ShedHive Privacy Policy Draft

Draft dated 12 October 2026. This policy is prepared for William Thomas Creative, ABN 45 604 711 840, operator of ShedHive at shedhive.au. Contact: [email protected].

This draft must be checked against the actual service providers, retention practices and legal identity before public registration opens. It is not a statement that those arrangements have already been implemented.

What information we collect

ShedHive uses your name, email address, account credentials, email verification details and security settings to provide your account. It keeps your membership and role in each shed, notification preferences, job requests, messages, quote acceptance and records of payments entered by shed managers. It also keeps projects, event details and shed information supplied by authorised managers.

For security and troubleshooting, the service may collect IP addresses, browser information, request times, authentication activity and records of administrative changes. Passwords are stored as hashes; authentication secrets are protected separately. ShedHive does not need payment card details to record payments made at a shed. Do not put card numbers, passwords, medical information or identity documents in messages or job requests.

ShedHive is not designed as a health record service. If a shed needs health or emergency information for its own activities, it must explain that collection separately and obtain any required consent. Additional sensitive-information features require a separate privacy assessment before they are introduced.

Why we use information

We use information to authenticate accounts, process shed membership requests, provide shed workspaces, deliver communications, manage job workflows, display approved public content, keep accurate operational records and prevent misuse. You can turn optional shed updates off for each membership. Necessary account, security and service communications may still be sent.

If you do not provide the information necessary for an account or a requested job, we may be unable to provide that function. You can browse public shed information without joining a shed. Where lawful and practical, you may ask a shed about participating without an online account or using a preferred name.

Who can see it

Each shed manager can access the information needed to manage membership and work in that shed. Joining one shed does not automatically give its managers access to your records in other sheds. A manager may see your account name and email address for membership administration. Messages are available to their conversation participants; ShedHive may access records where necessary to investigate security incidents, resolve support requests or meet legal obligations.

Platform administrators have privileged operational access. That access must be restricted, secured and used for a legitimate platform purpose. We may disclose information to service providers that operate hosting, security, email delivery and backups, to professional advisers where necessary, and to authorities where legally required or permitted. We do not sell personal information.

A public project or event is visible to anyone and may be indexed or copied by others. Managers must obtain permission for identifiable photos, names or stories before publishing them. Membership, private messages and job requests must not be published as public showcase content.

Hosting and overseas handling

Cloudflare provides DNS, network security and tunnel services and may process traffic and security information through its global infrastructure. Application hosting is being configured on a CloudPanel server. Before launch, the operator must document the server's location, email and backup providers, their overseas processing locations where practicable, and applicable safeguards. No promise that all information remains in Australia is made by this draft.

Where Australian Privacy Principle 8 applies, overseas disclosures must be assessed and managed in accordance with that principle. Using an overseas provider does not remove obligations that otherwise apply to us.

Cookies and installed apps

ShedHive uses session and request-security cookies to keep you signed in and protect forms. The initial PWA stores only static interface assets and an offline notice; it does not cache private shed records or authentication responses for offline use. Sign out on shared shed computers. Optional analytics or advertising trackers require a separate decision and appropriate disclosures before introduction.

Security and retention

Security measures include role-based access, shed-scoped permissions, password hashing, two-factor authentication for management access, encrypted sessions, HTTPS, request throttling and audit records. No system can guarantee absolute security.

We retain information only while needed for the purpose for which it was collected, legal obligations or a justified dispute or security need. Account closure may require removal or de-identification of personal details while preserving necessary business records. Backup copies may remain until their scheduled rotation. Before launch, the operator must adopt a documented retention schedule covering inactive accounts, messages, job/payment records, security logs and backups; this draft does not invent a fixed retention period.

Access correction and account closure

Email [email protected] to request access to or correction of your personal information, account closure, or assistance with notification settings. We may reasonably verify your identity before acting. We aim to respond within 30 days. If access or correction is refused where the law permits, we will explain the reasons and available complaint options. Tell us which shed is involved so we can direct requests concerning that shed's independently held records.

Privacy complaints and incidents

Send privacy complaints to [email protected] with enough detail for us to investigate. We aim to acknowledge complaints within seven days and respond within 30 days. If more time is needed, we will explain why. Where applicable, you may complain to the Office of the Australian Information Commissioner through its privacy complaint process.

If a suspected data breach occurs, we will assess and contain it. Where the Notifiable Data Breaches scheme applies and notification is required, we will notify affected individuals and the OAIC as required by law.

Changes

We will publish the current policy with its effective date and explain material changes through an appropriate service notice. A change in policy does not retrospectively authorise a new use of information that requires consent.