Privacy Policy

1. Who We Are

ShareAndGo is a product of NT Development Group Pty Ltd (ABN 41 660 399 020), an Australian company. We operate from Darwin, Australia. When we say "we", "us", or "our", we mean NT Development Group Pty Ltd.

2. Information We Collect

We collect information you provide directly:

• Account information (name, email address, organisation name)
• Documents you upload to data rooms
• Communications with our support team

We automatically collect:

• IP addresses and browser information for security audit logging
• Usage data (pages visited, features used) via Google Analytics
• Document access times and durations for audit trails

3. How We Use Your Information

• To provide and maintain the ShareAndGo service
• To verify your identity when accessing data rooms
• To generate tamper-evident audit trails for compliance
• To send transactional emails (access invitations, verification codes)
• To process payments via Stripe (we do not store card details)
• To improve the service through aggregated, anonymised analytics

4. Data Sovereignty

Your documents and their contents — including all storage, backups and AI search/OCR processing — are stored and processed exclusively in Australia (Google Cloud Platform, Sydney region: australia-southeast1). Your documents never leave Australian infrastructure, and all data is encrypted at rest (AES-256) and in transit (TLS 1.2+).

Limited operational metadata is processed by vetted subprocessors, some located overseas, solely to deliver the service: outbound email via SendGrid (e.g. recipient email address, subject and message body of an invitation), SMS notifications via Twilio (recipient phone number), and payment processing via Stripe (billing details). These providers process that metadata overseas under data processing agreements and handle delivery and billing metadata only, never your document content. We disclose this cross-border processing so our APP 8 position is precise rather than absolute.

AI features (document OCR, summaries, tagging, PII detection, Q&A and semantic search) are performed by Google Vertex AI in the Sydney region (australia-southeast1); we do not use your documents to train any model. If you choose to connect an external AI assistant (for example Claude or ChatGPT) to a data room via our optional MCP connector, the document content you expose to it is transmitted to that provider and processed under that provider's own privacy policy, which may be outside Australia. This egress is initiated by you and is off by default.

5. Data Sharing

We do not sell your personal information. We share data only with:

• Service providers: Google Cloud Platform, Sydney (hosting, document storage, database, and Vertex AI for OCR, search and summaries, all in australia-southeast1), SendGrid (email delivery), Twilio (SMS delivery), Stripe (payments), all bound by data processing agreements
• Data room participants: When you share a data room, invited participants can view documents you have granted them access to
• Legal requirements: When required by Australian law or valid legal process

6. Data Retention

We retain your account data for as long as your account is active. Documents in data rooms are retained according to the data room owner's settings. Audit logs are retained for 7 years to meet Australian regulatory requirements. You can request deletion of your account and associated data at any time.

7. Your Rights

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Complain to the Office of the Australian Information Commissioner (OAIC)

8. Cookies

We use essential cookies for authentication and session management. We use Google Analytics (GA4) for anonymised usage analytics. We do not use advertising or tracking cookies.

9. Contact

For privacy enquiries, contact us at [email protected]