Privacy Policy
Last updated: 27 July 2026
This Privacy Policy explains how Globalcsm Pty Ltd (ABN 14 127 573 219) ("we", "us", "our") collects, uses, and protects your personal data when you use Easypeasy Feaso. We are committed to handling your data in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
1. Data We Collect
a. Account data
When you sign up, we collect your email address, name (optional), and company name (optional). If you sign in with Google or GitHub, we receive your name and email from that provider.
b. Project data
When you create a feasibility study, we store the inputs, outputs, AI analyses, and your notes. This data is associated with your account and visible only to you (unless you choose to share it).
c. Usage data
We log: how often you use the Service, which features you use, AI request counts, error reports, and your IP address (for security and rate limiting). This data is used to improve the Service.
d. Cookies & local storage
We use a single authentication cookie (set by Supabase) for session management. We also use browser local storage for project data, settings, and your LLM API key (if you provide one).
e. Payment data
Payment is processed by Stripe. We do not see or store your credit card number. We receive only your billing email, plan, and subscription status from Stripe.
2. How We Use Your Data
- To provide the Service: compute feasibility, store projects, generate AI analyses
- To improve the Service: aggregate, anonymised usage statistics
- To support you: respond to your questions and bug reports
- To bill you: if you have a paid plan
- To comply with law: tax records, abuse prevention, lawful requests
We do not sell your data to third parties. We do not use your project data to train AI models.
3. AI & Third-Party Services
Easypeasy Feaso uses the following third-party services:
- Supabase (Sydney / US) — authentication, database, file storage
- Stripe (US) — payment processing
- Resend (US) — transactional email (receipts, password resets)
- Sentry (US/EU) — error monitoring
- Vercel (US/Sydney) — hosting and edge
If you provide your own OpenAI-compatible API key, your prompts are sent directly to that provider (e.g. OpenAI). Their use of your data is governed by their own privacy policy.
Our built-in (mock) AI does not send your data to any third party — it runs entirely on our servers using a deterministic rule-based system.
4. Data Storage & Security
Your data is stored in encrypted PostgreSQL databases hosted on Supabase. All data is transmitted over HTTPS. Authentication uses industry-standard JWT tokens with HTTP-only cookies. We use row-level security (RLS) to ensure that even in the event of a database breach, your data is unreadable without your account credentials.
While we take commercially reasonable steps to protect your data, no system is 100% secure. You use the Service at your own risk.
5. Your Rights
Under the Privacy Act, you have the right to:
- Access — request a copy of your personal data (account page → export)
- Correct — fix any inaccurate data (account page)
- Delete — permanently remove your account and all data (account page → delete)
- Opt out — disable cookies / marketing emails
- Complain — if you believe we have mishandled your data, contact us or the OAIC
To exercise any of these rights, email . We respond within 30 days.
6. Data Retention
We retain your data while your account is active. If you delete your account, we permanently remove your data within 30 days, except where retention is required by law (e.g. tax records: 7 years; anti-fraud: as needed).
7. International Data Transfers
Some of our service providers (Stripe, OpenAI, Sentry) may store data outside Australia. By using the Service, you consent to these transfers. We have ensured each provider maintains adequate data protection standards (GDPR, SOC 2, or equivalent).
8. Children
The Service is not intended for users under 18. We do not knowingly collect data from children.
9. Changes to This Policy
We may update this Privacy Policy. Material changes will be notified by email at least 14 days before they take effect.
10. Contact
Office of the Australian Information Commissioner (OAIC): oaic.gov.au