Privacy policy

1. Who we are

Cross Angle Australia Pty Ltd (ABN 59 665 279 863), trading as Halftonik ("Halftonik", "we", "us") makes online software for screen printers, embroiderers, DTF and other decoration shops. This policy explains how we handle personal information, following the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). We follow the APPs for all the personal information we hold, whether or not the Act applies to a business of our size.

2. Two roles

Information about our own customers. When a shop signs up, we collect details about the shop and the people who use Halftonik there. We decide how this information is used, and we're responsible for it under this policy.

Information shops keep about their customers. Shops use Halftonik to keep their own customers' details: names, contact details, addresses, orders, artwork, messages and payments. This includes people who order through a shop's order page, club or school store, customer portal or product presentation, and people a shop texts or emails. The shop decides what it keeps and why, and the shop is responsible for it. We store and handle it only to run Halftonik for that shop, as set out in our customer data terms. If you're a shop's customer, please contact the shop first about your information. If you can't, contact us and we'll pass your request on and help where we can.

3. What we collect

• Early access requests: when you ask for early access on our website, your name, shop name, email, phone (if you give it), what your shop decorates, how many people work there and any message, with a scrambled (salted hash) version of your internet address to stop floods. Our team adds its own notes and where the request is up to. If we invite you, we keep when the one-time sign-up link was made and used, and only a scrambled version of the link itself.
• Account details: name, email address, role in the shop and what that role is allowed to do (such as whether you see every job or only your own), password (stored only as a one-way scrambled value we can't read back) and two-step sign-in settings.
• Business details: shop name, trading names, ABN, address, phone, website, logo, and the bank details a shop chooses to print on its invoices.
• Billing: plan, number of users, subscription and payment history, and tax invoices. Card details go straight to Stripe; we never see or store card numbers.
• Security and usage: when and from where people sign in (internet address and browser type), the devices that are signed in, and an activity log of important changes in each shop, such as who sent a quote or changed a price. When a customer approves a quote or proof, we record their name, internet address and browser with the approval, as a record of what was agreed. On order pages, stores, portals and presentations we keep only a scrambled (salted hash) version of the visitor's internet address, to stop floods and misuse.
• Messages: what you send us when you ask for help, and emails and texts sent through Halftonik, with whether they arrived or bounced. When a customer or supplier replies to a shop's email, we receive the reply (who sent it, the subject, the text and any attachments) and keep it on the job, and, if the shop asks, send the shop a copy. Automatic replies such as out-of-office notices and emails with a virus are thrown away.
• Suppliers' links: when a shop sends a purchase or work order, its supplier can get a link to the order: what's ordered, the shop's delivery address, the shop's costs on that order and its job numbers, and for work sent out, the artwork the customer approved. We keep what the supplier sends back (their name if they give it, messages, delivery status, tracking numbers and expected dates), how often the link was opened, and a scrambled version of their internet address to stop floods. Suppliers never see the shop's customers' names or the shop's selling prices.
• Sending addresses: when a shop sends from its own address, the address and the records the shop adds to its domain, which we check against the internet's public address book.
• Connections: when a shop connects another service, such as Xero, QuickBooks, Stripe, Shippit or an online store, the keys or sign-in that service gives us. These are locked (encrypted) and never shown again.

Most of this comes straight from you. Some comes from the services a shop connects, and some is recorded automatically as Halftonik is used. If you don't give us the details we ask for, we may not be able to set up or run an account.

4. How we use it

• To run Halftonik: signing people in, showing and saving their work, and sending what they ask us to.
• To keep accounts and the service secure, and to prevent fraud, spam and misuse.
• To bill shops and issue tax invoices.
• To send service emails, such as sign-in links, invites to join a shop's team (sent to the address the owner or admin typed), receipts, payment problems, security alerts and important changes to Halftonik or these policies.
• To answer questions, help with problems and fix faults.
• To reply to early access requests: to get in touch about Halftonik, decide who to invite next and send the invite. Our team is told about each new request by email.
• To understand which parts of Halftonik are used, from our own records, so we can improve it. We don't use outside analytics or tracking services.
• To meet our legal obligations, such as keeping tax records.

We don't sell personal information. We don't use it for advertising, and we never send marketing to shops' customers. If we send account holders news about Halftonik, every such email has a working unsubscribe link.

5. AI help

Some features use AI to draft things, such as a quote from a customer's email, a reply to a customer, or an artwork check. When someone in a shop uses one, the text or artwork they choose is sent to Claude, made by Anthropic, through Amazon Bedrock, using Amazon's Australian locations only. A quote draft also sends a short list of the shop's own garments (style codes, names and colours) so the right ones are picked; it holds no customer details. Ask, in the app's Help menu, sends the question someone types with a few of our own help articles, and shows a short answer; it sends no shop or customer records, and we don't keep the question. Amazon doesn't keep any of it after producing the answer, and it isn't used to train AI. Every AI draft is checked by a person before anything is sent, and prices come from the shop's own price lists, not from the AI. Each shop gets up to 1000 AI uses a month, depending on its plan, and an owner or admin can switch AI help off in Shop details.

