1. Controller and scope
Octomedia Pty Ltd operates ARCD and controls the personal information described here. This notice supplements Octomedia's published privacy policy for the ARCD service.
It covers customer accounts and service use as well as identifiable executive and business-contact information held in the directory.
2. Information we collect
- Customer name, business email, organisation, authentication status, account role and agreement history.
- Subscription and entitlement status, Stripe customer and subscription references, billing country and billing-event outcomes. ARCD does not store card numbers.
- Private bookmarks, support or correction communications, security records and bounded technical logs such as time, request identifier, device or browser family and network-security signals.
- Retail company identity, websites, general business contact details, locations, categories, ownership, store counts and publicly associated executives and titles, together with source and review evidence.
3. Direct and indirect sources
We collect customer information directly during registration, payment, support and service use. Directory information can be collected indirectly from Octomedia's legacy records, official company websites and store locators, company publications, public registers, reputable editorial sources, invited company submissions and review work.
For people represented in directory records, the purpose of indirect collection is to maintain an evidence-based retail-industry research directory, verify changes, handle corrections and provide licensed supplier-sales research. New Zealand's indirect-collection notification principle, IPP 3A, may require additional notice or an applicable exception assessment.
4. Uses and disclosures
We use information to create and secure accounts, provide directory access, process and reconcile subscriptions, maintain and review directory records, prevent misuse, answer support and correction requests, and meet legal or financial-record obligations.
Service providers may process the minimum information needed for their role, including Supabase for database and authentication, Cloudflare for preview application delivery, Stripe for billing, transactional email providers and approved hosting or operational providers. Some processing may occur outside Australia or New Zealand; provider, region and safeguard details must be maintained in Octomedia's processor register before production use.
5. Retention and security
We use role-based access, row-level database rules, encrypted transport, administrator multi-factor authentication and audit records. No internet service can promise absolute security.
Private customer objects are scheduled for deletion 90 days after subscription expiry unless a dispute or legal hold applies. Raw Stripe webhook payloads are not stored by ARCD; normalized financial linkage and records may be retained for up to seven years where required. Directory evidence and corrections follow separate operational and legal retention decisions.
6. Access, correction and complaints
You may ask for access to or correction of personal information about you, or complain about its handling, through Octomedia's published privacy channel. We may need to verify identity and may retain a correction statement where a requested change is disputed.
Australian users may also contact the Office of the Australian Information Commissioner. New Zealand users may contact the Office of the Privacy Commissioner if a concern is not resolved.
7. Changes
Material changes are published as a new version. Where a change alters the customer agreement or acceptable use, ARCD may require renewed acceptance before further paid access.
Official privacy resources
Octomedia privacy policy · Australian Privacy Principles · New Zealand privacy principles