1. Introduction

SavePoint Pty Ltd ("SavePoint", "we", "us", or "our") operates the SavePoint Authentication Portal (auth.savepoint.com.au) that provides enterprise Single Sign-On (SSO) authentication services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our authentication services.

2. Information We Collect

2.1 Account Information

• Email address (required for account creation and authentication)
• Name (if provided or obtained from social login providers)
• Profile picture (if provided or obtained from social login providers)
• Authentication credentials (encrypted passwords, passkeys, TOTP secrets)

2.2 Social Login Information

• Basic profile information from GitHub, Google, or other OAuth providers
• Email address associated with your social accounts
• Public profile information as permitted by the social provider

2.3 Technical Information

• IP addresses and device information
• Browser type and version
• Authentication logs and session information
• Security events and access patterns

3. How We Use Your Information

• Provide authentication and authorization services
• Maintain and improve security of our systems
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations and enterprise security requirements
• Provide customer support and technical assistance
• Send security notifications and system updates

4. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties except as described below:

• SavePoint Applications: We share authentication status and basic profile information with authorized SavePoint applications you access
• Service Providers: We may share information with trusted service providers who assist in operating our services
• Legal Requirements: We may disclose information when required by law or to protect our rights and security
• Business Transfers: Information may be transferred in connection with mergers, acquisitions, or asset sales

5. Data Security

We implement enterprise-grade security measures to protect your information:

• End-to-end encryption for data transmission
• Encrypted storage of passwords and sensitive authentication data
• Multi-factor authentication and passkey support
• Regular security audits and vulnerability assessments
• Access controls and audit logging
• No SMS-based authentication due to SS7 vulnerabilities

6. Data Retention

We retain your personal information for as long as necessary to provide our services and comply with legal obligations. Authentication logs are retained for security and compliance purposes. You may request deletion of your account and associated data at any time.

7. Your Privacy Rights

You have the right to:

• Access and review your personal information
• Correct inaccurate or incomplete information
• Delete your account and associated data
• Export your data in a portable format
• Opt-out of non-essential communications
• File complaints with relevant privacy authorities

8. Cookies and Tracking

We use essential cookies and similar technologies to maintain authentication sessions, ensure security, and provide core functionality. We do not use tracking cookies for advertising or marketing purposes. Session cookies are automatically deleted when you sign out.

9. Children's Privacy

Our services are designed for business and enterprise use. We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have collected such information, we will take steps to delete it promptly.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. Your continued use of our services after such modifications constitutes acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us: