Privacy Policy
How we handle personal information collected through this website and the enquiries you send us. Last updated 2 October 2026.
Who we are
This policy is published by ShadowSight Pty Ltd (ABN 18 669 383 528) ("ShadowSight", "we", "us"). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
It covers this website, shadowsight.io, the enquiries you send us, and the information our platform processes for our customers (see "Data we process for our customers").
What we collect
When you use the contact form, we collect the details you give us: your name, work email address, company, phone number, the area you're interested in, and your message. Name, email and message are required; the rest is optional.
When you visit the website, we don't use cookies, analytics or advertising trackers, and we don't try to identify you. Like any website, the services that deliver it (see "Who we share it with") receive technical information such as your IP address, browser type and the pages you request, so they can serve and protect the site.
We don't ask for sensitive information, such as health or financial details. Please don't include it in your message.
Why we collect it
We use the details you send us to respond to your enquiry, for example to answer your questions, discuss pricing or arrange a Proof of Value, and to keep a record of our correspondence. We don't add you to a mailing list or send you marketing unless you ask us to.
If you don't give us your name, email address and message, we can't respond to your enquiry. You can also contact us by phone without using the form.
Who we share it with
We don't sell personal information. We use these service providers to run the website and handle enquiries:
- Microsoft Azure hosts the website and runs the service that receives the contact form. That service runs in the United States. It passes your enquiry on by email and doesn't store it.
- Microsoft 365 delivers and stores enquiry emails in our mailboxes, in Australia.
- Amazon CloudFront (Amazon Web Services) delivers the website from a location near you, which may be outside Australia.
We may also disclose personal information where the law requires or allows it.
Overseas disclosure
As described above, enquiries submitted through the contact form are processed in the United States on their way to our mailboxes in Australia, and the website may be delivered to you from a location outside Australia. We use reputable providers that protect the information they process for us. Our staff don't access personal information from outside Australia.
How we protect it and how long we keep it
The website and the contact form only use encrypted (HTTPS) connections. The service that sends enquiries can send email only from one dedicated mailbox and can't read other mail. Access to our mailboxes is limited to our team.
We keep enquiries for up to 2 years after our last contact, and then delete them. If you become a customer, your details are kept as part of our customer records.
Accessing or correcting your information
You can ask to access the personal information we hold about you, or ask us to correct or delete it, by contacting us (below). We'll respond within 30 days. If we refuse a request, we'll tell you why.
Data we process for our customers
Organisations use the ShadowSight platform to understand activity in their own Microsoft 365 environment. When they do, we process information from that environment on their behalf and on their instructions, under our agreement with each customer. It can include:
- staff identity details, such as name, work email address, department and job title;
- Microsoft 365 activity and audit records, such as file, sharing and email activity and matches against data-protection policies;
- alerts, reviews and investigation notes about specific activity, and supporting evidence;
- for WorkPulse, activity-based measures derived from Microsoft 365 activity metadata. WorkPulse doesn't access the content of messages or documents;
- where a customer chooses, copies of emails and files kept within the platform as evidence.
Each customer decides which of our modules it uses and how the results are used. Customers can limit how individuals are identified; for example, WorkPulse can show pseudonyms instead of names.
Where it's stored. Customer data is stored in the Microsoft Azure region where the customer's business is located, to maintain data sovereignty.
Service providers. The platform runs on Microsoft Azure, in the customer's region, and reads data from the customer's Microsoft 365 tenant through Microsoft's APIs. Where a customer has AI features turned on, analysis uses Azure OpenAI in the customer's region. Customers can turn AI features off entirely, in which case no customer data is sent to an AI service. Our staff don't access customer data from outside Australia.
How long we keep it. Customers set retention periods within limits we support. We delete a customer's data when our agreement ends, in line with that agreement; copies in encrypted backups are deleted as those backups expire, within 90 days or as agreed with the customer. Backups are used only to recover from a system failure.
If you work for one of our customers and have a question about how your information is handled, please contact your employer first: they decide what is monitored and why. We'll help them respond, and you can also contact us directly.
Questions and complaints
Contact us about this policy or about how we've handled your personal information:
- Email: contact@shadowsight.io
- Phone: 1300 410 900
- Post: 83 Bay Street, Brighton VIC 3186
We'll respond to a complaint within 30 days. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes to this policy
We may update this policy, for example when we change how the website works. The date at the top shows when it was last changed.