Privacy Policy
Effective Date: 18 August 2026 (supersedes the version dated 24 April 2026)
1. Who We Are and What This Policy Covers
This Privacy Policy explains how doculatch.com (“Website” or “Platform”), operated by DocuLatch, a service of Shantallow Partners Pty Ltd and Laguna Media (“we”, “us”, or “our”), collects, uses, discloses, and protects personal information.
We are based in Queensland, Australia, and handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (“APPs”). Where the EU or UK General Data Protection Regulation (“GDPR”), Singapore’s Personal Data Protection Act (“PDPA”), or other local laws apply to you, we also comply with those laws to the extent they apply.
DocuLatch provides a pay-to-unlock document delivery service. A vendor uploads a document, sets a price, and shares a private link. A buyer pays through our payment processor and the document is released automatically. This Policy applies to both vendors and buyers, and to anyone who visits the Website. It does not apply to third-party websites we link to.
Contact for privacy matters: contact form Entity: Shantallow Partners Pty Ltd, ABN 75 495 300 172
2. Anonymity and Pseudonymity
Where practicable, you may deal with us anonymously or under a pseudonym, for example, general enquiries through our contact form.
This is not practicable for vendor accounts. We cannot process payments, remit funds, meet our tax and anti-fraud obligations, or provide support without identifying you.
Buyers are not required to create an account. To complete a purchase we need an email address to deliver the receipt and the download link, and our payment processor requires payment details.
3. Information We Collect
3.1 Vendor account information
- Full legal name or registered business name
- Email address and, where provided, telephone number
- Business details and website address
- Login credentials (passwords are stored hashed, never in plain text)
- Payout details required by our payment processor to remit funds to you
3.2 Buyer information
- Email address
- Payment status and transaction reference
- Payment method details, which are collected and held by our payment processor. We do not store full card numbers on our systems.
We disclose the buyer’s email address and payment status to the vendor whose document was purchased, so that the vendor has a record of the sale and can provide support. Buyers should be aware that completing a purchase identifies them to the vendor.
3.3 Documents you upload
Vendors upload documents which may contain personal information about their own clients, names, addresses, property or financial details, valuations, assessments, and similar material.
This is personal information about your clients, not about you. Our role in relation to it is set out in clause 5.
We hold the document title, description, price, file size, and format as ordinary account data. We do not index, read, or analyse the contents of uploaded documents.
3.4 Transaction records
- Sales, refunds, chargebacks, and commission calculations
- Download events, including the date and time a document was released
- Invoices and remittance records
3.5 Technical and usage data
Collected automatically when you use the Website:
- IP address, approximate location derived from it, browser type, operating system, and device identifiers
- Login times and session activity
- Pages and features accessed
- Referring URLs and error logs
- Cookie and similar identifiers (see clause 8)
We log this data for security, fraud detection, abuse prevention, and service improvement.
3.6 Communications
Support enquiries, correspondence, and any feedback you provide.
3.7 Sensitive information
We do not seek sensitive information as defined by the Privacy Act 1988 (Cth). Please do not enter health information, or information about racial or ethnic origin, religious beliefs, or sexual orientation, into free-text fields such as document titles or notes to buyers.
4. Why We Use Your Information, and Our Legal Basis
| Purpose | Legal basis (GDPR, where applicable) |
|---|---|
| Create and operate vendor accounts | Performance of a contract |
| Store uploaded documents and control access to them | Performance of a contract |
| Process payments, release documents, and remit funds to vendors | Performance of a contract |
| Issue receipts, invoices, and remittance advice | Performance of a contract; legal obligation (tax and accounting) |
| Provide support and send service notices | Performance of a contract |
| Security, fraud prevention, and detection of unauthorised access or link sharing | Legitimate interests |
| Improve the Platform, fix faults, and analyse aggregate usage | Legitimate interests |
| Send optional product news and updates | Consent (you may withdraw at any time) |
| Comply with legal, regulatory, and record-keeping obligations | Legal obligation |
We do not use your personal information, or the contents of uploaded documents, to train machine-learning or artificial-intelligence models, and we do not use it for automated decision-making producing legal or similarly significant effects.
5. Documents You Upload – Your Role and Ours
For documents a vendor uploads, the vendor is the controller (or, under Australian law, the entity responsible to the individuals concerned) and we act as a processor and service provider on the vendor’s behalf.
Vendor responsibilities:
- Obtaining any consent needed to collect, use, and disclose the information in the documents you upload
- Providing your own clients with your own privacy notice
- Complying with the privacy laws applicable to you, including the APPs, GDPR, PDPA, or other local law
- Ensuring you are entitled to sell or distribute the material you upload
- Maintaining the confidentiality of your account credentials and controlling who receives your private links
- Responding to your own clients’ access, correction, and deletion requests
Our undertakings:
- We process uploaded documents only to provide the Platform, to comply with law, and on your instructions
- We do not open or read the contents of uploaded documents except where necessary for support you have requested, to maintain or repair the service, to investigate a suspected breach of our Terms or a report of unlawful content, or where required by law
- We do not sell, share, or use uploaded documents for our own commercial purposes
- We apply the security measures in clause 10
- We will notify you without undue delay if we become aware of a breach affecting your documents, so that you can meet your own notification obligations
If you require a formal data processing agreement or GDPR Article 28 terms, contact us.
6. Disclosure of Information
We do not sell personal information.
We disclose information only to:
- Our payment processor, to take payment from buyers, calculate commission, and remit funds to vendors. The processor is an independent controller of the payment data it collects and handles it under its own privacy policy.
- The vendor, where you are a buyer — specifically your email address and the status of your payment.
- Service providers who help us operate the Platform: cloud hosting and file storage, content delivery, email delivery, analytics, and error monitoring. These providers are bound by contract to handle data securely and to use it only for the services they provide to us.
