Privacy & Security Policy

MessageWorks Pty Ltd ("MessageWorks", "we", "our", or "us") is committed to protecting the privacy of all data entrusted to us by our clients and their customers. This Privacy & Security Policy explains how we collect, store, use, and protect personal information in connection with our business SMS platform.

We operate in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our services allow clients to use our platform to send SMS messages to their customers. In doing so, we process data strictly under client instruction and only for the purposes our clients specify.

This policy covers two related but distinct areas: (a) how we handle your personal information as a privacy matter, and (b) the technical and organisational security measures we implement to keep that information safe.

In providing our SMS platform, we may collect and store the following categories of information:

• Account information: business name, ABN, contact name, email address, and phone number for account holders and authorised users.
• Contact data uploaded by clients: mobile phone numbers, first names, and other non-sensitive fields used for SMS campaigns.
• Message content and metadata: the text of messages sent, delivery timestamps, delivery status, and campaign records.
• Usage and activity logs: records of actions taken within the platform for audit, troubleshooting, and compliance purposes.
• Website enquiry data: information submitted via our contact or free trial forms, including name, email, phone, company name, and ABN.

We do not collect or store sensitive information (as defined under the Privacy Act 1988) unless explicitly provided by the client, and we do not request sensitive information through our platform. We also strongly recommend that clients do not upload any sensitive information to the platform — our system is designed for standard business contact data only.

We use client data only for the following purposes:

• Delivering SMS messages through our platform on behalf of clients.
• Maintaining logs and records necessary for performance monitoring, compliance, and billing.
• Providing customer support and troubleshooting.
• Improving platform functionality under lawful and secure conditions.
• Responding to account enquiries and trial applications.

All data processing is conducted under the direction of our clients. We do not use, access, or repurpose client data for any unrelated commercial purposes, and we do not sell or trade client data under any circumstances.

The MessageWorks platform runs on Google Cloud Platform (GCP) — one of the world's most secure and audited cloud environments. Your data benefits from enterprise-grade infrastructure security without us needing to operate our own datacentres.

Google Cloud Platform

• Google Cloud datacentres are certified against ISO/IEC 27001, SOC 1, SOC 2, and SOC 3 standards.
• Physical access to datacentres is restricted to authorised personnel only, with multi-factor authentication, biometric controls, and 24/7 on-site security.
• Facilities are protected against environmental threats including fire, flood, and power failure, with redundant power and cooling systems.
• Data stored within the platform is encrypted at rest using AES-256 encryption.
• All data in transit between your browser and our servers is encrypted using TLS 1.2 or higher (HTTPS).

Replit Platform Security

• Replit is SOC 2 Type II certified, meaning its security controls are independently audited on an ongoing basis.
• Role-based access controls restrict which Replit personnel can access infrastructure systems.
• Automated security monitoring detects and alerts on suspicious activity across the platform.
• Regular third-party security assessments are conducted to identify and address vulnerabilities.
• Replit employees do not have routine access to client data stored on the platform.

Our platform is deployed using Replit's Autoscale infrastructure — a stateless, cloud-native deployment model. This means no customer data is held in server memory between requests; all persistent data is stored in our encrypted PostgreSQL database.

In addition to the infrastructure-level protections above, MessageWorks implements its own application security controls:

Authentication & Access

• All accounts are protected by username/password authentication with securely hashed passwords (bcrypt).
• Two-factor authentication (2FA) via SMS is required on every login — a one-time code is sent to the user's registered mobile number and expires after 5 minutes.
• Sessions are managed using secure, server-side session tokens stored in PostgreSQL — not in browser-accessible storage.
• Accounts automatically time out after 4 hours of inactivity (admin users) or 1 hour (standard users), requiring re-authentication.

Role-Based Access Control

• The platform enforces strict user roles: Admin, Owner, Standard, and Restricted.
• Restricted users cannot view contact mobile numbers or export data, limiting exposure of sensitive contact information.
• All permission checks are enforced on the server — not just in the user interface.
• Admin access is limited to MessageWorks staff managing the platform. Admin accounts cannot access client message content.

Audit & Monitoring

• All significant actions within the platform are recorded in a tamper-evident activity log.
• API rate limiting is applied to all public-facing endpoints to protect against abuse.
• Inbound email processing validates sender identity against a client-managed authorised senders list before any action is taken.
• SMS opt-out (STOP) requests are processed immediately and respected across all send paths.

We retain client data for a maximum of two years from the date of creation, unless a client formally requests secure deletion prior to that period.

Upon receiving a deletion request, we ensure thorough and irreversible data erasure in compliance with industry best practices. This includes campaign records, SMS logs, contact data, and account information.

Activity logs may be retained for a shorter period for operational and compliance purposes. Clients may contact us at any time to discuss their specific retention needs.

We do not share, disclose, or sell client or customer data to any third parties, except in the following limited circumstances:

• Where required by Australian law or a valid order of an Australian court or regulator.
• With our SMS gateway provider (MessageMedia), solely for the purpose of delivering messages — no contact data beyond the destination mobile number and message content is shared.
• With Replit Inc. as our hosting platform provider, under the terms of their privacy and security commitments as described in Section 4.
• With Mailgun (our email delivery provider) for the purpose of sending platform notifications and reports — only recipient email addresses and message content are shared.
• With tawk.to, our live support chat provider. For signed-in users, we share their name, email address, a platform user identifier and their MW account name so our support team can identify who is contacting us. Chat messages and information visitors choose to provide are also processed by tawk.to.

All third-party providers are bound by contractual obligations to protect the data we share with them and to use it only for the specified purpose.

Clients using the MessageWorks platform are responsible for:

• Ensuring they have obtained appropriate consent from their contacts to receive SMS communications.
• Keeping their account credentials and 2FA-registered mobile number secure and not sharing login details with unauthorised persons.
• Promptly notifying us if they suspect unauthorised access to their account.
• Complying with the Spam Act 2003 (Cth) and the Do Not Call Register Act 2006 (Cth) in relation to the messages they send.
• Providing accurate information when registering for and using the platform.

In the event of a data breach that is likely to result in serious harm to any individual, we will comply with our mandatory data breach notification obligations under the Privacy Act 1988 (Cth) — specifically the Notifiable Data Breaches (NDB) scheme.

This includes notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable after becoming aware of an eligible data breach.

We maintain an internal incident response process to detect, contain, and remediate security incidents promptly.

Clients may contact us at any time to request access to, or correction of, personal information we hold about them or their account.

We do not routinely review the contents of our clients' message data, but clients may request an export of their account records, SMS logs, or contact data at any time.

If you have questions or concerns about our privacy practices, or wish to lodge a complaint, please contact us: