Privacy Policy

1. Who we are

Consulting Console is operated by Aller Consulting Pty Ltd (ABN 32 666 456 613) ("we", "us", "our"), based in New South Wales, Australia. You can contact our privacy contact at privacy@consultingconsole.app.

2. Two roles we play

For our own account holders and website visitors, we decide how personal information is used, and this policy applies directly.

For information our customers put into their workspaces(for example, their clients' contact details, their employees' and external consultants' names and time records), we handle that information on our customer's behalf and under their instructions, as set out in our Terms of Service. Our customers are responsible for having the right to provide that information to us and for giving any notices their own clients, staff and external consultants need. We still protect it to the standard described in this policy.

3. What we collect

Information you give us

• Account details: name, email address, password (stored only as a salted hash), workspace name and logo.
• Workspace content: clients and billing contacts, postal addresses and tax details, projects, purchase order references, billable and cost rates, time entries and descriptions, invoices, external consultant bills, referral fee arrangements and referrer contact details.
• People you invite: the name, email address and role of employees and external consultants you add to a workspace.
• Support and correspondence: anything you send us by email.

Information from third parties

• Google, if you choose to sign in with Google: your name, email address and whether it is verified.
• Stripe, if you subscribe: subscription status, billing contact and payment status. We do not receive or store full card numbers.
• Xero, if you connect it: the Xero organisation you authorise, connection tokens, and the status of invoices and bills you sync.

Information collected automatically

• Security and audit records: sign-in sessions, and an audit log of actions taken in a workspace (who did what and when).
• Onboarding events: which setup steps were started, completed or skipped, so we can improve sign-up.
• Error reports: when the app hits an error, the page address, browser type and error details, so we can fix it.

We do not use advertising or analytics cookies. See our Cookie Statement.

We do not ask for sensitive information (such as health information) and ask that you do not enter it into Consulting Console. You can use a pseudonym when contacting us with a general enquiry, but we need your real name and email to provide an account.

4. How we use it

• To provide Consulting Console: creating accounts, running workspaces, generating invoices and bills, and syncing with Xero when you ask us to.
• To send service emails: account verification, password resets, invitations, and referral fee notices you have configured.
• To bill subscriptions through Stripe.
• To keep the service secure: authentication, fraud prevention, audit logs and investigating misuse.
• To support you and improve the product, including fixing errors and understanding where sign-up breaks down.
• To meet legal, tax and accounting obligations and resolve disputes.

We do not sell personal information. We do not use workspace content to train AI models. We will only send you marketing emails if you have agreed or where the Spam Act 2003 otherwise allows it, and every marketing email includes a working unsubscribe link.

5. Who we disclose it to

We disclose personal information only as needed to run the service:

• To the service providers listed on our Sub-processors page, who host, email, bill or integrate on our behalf.
• To other users in the same workspace, according to the roles and permissions the workspace owner sets.
• To Xero, only when you connect Xero and choose to sync.
• To professional advisers, insurers, or a purchaser of the business, under confidentiality obligations.
• Where required or authorised by law, such as to a court or regulator.

6. Overseas disclosure

Consulting Console runs on Google Cloud in Singapore (Google Cloud asia-southeast1), so workspace data is stored outside Australia. Our providers may also process information in other countries, including the United States, New Zealand and other countries where Google, Stripe and Xero operate. Current locations are listed below and on our Sub-processors page.

We take reasonable steps, including contractual terms, to make sure these providers protect personal information consistently with the APPs.

7. How we keep it secure

We use role-based access controls, salted password hashing, signed sessions, encrypted connections (HTTPS), provider encryption at rest and audit logging. Access to production systems is restricted to people who need it. No system is perfectly secure, but we work to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

If we become aware of a data breach likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and will tell affected customers promptly so they can meet their own obligations.

8. How long we keep it

We keep personal information while your account is active and for as long as needed for the purposes above. When a workspace is deleted, operational data is removed and a limited archive is kept for legal, tax, accounting, security and dispute purposes. Details are in our Data Retention & Deletion policy.

9. Access and correction

You can see and update most of your information in the app. You can also ask us for access to, or correction of, the personal information we hold about you by emailing privacy@consultingconsole.app. We will respond within 30 days. If the information is held in a customer's workspace, we may refer your request to that customer and help them respond. If we refuse a request, we will tell you why and how to complain.

10. Complaints

If you have a concern about how we have handled your personal information, email privacy@consultingconsole.app. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

11. Changes to this policy

We may update this policy as the product or the law changes. We will post the new version here with a new effective date and, for material changes, notify account owners by email before they take effect.