How Kerbwell handles personal information.

Kerbwell is operated by Black Shard Pty Ltd (ABN 66 696 910 773). We handle personal information under the Privacy Act 1988 and the Australian Privacy Principles, and we treat the notifiable data breaches scheme as applying to us.

Privacy questions

Our privacy officer: support@kerbwell.com.au.

Version 1.0, effective 4 November 2026.

Two roles

Our own records, and the records we keep for agencies.

For this website, for Kerbwell accounts, and for the sign-in and signing records we keep, we decide how personal information is handled and this policy applies directly.

Agencies use Kerbwell to keep records about their own clients, vendors, buyers and contacts. For those records the agency decides what is collected and why, and the agency's own privacy policy applies. We handle those records on the agency's instructions under our agreement with it, and we do not use them for our own purposes. A request about a record an agency holds is best made to that agency, and we will help it respond.

What we collect

Only what the service needs.

Website enquiries: your name, email address, phone number, agency name and your message, with the time it was sent and the IP address it came from.
Page visits on this website: the page, the referring page and the screen size. No advertising or third-party analytics tags run on this website.
Accounts: your name, email address, mobile number, agency and role, and the passkeys and other sign-in methods you set up. For a passkey we hold only its public key.
Sign-in and security records: the time, the method used, your IP address, your browser's user agent, the approximate location (country and region) and network (ASN) derived from your IP address, and a record of the device. One-time codes are stored only as a one-way hash.
Electronic signing: your name and contact details, the document, your consent to sign electronically, your signature, how your identity was confirmed, and the IP address, user agent, approximate location and time of each step, with a cryptographic hash of the document.
Identity verification, when an agency asks for it: the details listed for FrankieOne below.
Messages: the content and delivery status of email and SMS messages we send for you or to you.

How we collect it

Mostly from you: through this website, when you sign in, and when you sign a document. Some comes from the agency that invited you, such as your name and contact details on an agreement it sends. Technical details come from your browser and from Cloudflare, which handles the connection. Identity verification results come from FrankieOne once that service is switched on.

Why we use it

To provide the service: run accounts, deliver documents, record signatures and send the messages you or your agency ask for.
To confirm it is you: sign-in, one-time codes, and the extra verification steps described under automated decisions.
To keep a reliable record: the signing evidence an agency, a court or a regulator may need later.
To protect the service and the people using it: detecting misuse, investigating incidents and meeting our legal obligations.
To answer your enquiry and support your account.

We do not sell personal information, and we do not use it for advertising.

Who handles it, and where

Every service provider, its location and the basis for any overseas disclosure.

Microsoft Azure
What it does
Runs the Kerbwell application, its database and file storage, and sends our email and SMS messages through Azure Communication Services.
Information
Everything held in the application: account details, agency records, sign-in and signing records, messages we send.
Where
- Australia (Australia East region)
APP 8 basis
Not an overseas disclosure. The application, database, storage and messaging service are provisioned in Australia, and the messaging service is configured with its data location set to Australia.
Cloudflare
What it does
Serves this website and its enquiry forms, runs the bot check on our forms, and carries traffic to our sign-in, portal and signing addresses. Encrypted connections from your browser end at Cloudflare's network before they reach us.
Information
Your IP address, the address and headers of each request (including your browser's user agent), the country, region and network (ASN) Cloudflare derives from your IP address, which our servers record with sign-in and signing events, bot-check signals, and the contents of any enquiry you send through this website.
Where
- United States (Cloudflare, Inc.)
- The Cloudflare data centre that handles your request, which for a visitor in Australia is usually in Australia
- Website enquiries are stored in Cloudflare's database and storage services with an Oceania location setting
APP 8 basis
APP 8.1. Before disclosing, we took reasonable steps to ensure Cloudflare does not breach the Australian Privacy Principles: Cloudflare's data processing addendum binds it to process personal information only on our instructions, keep it confidential and secure, flow the same terms down to its own subprocessors and tell us of a breach. We remain accountable for Cloudflare's handling under section 16C of the Privacy Act.
FrankieOne
What it does
Verifies a person's identity when an agency asks for an identity check, for example as part of its anti-money laundering customer due diligence or before a high-value signing. Not switched on yet.
Information
Name, date of birth, address and contact details, identity document details, and where a document or face check is used, the document image and a photo of your face. We keep the result, the check reference, its level and date, and the verified details. We do not keep document images in our records.
Where
- Australia
- Any provider outside Australia that FrankieOne uses for a particular check, named here with its country before the service starts
APP 8 basis
Disclosure to FrankieOne in Australia is not an overseas disclosure. Our contract with FrankieOne will list every provider outside Australia that a check can use, with its country, and bind FrankieOne to APP-equivalent handling for that provider. We will name those countries in this policy before the service starts, and we will not switch the service on until we have.

Overseas disclosure, in short: the only provider outside Australia that receives personal information today is Cloudflare, whose parent company is in the United States and whose network spans many countries. We do not rely on your consent to disclose overseas.

Sign-in checks against breached passwords send only the first five characters of a one-way hash of the password, which identifies no one. Location and network lookups for sign-in risk run on our own servers.

Automated decisions

Where a computer program decides something about you.

We publish these details ahead of the Privacy Act automated-decision transparency requirements that apply from 10 December 2026.

To protect accounts and signatures, our sign-in and signing services score each attempt for risk. The score is calculated by a computer program, and the program can, without a person reviewing it first:

ask for an extra step before you continue: a passkey, a code sent to your other contact method, or a bot check;
pause sign-in for a period after repeated failed attempts;
ask you to confirm your identity again before you finish signing if your last confirmation was more than 15 minutes earlier;
ask you to change a password that appears in a list of breached passwords;
refuse a signing method that does not meet the minimum set for that kind of document. An agency agreement cannot be signed with a link and code sent to the same email address or phone number, and signing records a single-factor confirmation as single-factor.

The personal information it uses: your IP address and the approximate location and network derived from it, the device record, your recent sign-in history and failed attempts, the time since your last confirmation, and the breached-password result.

These decisions change how you prove who you are. They do not decide whether a sale, an agreement or any service goes ahead. If one stops you, contact support@kerbwell.com.au and a person will review it and tell you what the program relied on.

Agencies can also switch on tools in Kerbwell that score or rank enquiries and properties. Those decisions are the agency's, and its client portal carries a disclosure generated from the tools it has switched on.

Security

Personal information is encrypted in transit and at rest. Staff accounts use multi-factor sign-in, and access to production systems is limited to named people and recorded. Each agency's records are separated at the database. Sign-in and signing events are recorded, and a completed document is sealed with a digital signature so that any later change to it can be detected.

How long we keep it

One-time codes and sign-in challenges: 24 hours.
Sign-in and security events: 2 years, after which the IP address and user agent are removed.
Device records: deleted after 13 months without use.
Signed documents and their evidence where anti-money laundering record keeping applies: 7 years, in storage that cannot be altered or deleted during that time.
Everything else: destroyed or de-identified once we no longer need it for the purpose we collected it for, unless the law requires us to keep it.

Access, correction and complaints

You can ask for the personal information we hold about you and ask us to correct it. Email support@kerbwell.com.au. We respond within 30 days, and there is no charge to ask.

If you have a complaint about how we handled your personal information, email support@kerbwell.com.au. We acknowledge a complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

If a data breach involving your information is likely to cause you serious harm, we will tell you and the Commissioner, and say what happened and what you can do.

Changes

When we change this policy we publish the new version here with its effective date. Before a new service provider handles personal information, we add it here first.