Privacy Policy

Last updated: 7 July 2026

⚠️ This policy is a working draft tailored to how Besky actually handles data. Have it reviewed by a qualified Australian privacy lawyer before public launch.

This Privacy Policy explains how [LEGAL ENTITY NAME] (ABN [ABN]), trading as Besky (“Besky”, “we”, “us”), collects, uses, and protects your information. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

What we access in your inbox

When you connect Gmail or Outlook, you grant Besky a read-only connection. We can read messages to find order confirmations. We cannot send, delete, or modify email, and we do not access your contacts. We look only at messages that appear to be retailer order confirmations; other email is not our purpose.

What we collect

Account identity: the email address of the mailbox you connect. It is stored encrypted and as a one-way hash — never in plaintext.
Access tokens: the OAuth tokens from Google/Microsoft that let us read your mail. Stored encrypted at rest.
Purchase data: products, prices, retailers, and order dates extracted from your order-confirmation emails.
Product & price data: public retailer listings we match your purchases against to track prices.
Consent & audit records: what you agreed to and when, and security-relevant events.

How we use it

To identify what you’ve bought and monitor those products’ prices.
To alert you when a price drops while you can still act.
To operate, secure, and improve the service.

We do not sell your personal information, and we do not use your email content for advertising.

How we protect it

Email addresses and OAuth tokens are encrypted at rest. Access to systems that can decrypt data is restricted. We retain data only while your account is active or as needed to provide the service.

Gmail and Outlook connections are read-only. Besky cannot send, delete, or change your email.
Besky does not store raw email bodies; it stores structured purchase details derived from order confirmations.
Disconnecting your inbox stops future scans and can be used to delete the purchase details derived for your account.

Third parties

We use Google and Microsoft (mail access), and infrastructure and processing providers, to run Besky. Besky’s use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Providers may process data on our behalf under contract; they are not permitted to use it for their own purposes.

Your choices & rights

Disconnect any time from Settings — this revokes our access.
Delete your data: email privacy@besky.com.au and we will delete your account and associated data.
You may request access to, or correction of, the personal information we hold about you.
You can revoke Besky’s access directly from your Google or Microsoft account security settings.

Contact

Privacy questions or complaints: privacy@besky.com.au. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

Changes

We may update this policy; material changes will be reflected in the “last updated” date above.