6. Automated decisions

We don't use computer programs to make decisions that significantly affect people's rights or interests, and AI is never used to decide anything about a person. A few safety checks happen automatically:

• Too many wrong sign-in attempts, or too many orders from one place in a short time, are blocked for a while. These checks use the scrambled internet address and the email address or phone number entered.
• If an email address bounces or its owner marks an email as spam, or someone replies STOP to a text, we stop sending to that address or number.

If you think one of these checks has blocked you by mistake, email support@halftonik.com and a person will look at it.

7. Who we share it with

We use these service providers to run Halftonik. Each can only use the information to provide its service to us:

• Amazon Web Services (Australia): hosting, databases, file storage, backups, sending and receiving email, text messages and AI help.
• Stripe (Australia and the United States): our subscription billing, and card payments into a shop's own Stripe account.
• Hostinger, our email provider, for the support@halftonik.com inbox. It stores email in its own data centres, which may be outside Australia.

When a shop connects another service, Halftonik sends that service what's needed, on the shop's instruction: the shop's accounting system, such as Xero or QuickBooks (invoices, customers and payments), Shippit (delivery names, addresses and parcel details), Zapier (the events the shop chooses), or reads orders from the shop's online store (Shopify, WooCommerce, BigCommerce, Squarespace or Wix). Those services handle the information under their own privacy policies, and may do so outside Australia.

We may also share information when the law requires or allows it, such as to a court or regulator, to protect someone's safety, or if the business is sold, in which case the buyer must keep to this policy.

8. Outside Australia

We store Halftonik's information in Australia. Information is likely to be disclosed outside Australia in these cases:

• to Stripe, in the United States, for card payments and billing;
• to Hostinger, our email provider, if you email us, which may store email in Europe, the United States or elsewhere;
• to services a shop chooses to connect, which may be in the United States, Canada, New Zealand, the European Union, Israel or elsewhere, depending on the service.

We choose providers with strong security and privacy commitments, and we only send what each needs.

9. Keeping it safe

• Information is encrypted while it travels and where it's stored.
• Each shop's information is kept separate by the database itself, so one shop can't see another's.
• Owners and admins must use two-step sign-in, and people only see what their role allows.
• Keys for connected services are encrypted and tied to the shop. Customer links, sign-in links and API keys are stored only as one-way scrambled values.
• Our team doesn't look at a shop's information unless the shop asks us to help, or we need to, to keep the service secure or because the law requires it. For help, a shop's owner can let our support team see the shop for 24 hours from Settings, Security. While it's on, support sees the shop's settings, team, counts and recent activity, read only, never card or bank details, and each look is recorded in the shop's activity log.
• Our own team console shows each shop's plan, trial, billing status and how much it uses, not its customers or jobs. It needs two-step sign-in, and everything our team does in it is recorded and can't be changed. When we change a shop's trial, plan or credit, the shop's activity log says so.

Read more on our security page. If a data breach is likely to result in serious harm, we'll tell the people affected and the Office of the Australian Information Commissioner (OAIC), as the Notifiable Data Breaches scheme requires. If it involves a shop's customer information, we'll tell the shop without undue delay, and within 72 hours, and help it do the same.

10. How long we keep it

• We keep a shop's information while its account is open. If a trial ends or a plan lapses and isn't restarted, we keep it for 12 months in case the shop comes back, then email the owner and delete it 30 days later.
• When a shop closes its account, it has 30 days to download its information or ask us for a copy. We then delete it, except what the law requires us to keep, such as tax invoices and payment records, which we keep for 5 years.
• Deleted information stays in our backups for up to 35 days, earlier versions of files for up to 90 days, and server logs for up to 30 days, and is then gone.
• Replies arrive in a locked (encrypted) mailbox that empties itself after 7 days. Once a reply is on the job, it's kept with the shop's other records.
• Early access requests are kept while we're working through them, and for no more than 2 years after the last time we were in touch. Ask us and we'll delete yours sooner. If you sign up, your request stays with your account's records.
• Support emails are kept for as long as they're useful, and no more than 2 years after the account closes.

11. Cookies and browser storage

We use only the cookies Halftonik needs to work: a few to keep you signed in, including during two-step sign-in, one for a shop's customer portal (only on that shop's portal pages), and a short-lived one while you connect an accounting system. We also keep a note in your browser of which updates you've seen. We don't use advertising, analytics or tracking cookies, and we don't let other companies place them.

12. Children

Halftonik is for businesses, and people using it must be 16 or older and using it for work. Shops sometimes keep children's details, such as names for a school or sports club order. Shops are responsible for having the right to do so, and we protect that information like everything else.

13. Seeing or correcting your information

You can see and change most of your information in Halftonik. To ask for a copy, a correction or deletion, email support@halftonik.com. We'll confirm who you are, then reply within 30 days, without charge. If we can't do what you ask, we'll tell you why and how to complain.

14. Complaints

If you're unhappy with how we've handled personal information, email support@halftonik.com or write to us at 3/34 King William Street, Broadmeadows VIC 3047, Australia. We'll confirm we've got it within 7 days and give you our answer within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

15. Changes to this policy

We review this policy at least once a year and when how we handle information changes. The date at the top shows the latest version, and we email shop owners about important changes at least 30 days before they apply.