Privacy policy

AllNow (app.allnow.com.au) is operated by Cortex Digital Pty Ltd("we", "us"), an Australian company. This policy explains what information we collect, why, where it lives, and how you can have it deleted. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Effective date: 3 November 2026.

About AllNow

AllNow is a business intelligence dashboard. Your organisation connects the systems it already uses, such as accounting, advertising, rostering, point of sale and CRM platforms, and AllNow displays that data back to your own team in one private dashboard.

Information we collect

• Account information. Your name, email address and role, given when your organisation invites you or when you sign up yourself. If you sign in with Google or Microsoft, we receive your name and email address from them. If you choose text message codes for 2-step verification, we keep your mobile number.
• Workspace planning answers. When you plan a workspace at app.allnow.com.au/start: your work email address, your name, your business's industry and size, the systems it uses, and the names, roles and email addresses of colleagues you add.
• Workspace requests. The workspace name and web address you choose, and the email address you confirmed with a code.
• Agreements to our terms. When you agree to our terms of service: your account, the versions of the terms and of this policy you were shown, and the time.
• What you tell Allan. Your chats with Allan, the dashboard's assistant, anything you ask it to remember for you, and your feedback on its alerts. In a workspace created through AllNow sign-up we also record what each chat cost to answer, which is how a free trial's monthly chat allowance is applied.
• Connected service data. Business data from services your organisation explicitly connects, for example invoices and payroll from your accounting platform, campaign spend and delivery metrics from your advertising accounts, rosters and timesheets from your workforce platform. We only receive what the connected provider makes available under the access your administrator grants.
• Usage information. Product analytics about how the dashboard is used, collected in a privacy-hardened configuration (no session recording, no cross-site tracking), and error reports when something breaks.

How we use your information

For one purpose: showing your organisation its own data in its own dashboard. We do not sell personal information, we do not use your business data to train models, we do not advertise to you, and we never show one customer's data to another. Each organisation's data is kept separate from every other organisation's.

Advertising platform data

When your administrator connects a Meta or Google Ads account, we read campaign-level performance metrics (such as spend, impressions and clicks) using the access you grant through that provider's own consent screen. This data is displayed only to authorised users of your organisation's dashboard. We do not create or modify ads, and we do not share this data with any third party.

Meta Platform Data. Data received from Meta is used solely to provide the reporting features your organisation requested, is not sold or licensed, and is deleted when you disconnect the integration or when Meta requires it.

Google user data (Limited Use). AllNow's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use Google user data only to provide the reporting features visible in your dashboard, we do not transfer it except as necessary to provide those features or as required by law, we do not use it for advertising, and we do not allow humans to read it except with your permission, for security purposes, or as required by law.

Where your data is stored

Your account, workspace planning answers and your organisation's data are stored in Australia (AWS ap-southeast-2, Sydney). A few services we use process data outside Australia: error reports (Sentry) and product analytics (PostHog) in the United States, emails (SendGrid) and text messages (Twilio) through the United States, the security check on our sign-up and sign-in forms (Cloudflare) on its global network, and card and direct debit payments (Stripe). Credentials for connected services are encrypted at rest with AES-256-GCM; the encryption keys are held separately from the stored data. Access within our systems is role-restricted and audited.

Subprocessors

Only infrastructure subprocessors, and only to run the product: database and authentication hosting (Supabase), application hosting (Vercel), cloud infrastructure (Amazon Web Services), transactional email (SendGrid, Twilio), error reporting (Sentry), privacy-hardened product analytics (PostHog), form security checks (Cloudflare), AI models for Allan, Ask and chat (Anthropic's Claude models, run on Amazon Bedrock) and payments (Stripe). We do not sell, rent or trade personal information.

Retention and deletion

• Connected service data is kept while the connection is active so your dashboard stays current. Disconnecting a service deletes its stored credential immediately and stops all further collection.
• Workspace planning answers are deleted 30 days after your last change. If you sign in to create a workspace from them, we keep a copy, without colleagues' email addresses, until the workspace is created or your request is turned down. If you stop before then, the copy stays until you delete your account or ask us to delete it.
• Workspace requests keep your email address and the workspace name while the workspace exists, and a request that is turned down or fails keeps them until you delete your account or ask us to delete them. After that the request still keeps the workspace's web address, the ids that tied it to your account and plan, and a one-way fingerprint of your email address, so the same address cannot open a second workspace. The agreement to our terms recorded with a request is deleted when its email address is.
• Your account is kept until you delete it. Delete it yourself at Settings, Profile & password, Delete my account, or at app.allnow.com.au/account/delete. Deleted straight away: your sign-in, your access to every workspace, invitations to your email address if you proved it is yours (with an emailed code, or a Google or Microsoft sign-in that verified it), your notification, alert and dashboard settings, custom panels you built, what you asked Allan to remember for you and your feedback on its alerts, your chats with Allan in workspaces created through AllNow sign-up, your workspace planning answers, requests and agreements to our terms, and the Google account you connected for sending email. If a chat cannot be removed straight away, we tell you, keep trying, and finish deleting your account, sign-in included, automatically once it is gone. If you are the only owner of a workspace, or created one that is still open, close it at Settings, Close workspace, or ask us to move it to another owner first. A closed workspace does not stop you deleting your account.
• A closed workspace is locked to everyone the moment its owner closes it at Settings, Close workspace: Xero is disconnected and its Xero figures deleted, Allan, alerts and digests stop, and nothing more is charged after the period already paid. Its owner can reopen it for 30 days. After that we delete the workspace and its data. If it ever paid, or another service is still connected to it, our team deletes it once billing and that connection are settled.
• Kept after deletion: our security log of actions taken with your account and any deletion request you sent us, which include your email address; Allan notes you wrote for the whole workspace, which stay with that workspace; what each of your chats cost to answer, without your account, so a trial workspace's monthly chat allowance stays as it was; a record, by an internal id with no name or address, that your chats were erased, so none is saved again; your chats with Allan in a workspace our team set up for your organisation, which stay with that workspace; in a workspace whose data store is paused or retired, the Google account you connected for sending email, your dashboard settings and your custom panels, which nothing reaches until the store is restored or deleted; and records the law requires us to keep.

You can also ask us to delete stored data, your account or your organisation's whole workspace; see our data deletion instructions. We complete deletion requests sent to us within 30 days.

Your privacy rights

You may request access to, correction of, or deletion of your personal information at any time. If you believe we have mishandled your information you may complain to us, and if unsatisfied, to the Office of the Australian Information Commissioner (oaic.gov.au).

Privacy contact

Privacy questions and requests: privacy@allnow.com.au. We respond within 5 business days.

Changes to this policy

If this policy changes materially we will notify administrators of connected organisations by email before the change takes effect.