Privacy Policy
Effective 2 October 2026
Your trust matters to us. This policy explains, in plain language, how Contenses handles personal information. Contenses is a business tool: it records where your organisation’s content assets are published. We collect only what we need to run it.
1. Who we are
Contenses is operated by Imesc Digital Solutions, trading as Contenses, an Australian business based in Western Australia (“Contenses”, “we”, “us”, “our”).
This policy covers our marketing website at contenses.com, the Contenses application at app.contenses.com, and the emails we send (together, the “Services”). It explains what personal information we handle, why, and the choices and rights you have.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Where they apply to you, we also honour the rights given by the EU and UK General Data Protection Regulation (GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA).
2. Our role: controller and processor
We play two different roles depending on the information involved:
- Controller. We decide how and why information is used for website visitors, people who contact us, account holders (your login and profile), and billing contacts. This policy applies in full.
- Processor (service provider). The content our customers put into their workspaces (“Customer Content”), such as asset records, URLs, revisions, approvals and the names of colleagues, belongs to and is controlled by that customer. We process it only to provide the Services and on the customer’s instructions under our Terms of Service.
If you are a member of a customer’s workspace and have a question about how your organisation uses Contenses, please contact your organisation first. We will help them respond.
3. Information we collect
Information you give us
- Enquiries. When you use our contact form, we collect your name, work email, company (optional), the topic, and your message.
- Account details. When you create or accept an invitation to an account, we collect your first and last name, email address and password. Passwords are stored only as a secure hash, never in plain text. If you turn on multi-factor authentication, we store the authenticator enrolment needed to verify your codes.
- Workspace details. Workspace name, billing business name and billing contact details. When you invite a colleague, you give us their email address and first name.
- Billing information. When you subscribe, our payment provider Stripe collects your billing email, billing address, optional tax ID and payment card details. Card details go directly to Stripe. We never see or store your full card number.
- Customer Content. The information you and your team enter into Contenses: asset names and descriptions, links to master, design and source files, publishing locations and URLs, revisions, approvals, products, platforms and comments. Contenses records links to your files. It does not store the files themselves.
- Communications. Messages you send to us and our replies.
Information we collect automatically
- Activity and audit records. The app keeps a timestamped record of actions taken in a workspace, such as who created, changed, approved or exported something, so that customers have a reliable audit trail.
- Technical and log data. Our hosting and infrastructure providers automatically record technical details when you use the Services, including your IP address, browser type, device information, pages requested and timestamps. We use this to run, secure and troubleshoot the Services. Our contact form also records your browser type and how long the form took to complete, to filter out automated spam.
- Cookies and local storage. See Cookies and similar technologies below.
Information from others
- A workspace owner or admin may give us your name and email address to invite you.
- Stripe tells us whether a payment succeeded and the status of a subscription.
4. How we use information
We use personal information to:
- provide, operate and maintain the Services, including your account and workspaces;
- authenticate you, keep accounts secure and prevent fraud, spam and abuse;
- process subscriptions, payments, invoices and tax;
- send service emails, such as verification, password reset, invitations, approval requests, billing notices and important changes;
- respond to enquiries and provide support;
- understand how the Services are used so we can fix problems and improve them;
- send product updates or marketing, only where you have asked for them or the law allows, and always with a way to opt out;
- comply with legal obligations and enforce our terms.
We do not sell personal information. We do not share it for cross-context behavioural advertising. We do not use Customer Content to train artificial intelligence models.
Legal bases (EU/UK users)
Where the GDPR applies, we rely on:
- contract, to provide the Services you or your organisation signed up for;
- legitimate interests, to secure, support and improve the Services and to answer enquiries, balanced against your rights;
- legal obligation, for tax, accounting and regulatory requirements;
- consent, for optional cookies and marketing emails. You can withdraw consent at any time.
7. International transfers
We are based in Australia. Our service providers may store and process information in other countries, including the United States and countries in Europe. When information leaves Australia, or the EU/UK, we take reasonable steps to make sure it stays protected. These include using providers bound by contractual commitments, such as standard contractual clauses, that give a level of protection comparable to the law where the information came from.
8. How long we keep information
We keep personal information only as long as we need it for the purposes above:
- Account information is kept while your account is active and deleted when your account is closed, except where we must keep some details for the reasons below.
- Workspace data, including Customer Content, is kept for the life of the subscription. When a trial or subscription ends without renewing, you have 90 days to export it or reactivate. After that, we delete it from our live systems. Copies in backups are removed within a further 30 days.
- Unverified sign-ups are suspended after 48 hours. You can delete one straight away using the “I didn’t sign up” link in the verification email.
- Enquiries are kept for up to 24 months after our last contact with you.
- Billing and tax records are kept for as long as Australian tax law requires, generally five to seven years.
- Security and system logs are kept for limited periods set by our infrastructure providers.
9. Security
We use technical and organisational measures to protect information, including:
- encryption in transit (HTTPS everywhere);
- database-level isolation so each workspace can access only its own data, which we test for;
- hashed passwords, optional multi-factor authentication, and mandatory multi-factor authentication for our own administrators;
- an audit record of administrative actions;
- restricting staff access to those who need it.
No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify affected customers and the relevant regulators as the law requires, including under the Notifiable Data Breaches scheme.
10. Your rights and choices
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct inaccurate or incomplete information;
- have your information deleted;
- receive a copy of your information in a portable format;
- object to or restrict certain processing;
- withdraw consent where we rely on it;
- opt out of marketing emails at any time, using the link in each email.
You can update your name and password in your account settings. Workspace owners can export their workspace register as CSV at any time. For anything else, email privacy@contenses.com. We may need to verify your identity first. We aim to respond within 30 days. We will not treat you differently for exercising your rights.
If your request relates to Customer Content held in your organisation’s workspace, we will pass it to that organisation, which controls the data.
11. Children
The Services are designed for businesses and are not directed at anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us information, contact us and we will delete it.
12. Changes to this policy
We may update this policy as the Services or the law change. We will post the new version here with a new effective date. If the changes are significant, we will notify account holders by email or in the app before they take effect.
13. Contact and complaints
For privacy questions, requests or complaints, contact our privacy team at privacy@contenses.com. We will acknowledge your complaint and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner. If you are in the EU or UK, you can also contact your local data protection authority.