incoming party being bound by equivalent privacy obligations.

8. Data Security

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss, and unauthorised access. These include:

TLS encryption for all data in transit.
Encrypted database storage via Supabase (hosted on AWS).
Role-based access control — users only access data associated with their organisation.
Passwords are never stored in plain text; authentication is handled via hashed credentials or Supabase Auth.
Error and exception tracking via Rollbar to detect anomalies quickly.

No method of transmission or storage is 100% secure. We will notify affected individuals and, where required, the Office of the Australian Information Commissioner (OAIC) in the event of an eligible data breach under the Notifiable Data Breaches (NDB) scheme.

9. Data Retention

We retain personal information for as long as your account is active or as needed to provide services. When an account is closed we delete or de-identify personal information within 90 days, unless we are required by law to retain it longer. Sensor telemetry data may be retained for longer periods as it constitutes operational records for your organisation.

10. Your Rights

Under the APPs you have the right to:

Access — request a copy of personal information we hold about you.
Correction — request that inaccurate or out-of-date information be corrected.
Deletion — request deletion of your personal information, subject to legal retention obligations.
Complaint — lodge a complaint with us, or directly with the OAIC (oaic.gov.au) if you are unsatisfied with our response.

To exercise any of these rights, contact us using the details in Section 12.

11. Changes to This Policy

We may update this policy from time to time. The current version is always available at thermasense.com.au/privacy/. We will notify registered users of material changes by email where practicable.

12. Contact Us

For privacy enquiries, access or correction requests, or complaints:

Southerndown Ventures Pty Ltd
6/828 High St, Kew East VIC 3102
Australia
Email: privacy@thermasense.com.au

We will respond to all enquiries within 30 days.