SaneLog Privacy Policy

Last updated: 26 September 2026

This Privacy Policy describes how Zesty Marmot Pty Ltd (ABN 40 702 662 806) trading as SaneLog (SaneLog, we, us) handles personal information in connection with the SaneLog service at sanelog.com (the Service) and our website.

We are an Australian company and we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to personal information we hold about you, this policy also describes how we meet those laws, and Zesty Marmot Pty Ltd is the controller of that information.

1. What this policy covers - and the important exception

This policy covers personal information we collect and hold about our own users: people who visit our website, create or use a SaneLog account, contact our support team, or otherwise deal with us directly.

It does not cover the contents of the logs our customers send to the Service (Customer Content). Log data belongs to the customer that sent it and may contain personal information about that customer's own end users. We process Customer Content only on the customer's behalf and instructions, as a processor, under the Data Processing Addendum that forms part of our Terms of Service.

If your personal information appears in a customer's logs, that customer - not SaneLog - decides how it is collected and used, and their privacy policy applies to it. Please direct any request about that information to them. If you contact us about personal information in Customer Content, we will refer your request to the relevant customer and will not respond substantively except as the law requires.

2. Personal information we collect

Account and profile information. When an account is created or you are invited to one as a user, we collect your name, email address and role, and your authentication details: password (stored only as a secure hash), two-factor and recovery codes, passkey credentials and trusted-device records.

Billing information. For paid plans we collect billing contact details, plan and subscription history, and invoice records. Payments are processed by our payment processor, Stripe: your card or payment details are provided directly to Stripe and we do not store full card numbers. We receive from Stripe confirmation of payment and limited details such as card type and last four digits.

Usage, security and audit information. The Service records administrative and security-relevant activity in a per-account audit log attributed by email address - for example sign-ins, invitations, configuration changes and reveals of source or API tokens. We also collect technical information when you use the Service or our website, such as IP address, browser and device information, and timestamps, which we use for authentication, security and troubleshooting.

Support and other communications. When you email support@sanelog.com or otherwise correspond with us, we keep the correspondence and the details you provide in it.

Marketing preferences. If you sign up for product updates, we keep your email address and preferences until you unsubscribe.

We collect personal information directly from you, from the account admin who invites you, and automatically through your use of the Service. We do not collect personal information about you from data brokers, and we do not buy personal information.

If we receive personal information about you that we did not solicit and could not lawfully have collected, we will destroy or de-identify it where lawful and reasonable to do so.

3. How we use personal information

We use personal information about our users to:

provide, operate and secure the Service, including authenticating you, enforcing account roles, and maintaining the audit log;
manage plans, billing and payments, and send invoices and receipts;
respond to support requests and communicate with you about the Service, including service and security notices;
monitor for, investigate and prevent fraud, abuse, security incidents and breaches of our Terms of Service;
improve and develop the Service, using aggregated or de-identified information wherever practicable;
send marketing communications where you have opted in or where otherwise permitted by law - every marketing email includes an unsubscribe link, and we comply with the Spam Act 2003 (Cth);
comply with our legal obligations, and establish or defend legal claims.

We do not sell personal information, and we do not use it for automated decisions that produce legal or similarly significant effects about you.

Where those laws apply, we rely on the following legal bases:

Performance of a contract - providing the Service to you and your account under our Terms of Service, including authentication, billing and support.
Legitimate interests - securing the Service, preventing fraud and abuse, maintaining audit records, improving the Service, and communicating with business contacts, balanced against your rights and interests.
Consent - optional marketing communications and any cookies that are not strictly necessary. You may withdraw consent at any time.
Legal obligation - record-keeping, tax and other requirements that apply to us.

5. Cookies

In the application (app.sanelog.com). The Service uses only cookies and similar technologies that are strictly necessary to operate it - for example to keep you signed in, remember trusted devices and protect against cross-site request forgery. There are no analytics, advertising or marketing cookies in the application. Essential cookies cannot be switched off while using the Service.

On our marketing website (sanelog.com). We use Google Analytics and similar measurement tools to understand aggregate use of the website, such as which pages are visited and how visitors found us. These tools set cookies and collect technical information such as IP address and device details, which Google processes on our behalf. Where the law of your location requires it, we will ask for your consent before setting analytics cookies, and you can decline without affecting your use of the website. You can also opt out of Google Analytics across websites using Google's browser opt-out tools.

We do not use cookies for third-party advertising or retargeting on either site.

