180 Degrees IT SolutionsBack to App

Privacy Policy

Last updated: 2026-10-26

This Privacy Policy explains how 180 Degrees IT Solutions (ABN 20 109 249 863, PO Box 284, Yungaburra QLD 4884) (“we”, “us”), an Australian business, handles information when you use BrightMesh Tables. We aim to be straightforward about what we collect, why, and who else touches it. If something here is unclear, email kevin@180degreesit.com.

1. What we collect

  • Account details: your name, email address, and (optional) profile image.
  • Authentication data: a scrypt-hashed password, session tokens, and — if you choose to enable them — a two-factor (TOTP) secret or a passkey (WebAuthn) credential. We never store passwords in plain text.
  • Your workspace content: the tables, rows, columns, views, comments, and files you or your team create. This is your content, organised into a workspace that is logically isolated from every other customer’s workspace.
  • Usage and security logs: request timestamps, IP addresses, your browser’s user agent (a description of your browser and device), and account-security events (sign-ins, exports, deletion requests, acceptance of our Terms) used to keep the service secure and to investigate abuse. Error reports sent from the app also include the user agent.
  • Email sent to a workspace: if a workspace turns on email-to-table, the email addresses it creates accept messages from anyone who knows the address. We receive and store the sender’s address, the subject, the body and any attachments, and show them to the workspace’s reviewers before anything is written to a table.
  • Email sent and tracked from a record: when a workspace member sends an email from a record, we keep a copy of the message, and of any reply that comes back to that record’s tracking address, with the sender and recipient addresses. Message bodies are encrypted at rest.
  • Forms and requests you fill in without an account: if you submit a public form or a task request, or use a guest portal link, we collect what you type or upload, and the usual request details (IP address and user agent). The request form also uses Cloudflare Turnstile to tell people from bots; see section 4.
  • Microsoft directory data (only if a workspace admin uses it): an admin can sign in to their organisation’s Microsoft 365 tenant to pick people to invite. We read each person’s display name, email address, user principal name and whether the account is enabled, show them in a picker, and do not save the list.

BrightMesh Tables does not currently process payments in-app — there is no billing or payment-processor integration built into the product. If that changes, this policy will be updated before any card or billing data is collected.

2. Why we collect it

  • To provide the service and keep your workspace data available to you.
  • To authenticate you and protect your account.
  • To send transactional email you’ve triggered or opted into — workspace invitations, reminders, weekly digests, and automation notifications.
  • To diagnose bugs, investigate abuse, and improve the product.
  • To power the in-app AI features, when you choose to use them.

We do not sell your data, and we do not share it with advertisers.

3. Multi-tenant workspace isolation

BrightMesh Tables is multi-tenant software: many customers share the same application, each inside their own workspace. Every table, row, column, view, and comment is scoped to a workspace, and access is checked at both the application and database layer so that one customer’s data is never visible to another customer’s workspace.

4. Third parties who process data on our behalf

We use a small number of vendors to run the service. We don’t sell access to your data to any of them — each is used for a specific operational purpose. The full list, with what each one receives and the country it processes data in, is on our subprocessors page.

  • Anthropic (Claude API): when you use an in-app AI feature — AI chat, “Ask This Table”, AI-powered automations, or autonomous AI agents you’ve configured — the relevant prompt and the workspace data needed to answer it or carry out the action are sent to Anthropic’s Claude API to generate a response. Under Anthropic’s commercial API terms, this data is not used to train their models. AI features only run against data you or your workspace choose to expose to them.
  • SMTP2GO: our transactional email relay. It sends workspace invitations, reminder notifications, weekly digests, and automation emails on our behalf, from noreply@oneighty.cloud. It does not send marketing email and holds no ongoing copy of your workspace content beyond what’s needed to deliver each message.
  • Your workspace’s own AI provider (optional): a workspace admin can configure an OpenAI-compatible AI provider with their own key. If they do, that workspace’s AI prompts and the data needed to answer them go to that provider instead of Anthropic. We do not choose that provider; the workspace does.
  • Destinations your workspace chooses: workspace admins can send row data to addresses and tools they pick, such as webhooks, Slack, Zapier or Make. We do not choose those recipients; the workspace is responsible for them.
  • Your browser’s speech service: if you use voice input in the AI assistant, your browser turns speech into text using its own speech recognition, which may send the audio to the browser maker (Google Chrome and Microsoft Edge do). The audio never reaches our servers; only the resulting text does.
  • Cloudflare: all traffic to and from the app passes through Cloudflare’s network, which therefore handles requests and responses in transit. Cloudflare Email Routing and an Email Worker receive email sent to a workspace’s inbound addresses and pass it to us. Cloudflare Turnstile checks the public request form for bots. Cloudflare R2 storage has held database backup copies; see section 5.
  • Microsoft: if you sign in with Microsoft, Microsoft authenticates you and tells us your name and email address. If a workspace admin uses Microsoft 365 directory lookup to invite people, Microsoft Graph returns the directory entries described in section 1.
  • Hosting infrastructure: the application and database run in Docker containers on a virtual server we manage, managed through Coolify, our platform for running the app. The server’s network address is registered to Host Universal Pty Ltd and located in Melbourne, Australia. Coolify orchestrates the containers; it does not independently process your data outside that hosting role.
  • Microsoft Azure Key Vault: operational secrets that protect this infrastructure — database credentials, our authentication signing secret, and our encryption keys — are stored in Azure Key Vault (Australia East) rather than in application code or plain configuration files. Key Vault is a secrets store for our own infrastructure; it does not itself hold customer workspace data.

