Privacy Policy
Last updated: 6 November 2026
This policy explains how CAAN Consulting Pty Ltd (“we”, “us”) handles personal information collected through tableoneflow.com, the public demo, and the TableOne Flow desktop app and hosted service. It also covers people who are invited into a report by someone else.
We are preparing a getting-started email series. It is not active yet. The getting-started email and retention terms in this policy explain how it will work when offered.
What we collect
Most information comes from you, or is recorded when you use our website or TableOne Flow:
- Contact details and enquiries. Your email address, and anything else you give us when you register interest, make an enquiry, sign up for the demo or ask for support, such as your name, role and organisation.
- Your account. Your name, email address, organisation, role and seat, any professional details you enter, your notification preferences, and the version of our licence you accepted.
- What you do in reports. Your responses, comments, mentions, review decisions, sign-offs and consents (including the name you type), with the time of each.
- Sign-in, acceptance and seat records. When you sign in, use the demo, accept our licence, or sign off or give a consent in a report, we record your IP address and browser or app details. We also record who has held each seat, and changes to who can access what.
- Billing details for paid plans.
- Optional email choices. What you chose, the notice shown, when and how you chose it, any time zone you confirm for getting-started emails, and records of delivery and opt-out requests.
Some information comes from other people. If someone invites you to an organisation or a report, or names you as a Competent Person, they give us your name and email address, and we use them to send the invitation and the emails that follow from it.
How we use it
We use personal information to:
- provide TableOne Flow, including your account, signing in and the emails the product sends;
- keep each report’s record of who did what, for the organisation that holds the report;
- protect the service and investigate suspected misuse of an account;
- check that each licence is used by the people it was bought for, using sign-in and seat records;
- respond to enquiries and support requests, and invoice for paid plans;
- send product news and getting-started guidance to people who choose them;
- meet our legal obligations.
We share personal information with the service providers listed below, with the organisation that holds a report you take part in, and where the law requires. We do not sell personal information.
Information in reports
Organisations decide what goes into their reports, including information about other people, such as Competent Persons. We hold that information for the organisation under our Customer Licence, and we will refer any request about it to that organisation. If you take part in a report, what you do is recorded in that report’s history, which the organisation keeps.
Where it is held, and who helps us
Our main service providers are:
| Provider | What it does | Where |
|---|---|---|
| Amazon Web Services | Hosts the hosted service and stores its data | Sydney, Australia |
| Cloudflare, Inc. | Hosts this website, its forms and the public demo | United States, and other countries where it operates |
| Resend | Sends product emails, such as sign-in links, invitations and notifications, which can include a report’s name. It will also send the getting-started series when offered. | United States |
| Brevo (Sendinblue SAS) | Handles our website’s registration and enquiry forms, and sends marketing emails to people who asked for them | France |
If you sign up for the demo, your details go to Brevo only if you ask for product news; otherwise they are emailed to us.
Personal information is therefore likely to be disclosed to recipients in the United States and France, and may be handled in other countries where Cloudflare operates. Our providers remain subject to the laws of the countries where they are established.
How long we keep it
We keep personal information while we need it for the purposes above or the law requires it, and then delete or de-identify it. In particular:
- Report content. After an organisation’s licence ends, we keep its report content for the export window in our Customer Licence, and may then delete it.
- Records of change. Records of changes to accounts, organisations, seats and access, and of licence acceptance, are kept for the life of the organisation’s account plus 7 years.
- Getting-started email evidence. For this series, we keep the minimum record of permission and emails sent under it for six calendar years after that permission ends or we last rely on it, whichever is later. The minimum record of a stop request made through the series is kept for six calendar years after the request or any later relevant send. These are our retention periods; a legal hold may require longer retention.
- Respecting your email choices. We keep the record needed to respect a refusal or withdrawal while we could otherwise send optional emails to that address. A limited record also prevents us repeating a getting-started series. We do not use these records to contact you.
- Getting-started email delivery records. Unsubscribe-link records expire after 90 days. We clear the encrypted address and copies of resolved messages when the series ends. Full delivery records, including copies of messages whose delivery is unconfirmed, are normally removed 90 days after the series ends or the latest recorded send activity, whichever is later. A minimal record of attempted messages and uncertain outcomes remains to prevent repeating the series. We keep the details needed for unfinished opt-out work until our email providers confirm it. A legal hold can delay removal.
How we protect it
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure.
Optional emails
When offered, you may choose up to two getting-started emails over two weeks when accepting our licence. These provide product guidance and are optional. Our optional emails, including product news, include a stop or unsubscribe link that needs no account or password. You can also opt out through our support form.
Signing in again or accepting the licence does not cancel an earlier opt-out. Necessary security, sign-in, access and workflow emails are separate.
Access, correction and complaints
You can ask for access to the personal information we hold about you, or ask us to correct it. You can also ask us to delete it, and we will where we can, except for records that are part of an organisation’s report (which we will refer to that organisation) and records we keep for a period stated above. There is no charge for making a request, and we may need to confirm your identity first.
To complain about how we have handled your personal information, contact us as below and say that it is a privacy complaint. We will look into it and reply in writing.
We aim to respond to requests and complaints within 30 days.
Cookies
Our website’s analytics (Cloudflare Web Analytics) do not use cookies. The security check on our forms may set a short-lived functional cookie.
Contact us
For privacy requests, complaints and questions about this policy, use our support form and start your message with the word Privacy.
CAAN Consulting Pty Ltd · ABN 80 696 734 693 · ACN 696 734 693
Changes to this policy
We may update this policy. The date at the top shows when it last changed.