Privacy Policy
Timbre and Co. collects only what it needs to run its jobs, keeps it on servers in Sydney, encrypts it, and never sells it. This policy follows the Australian Privacy Principles.
1. What we collect
| What | For example | Why |
|---|---|---|
| Account details | Name, email, role, password (stored only as a one-way hash) | To sign you in and show who did what |
| Sign-in records | Time, IP address, browser and device type | To protect accounts and spot misuse |
| Work | Projects, tasks, comments, schedules, shoot locations, files and footage | To run the jobs |
| Clients and contacts | Names, businesses, emails, phone numbers, deals and quotes | To manage client relationships |
| Emails | Messages to and from our business mailboxes, linked to the jobs and people they concern | To keep each job's work in one place |
| Device settings | Light or dark theme, a remembered device, notification permission | To make the consoles work on your device |
2. How we use it
To deliver our work, contact people about their jobs, keep the consoles secure and meet our legal obligations. We do not sell it, and we do not use it for advertising.
3. AI processing
The consoles send the text of comments, emails and job details to Anthropic's Claude AI to suggest tasks, update dates and keep short job notes. Anthropic processes it under its commercial terms, and does not use it to train its models. People can see, change or undo what the AI does.
4. Who can see it
- Inside Timbre and Co. Staff and contractors see only what their role needs. An email is visible only to the people on it, and each person's calendar is theirs alone.
- Partners such as Fairy Tale Proposals see only the jobs they work on with us. A producer can preview a partner's console as its members see it, view only, and each preview is logged.
- Clients see only their own jobs, files, quotes and messages.
- Service providers that run the consoles for us: BinaryLane (our servers, in Sydney), our email providers, Anthropic (AI), Canva (documents), Google (fonts), Squarespace (our logo) and Open-Meteo (weather for shoot locations). Browsers' own services deliver push notifications.
- Others only when the law requires it.
Some of these providers store or process data outside Australia. We choose providers with appropriate safeguards.
5. How we protect it
- Encrypted in transit: every connection to the consoles uses HTTPS.
- Encrypted at rest: our data and files sit in an AES-256 encrypted vault on the server, and every nightly backup is separately encrypted with AES-256.
- Passwords are stored only as one-way hashes. Connected mailbox passwords are encrypted.
- A new device or network needs a code sent by email.
- Access is limited by role, and sign-ins are logged.
- The server's security is checked automatically every day.
6. How long we keep it
We keep job records for as long as we need them for the work and for legal and tax records (usually 7 years), then delete or anonymise them. Backups are kept for 30 days. Sign-in records are kept for 12 months.
7. Cookies
The consoles use only the cookies they need to work: one to keep you signed in, and small ones that remember your settings and the page you were on. There are no advertising or tracking cookies.
8. Your rights
You can ask to see or correct the personal information we hold about you, or ask us to delete it where we do not need to keep it. Email contact@timbreandco.com, or write to us at 2705/1 Paddock St, Lidcombe NSW 2141, Australia, and we will reply within 30 days.
9. Complaints
Email contact@timbreandco.com first. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
10. Changes
We will post any change here and tell account holders the next time they sign in.