6. Who we disclose personal information to

We disclose personal information about our users only:

to service providers that help us operate the Service, acting on our instructions - principally Amazon Web Services (cloud hosting, and the email the Service sends via Amazon SES), MXroute (the mailboxes that receive email sent to our sanelog.com addresses, including support), Stripe (payment processing) and Google (analytics for our marketing website, as described in section 5);
within your account - your name, email address and activity in the audit log are visible to authorised users of your own account, as part of how the Service works;
to professional advisers such as lawyers, accountants and auditors, under duties of confidence;
in a corporate transaction - if we sell, merge or reorganise the business, personal information may be transferred as part of that transaction, subject to this policy;
where required or authorised by law - including to courts, regulators and law enforcement in response to valid legal process, and to protect the rights, safety or property of SaneLog, our customers or others.

7. Where personal information is stored, and overseas disclosure

Account, billing and administrative information is stored on Amazon Web Services infrastructure in Australia (Sydney, ap-southeast-2). Customer Content is stored in the hosting region the account has selected from those we make available (currently Australia), as described in our Terms of Service.

Some of our service providers process limited personal information outside Australia: MXroute hosts the mailboxes that receive email sent to our sanelog.com addresses in the United States, Stripe processes payment transactions in the United States and other countries in which it operates, and Google processes analytics data from our marketing website in the United States and elsewhere. Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, and where the GDPR or UK GDPR applies we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (or the recipient's equivalent approved mechanisms).

8. Security

We protect personal information with the same measures that protect the Service generally, including encryption in transit and at rest, two-factor authentication and passkeys, role-based access controls, audit logging, and need-to-know administrative access by our personnel. No system is completely secure, and you are responsible for keeping your own credentials confidential and enabling the protections available to you, such as two-factor authentication or passkeys.

9. Retention

We keep personal information about our users for as long as the relevant account is active and afterwards only as long as needed for the purposes described in this policy - including for the periods required by Australian tax, corporations and other record-keeping laws (generally up to seven years for financial and transaction records), and as needed to resolve disputes and enforce agreements. Audit logs are retained for the life of the account as part of the account's records. When personal information is no longer required, we take reasonable steps to delete or de-identify it.

Customer Content is retained and deleted according to the account's plan retention period and our Terms of Service, not this section.

10. Your rights

Under the Privacy Act, you may request access to the personal information we hold about you and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

Where the GDPR or UK GDPR applies, you also have the rights to: access your personal information and receive a copy; rectify inaccurate information; erasure; restriction of processing; data portability; object to processing based on legitimate interests or to direct marketing; withdraw consent at any time (without affecting prior processing); and lodge a complaint with a supervisory authority.

You can exercise most of these directly in the Service - updating your profile, managing authentication methods and unsubscribing from marketing. For anything else, contact us at support@sanelog.com. We may need to verify your identity before acting on a request, we will respond within the time required by applicable law, and we will not charge you for making a request (though a reasonable charge may apply to giving access in some circumstances under the Privacy Act, which we will tell you about first). If we refuse a request, we will tell you why and how to complain.

Remember that if your information appears in a customer's logs, the request should go to that customer (see section 1).

11. Data breaches

We maintain processes to detect, assess and respond to data breaches. Where a breach involving personal information we hold is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, and we will comply with any other breach notification obligations that apply to us. Breaches affecting Customer Content are notified to the relevant customer under the Data Processing Addendum.

12. Children

The Service is intended for business and professional use and is not directed at children. You must be at least 18 to create an account, and we do not knowingly collect personal information from children. If you believe a child has provided us personal information, contact us and we will delete it.

13. Third-party links and services

Our website and the Service may link to or interoperate with third-party services you choose to use, such as notification channels and AWS accounts you connect. Those services handle personal information under their own privacy policies, which we encourage you to read.

14. Changes to this policy

We may update this policy from time to time. We will publish the updated version at app.sanelog.com/legal/privacy and update the "Last updated" date above, and for material changes we will notify account holders by email or through the Service. Continued use of the Service after a change takes effect indicates acceptance of the updated policy, to the extent permitted by law.

15. Complaints and contact

If you have a question, request or complaint about how we have handled your personal information, contact us:

Email: support@sanelog.com
Legal notices: legal@sanelog.com or PO Box 127, Camberwell VIC 3124, Australia

We will acknowledge complaints promptly, investigate, and respond within a reasonable time (and any time required by law).

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992. If you are in the EU or UK, you may also complain to your local supervisory authority.