Privacy Policy

Last updated 7 October 2026.

CentreOS is a tool that helps shopping centre managers keep track of reports from their tenants. This policy explains what we collect, why we collect it, who else handles it, and how to ask us about it.

It covers three groups: visitors to this website, customers, and people who use the CentreOS service (the site that a centre's shops and managers sign in to).

Who we are

CentreOS ("we", "us") runs this website, our guides site and the CentreOS service. For a centre, the reports belong to the centre. We run the system for the centre and look after the data on its behalf.

The service has its own short privacy page for shops and managers. It follows this policy.

For privacy questions, requests and complaints, email support@centreos.com.au.

What we collect

When you visit this website. We use an analytics provider in the United States to see how this website is used and where people get stuck. It records which pages are read, where visitors came from, your device and browser type, and your approximate location. It also records your device's internet address (IP address) and a recording of how the page was used. Our settings hide everything typed into form fields in that recording. It keeps a random identifier in your browser's local storage so it can recognise a returning visitor. It does not set cookies here. We do not use advertising trackers.

When you read our guides site. The guides site has no forms and no analytics. Its host keeps a basic log of each request, which can include the page asked for and your IP address. The logs are private and deleted after 30 days.

When you send an enquiry. The enquiry form collects:

• What you are dealing with: a preset option, or whatever you type if you choose "Something else".
• Your centre's name.
• An email address, so we can reply.
• How many shops your centre has (as a range), and the plan you are interested in.

The form also has a hidden field that only spam bots fill in. Real visitors leave it blank. It is not personal information.

If you are a customer. We hold your centre's name, the names and email addresses of the people you tell us to contact or add to the service, and our quotes, invoices and payment records. We do not take payments on this website. Customers are invoiced.

If you use the service as a shop. When a shop sends a report, promotion or idea, we collect what the shop types in: the title, description, category, where in the centre it is and how urgent it is. We also collect the shop's name, any photos or videos attached, and the date and time. Shops can add follow-up notes and reply to notices from the centre. We do not ask for a person's name.

A shop can add up to five email addresses, and the centre can add them too. Each shop also has a PIN, which is the code on its card. We store the PIN so the centre can look it up and issue a replacement.

If you use the service as a manager or team member. We hold your name, email address, role, the time of your last sign-in and your email alert choices. Passwords are stored scrambled so even we can't read them. Each update to a report records who made it and when.

Technical data from the service. Our cloud host keeps a log of every request to the service. It records the IP address and the web address requested, and keeps the log for 30 days. Failed sign-in attempts are also recorded in a security log, with the IP address and country, for 30 days.

If a centre emails a shop a sign-in link from its PIN card, opening the link can record the PIN once in our server logs. Only we can see those logs, and they are deleted after 30 days.

Our analytics provider also runs on the service. It records how the service is used, including your IP address, and a recording of how the screen was used. Our settings mask all text, inputs and photos in that recording.

Sensitive details. Please do not put sensitive details, such as health information, in a report or a photo. Photograph the problem rather than people.

How we find centres to contact. We may email centre managers about CentreOS using business contact details they have published, for example on a centre's website. Every email says who we are and offers a way to opt out. If you ask us to stop, we will.

How your enquiry gets to us

Our website form service, which is operated from India, delivers the enquiry form to our inbox. It also keeps a copy: its policy says it stores submissions for up to three years.

To filter spam, it sends the sender's IP address and email address to two spam-checking services. It runs on cloud infrastructure providers, so your enquiry can pass through servers in other countries on its way to us.

Why we collect it

We use your information to:

• read and reply to your enquiry;
• set up and run the service for customers;
• send you messages the service needs, such as sign-in links, notices, report updates and a daily round-up for managers;
• keep the service secure; and
• understand how the website and the service are used, so we can improve them.

We may also use or share information where the law requires it, or to protect ourselves in a dispute.

We do not sell your information, and we do not use it for advertising. We do not sign you up to a newsletter or mailing list unless you ask. The one exception is a short business email to centre managers, explained under "How we find centres to contact".

Who else handles your information, and where

The service stores reports, photos and backups in Sydney, Australia. The providers below handle some information for us.

• Google, our cloud host. It hosts the service and stores its data in Sydney. Its server logs hold IP addresses and web addresses and are kept for 30 days. The logs are not limited to Australia.
• Google, our email provider. It sends the emails the service sends, and holds the mail we send and receive. We cannot choose which country it handles that mail in. Copies of emails we send may also stay in our mailbox until deleted.
• Our translation service. It is provided by our cloud host. When a shop writes in a language other than English, the text is sent to it to be translated. Google says it holds the text only briefly while it translates and does not use it to train its systems or share it. It handles the text where it chooses, which may be outside Australia. The English translation is saved with the report. Shop names, PINs and email addresses are never sent.
• Our analytics provider (United States). It handles analytics for this website and the service. It records IP addresses, so it holds them in the United States.
• Our website form service (operated from India). It delivers the enquiry form, as described above. Its own infrastructure providers may use servers in other countries.

The countries we know of are Australia, the United States and India. These providers may also use others.

How we keep it safe

We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, changes or disclosure.

Our sites use HTTPS, which is an encrypted connection. Passwords for the service are stored scrambled so even we can't read them. Photos and videos are kept in private storage. No system is completely secure, so we cannot guarantee security. Please keep your password and PINs safe.

How long we keep it

• Enquiries. For as long as reasonably needed to follow up with you and for basic business record-keeping, unless you ask us to delete them sooner. Our website form service may keep its own copy for up to three years under its own policy.
• Customer records. While you are a customer, and after that for as long as the law requires us to keep business records.
• Reports and accounts in the service. While the centre uses CentreOS. Reports are kept as a record of what was raised and what was done about it. Centre management can archive a report or remove it from view. That hides it but does not erase it.
• If a centre cancels. It has 30 days from the date the cancellation takes effect to download its data. We then delete it from our live systems within a further 30 days.
• What deletion does not reach. Deletion does not reach four things. Server logs and analytics, which are kept until their own periods end. Copies of emails we have already sent, including copies in our own mailbox. Records of enquiries held by our website form service. Records the law requires us to keep, such as invoices.
• Server logs and security logs. 30 days.
• Analytics. Recordings are kept for 30 days. Other analytics events are kept for as long as we need them to understand how the website and the service are used.
• Backups. We back up the database every day and keep each backup for 7 days. We keep a deleted photo for 7 days. So copies of deleted data can last up to 7 more days. Google, who host them, then remove expired data from their own systems under their own deletion process. Emails we have already sent cannot be recalled.

Cookies and similar technology

This website sets no cookies. Our analytics provider keeps an identifier in your browser's local storage, which you can clear in your browser settings.

In the service, shops get no cookie. Managers and team members get one cookie that keeps them signed in for 12 hours. A shop's browser keeps the PIN and shop name for the open tab only, and keeps display choices such as light or dark mode.

Your rights

You can ask us at any time to see what we hold about you, correct it, or delete it. Email support@centreos.com.au. We will act on it within a reasonable time, and our aim is 30 days.

If your information is in a centre's records, we may need to check with the centre. If we cannot do what you ask, we will tell you why.

Complaints

If you think we have mishandled your information, email support@centreos.com.au and tell us what happened. We will acknowledge your complaint within 5 business days, and respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Changes to this policy

If how we handle your information changes, we will update this page and change the date at the top.