5. Where your data is processed

Our application and database run on a server we manage via Coolify, whose network address is in Melbourne, Australia. Encrypted backups are kept on that server and copied each night to a computer we control. Some vendors process data outside Australia:

  • Anthropic processes AI prompts and the workspace data sent with them outside Australia. If your workspace uses its own AI provider, that provider processes them instead, wherever it operates.
  • Cloudflare carries all traffic, and receives inbound email, through its global network, so that data passes through Cloudflare locations in many countries. Database backup copies were also uploaded to Cloudflare R2 storage, where Cloudflare chooses the storage location. That upload was switched off on 2026-10-11; copies made before then may still exist until they are deleted.
  • SMTP2GO delivers the email we send. We have not restricted delivery to an Australian region.
  • Microsoft handles sign-in and directory lookups through its global identity service. Our Azure Key Vault is in Australia East.

See the subprocessors page for the vendor-by-vendor list.

6. Sensitive data protection

If your workspace stores sensitive personal information — for example names, email addresses, phone numbers, or health-related notes — a column holding that kind of data can be marked as a Sensitive Column. Values in a Sensitive Column are encrypted at rest using AES-256-GCM, and are masked by default whenever data is read (in the grid, in AI responses, in exports, and in shared views) — a user has to explicitly reveal a value, and have permission to do so, before it’s shown in the clear.

7. How long we keep it

  • Workspace content (tables, rows, columns, views) is retained while your workspace is active.
  • A deleted table is recoverable from “Recently Deleted” for 30 days, after which an automated nightly job permanently purges it.
  • Security/audit history (e.g. field-change history) is retained for around 90 days for accountability and troubleshooting.
  • When someone opens a public share link, we record that the link was opened, how many rows it showed, and the network address and browser it was opened from. No account is involved and we do not know who the visitor is. This is so the workspace owner can see what left their workspace. It is kept for 90 days and then automatically deleted, the same window as other security history above.
  • When someone in a workspace, or an API key, exports or downloads data, we record who did it, what they took and when, including attempts that were refused. The workspace owner uses this to see what left their workspace. It is kept for 12 months and then automatically deleted.
  • Automatic version-history snapshots of a table are kept for 30 days (snapshots someone saved by name are kept until they delete them). The log of webhook messages a workspace sent is kept for 30 days. In the security log, the network address and browser of each event are cleared after 90 days.
  • Files uploaded to a record are deleted from our servers when the record, or its table, is permanently removed. A file that something else in the workspace still uses (a copy of the record, a saved version of the table, a comment) may be kept while it is in use.
  • Infrastructure backups are kept for a limited rotation window for disaster-recovery purposes only, and are not a substitute for the account-deletion request described below.

8. Your rights

  • Access and export: you can download a copy of the personal data we hold on your account — your profile, memberships, comments, notifications, and session/API-key metadata (never raw tokens or key secrets) — at any time from inside the app via /api/account/export.
  • Deletion: you can delete your account yourself from Settings > Profile > Delete account. This immediately signs you out everywhere and revokes your API keys, and we email you a link to cancel. After 30 days we scrub your comments and anonymise your profile (name, email, image and sign-in methods) so it can no longer identify you. If you are the sole owner of a workspace, you’ll be asked to make someone else an owner first, so the workspace isn’t orphaned for the rest of your team.
  • Correction: you can edit your profile details from your account settings at any time.
  • Workspace content: rows and tables in a workspace are shared work product, not individual personal data — deleting your account does not delete rows you contributed to a shared workspace, in the same way leaving a shared document doesn’t delete what you wrote in it. If you need specific workspace content removed, ask the workspace owner, who can delete it directly.
  • Complaints: if you believe we have mishandled your personal information, contact kevin@180degreesit.com first. You may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies

We use a small number of cookies and equivalent local storage entries. These are essential for sign-in (session cookies) and for remembering your preferences (theme, layout density, zoom). We do not use advertising or cross-site tracking cookies, and we do not run analytics scripts on any page, including shared views embedded in other websites. Because nothing non-essential is set, there is nothing to opt in to.

10. Security

We encrypt data in transit (HTTPS/TLS), hash passwords with scrypt, encrypt Sensitive Column values and operational secrets at rest, and support two-factor authentication (TOTP) and passkeys on top of password sign-in. We apply standard hardening (rate limiting, Content-Security-Policy, HSTS). No system is perfectly secure, but we apply industry-standard security practices and keep improving them — we do not hold any formal security certification (e.g. SOC 2, ISO 27001) today, and don’t claim one.

11. Children

BrightMesh Tables is a business tool, not intended for children under 16. We do not knowingly collect personal information from children.

12. Governing law

This policy is written to align with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), which govern how we handle personal information as an Australian business. It does not make any representation about compliance with non-Australian privacy regimes (for example the EU GDPR or US state privacy laws) — BrightMesh Tables is operated for 180 Degrees IT Solutions’ own customers, not marketed to EU or US consumers specifically.

13. Changes to this policy

If we make material changes, we will update the “Last updated” date above and, where appropriate, notify account holders by email. The current version is always available at /privacy.

14. Contact

Privacy questions or requests: kevin@180degreesit.com. See also our Terms of Service.