- Professional advisers, our accountants and lawyers, where necessary.
- Legal authorities, where required or authorised by law, or to establish, exercise, or defend legal claims.
- A successor entity, in the event of a merger, sale, or restructuring, subject to the acquirer being bound by this Policy.
A current list of our material service providers is available on request.
7. Direct Marketing
We may send service messages, receipts, payout notices, security alerts, downtime notifications, and changes to terms. These are part of the service and cannot be opted out of while you hold an account or have a transaction in progress.
Optional product news and promotional messages are sent only with your consent. Every such message includes an unsubscribe link, and you may opt out at any time by using it or by contacting us. We comply with the Spam Act 2003 (Cth).
Buyers are not added to a marketing list as a result of a purchase, and vendors must not use buyer email addresses obtained through the Platform for marketing without the buyer’s consent.
8. Cookies and Similar Technologies
We use:
- Strictly necessary cookies — to authenticate vendors, keep you logged in, maintain session security, and carry a purchase through checkout. The Platform will not function without these.
- Preference cookies — to remember your settings.
- Analytics cookies — to understand aggregate usage and improve the Platform.
Where required by law, we ask for your consent before setting non-essential cookies, and you may change or withdraw that choice at any time through the cookie settings link on the Website. You can also block or delete cookies through your browser, though this may prevent you logging in or completing a purchase.
We do not use cookies for third-party advertising or cross-site tracking.
9. Data Storage and Location
The Platform is hosted on cloud infrastructure, and content is delivered through a content delivery network. Uploaded documents, account data, and backups may be stored or processed on servers located outside Australia, including in [INSERT: primary storage region — e.g. United States (Oregon)].
Our payment processing, email delivery, and analytics providers may also process data outside Australia.
Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs, including through contractual protections. For transfers of EU or UK personal data outside those jurisdictions, we rely on Standard Contractual Clauses or another approved transfer mechanism.
10. Security
We take reasonable technical and organisational measures to protect information, including:
- Encryption of data in transit (TLS) and encryption at rest where supported by our infrastructure
- Hashed password storage
- Documents held in private storage that is not publicly listable or directly addressable; a download is issued only after entitlement is validated
- Role-based access controls, with internal access limited to personnel who need it
- Session controls, activity logging, and monitoring for anomalous access
- Automatic backups, held securely and restricted in access
- Regular software and platform updates
Vendors are responsible for choosing a strong, unique password, keeping credentials confidential, not sharing accounts, and exercising care over who receives their private links. Notify us immediately if you suspect unauthorised access.
No system is completely secure, and we cannot guarantee absolute security.
11. Data Breach Notification
If a data breach occurs that is likely to result in serious harm, we will assess it promptly and notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth), and any equivalent obligation under the GDPR or PDPA.
Where the breach affects documents a vendor has uploaded, we will notify that vendor without undue delay so that they can meet their own obligations to the individuals concerned.
12. Data Retention
| Data | Retention period |
|---|---|
| Vendor account and profile information | While the account is active, and for 12 months after closure |
| Uploaded documents | While the account is active; deleted 90 days after account closure, unless earlier deletion or export is requested |
| Buyer email address and download entitlement | 12 months from purchase, so that a buyer can re-download a purchased file |
| Billing, transaction, and commission records | 7 years, as required by Australian tax and financial record-keeping law |
| Security and access logs | 12 months |
| Support correspondence | 3 years |
Export before closure. Vendors should download any documents and transaction records they wish to keep before an account is closed. After the retention period lapses, deleted data cannot be recovered.
Effect of account closure on buyers. Where a vendor closes their account, documents purchased before closure remain available for download for the period stated above. After that, buyers should contact the vendor directly.
Data may persist in encrypted backups for a short period after deletion from live systems, after which it is overwritten in the ordinary backup cycle.
13. Your Rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you
- Correct information that is inaccurate, out of date, or incomplete
- Request deletion of your personal information
- Object to, or request restriction of, certain processing
- Request a portable copy of information you have provided
- Withdraw consent where processing is based on consent
- Not be discriminated against for exercising these rights
Making a request. Contact us using the details in clause 18. We will verify your identity before acting, and will respond within 30 days. There is no charge for a reasonable request. If we refuse a request in whole or in part, we will tell you why in writing and explain how to complain.
Requests about material inside a vendor’s documents should be directed to that vendor, not to us — the vendor holds the relationship with those individuals. If someone contacts us directly, we will refer them to the vendor and let the vendor know.
Note that we cannot delete transaction records we are required to retain for tax and financial record-keeping purposes.
14. Children
The Platform is a professional tool and is not directed at, or available to, anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.
15. Third-Party Links
The Website may contain links to third-party sites, and vendors’ documents may themselves contain links. We are not responsible for the content or privacy practices of any third-party site. Review their policies before providing information to them.
16. Complaints
If you believe we have mishandled your personal information, contact us first using the details in clause 18. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you may escalate to:
- Australia — Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au, 1300 363 992
- United Kingdom — Information Commissioner’s Office (ICO), www.ico.org.uk
- European Union — your local supervisory authority
- Singapore — Personal Data Protection Commission (PDPC), www.pdpc.gov.sg
17. Changes to This Policy
We may update this Policy from time to time. The effective date at the top of the page shows when it was last revised. Where changes are material, we will notify vendors by email before they take effect. Continued use of the Website after that date means you accept the updated Policy.
18. Contact
For questions, access requests, or complaints regarding this Privacy Policy:
DocuLatch A service of Shantallow Partners Pty Ltd and Laguna Media ABN 75 495 300 172
Email: privacy contact — use the contact form Post: P.O. Box 1388, Noosa Heads, Queensland 4567, Australia Web: https://doculatch.com