Privacy policy
How Pythagoro handles personal information under Australian privacy law.
Last updated 10 November 2026.
Who we are
Pythagoro is software for organisations, made up of three apps: Lode, Mint and Assay. It is operated by Just Gold Digital Agency Pty Ltd, ABN 20 630 605 926 ("we", "us"). We follow the Australian Privacy Principles in the Privacy Act 1988.
Two kinds of information
- Information organisations put into Pythagoro. When an organisation uses Pythagoro, it decides what goes in: its people, policies, learning, projects, meetings, registers and reports. We hold and process that information on the organisation's behalf and on its instructions. If you are a member of an organisation and have a question about your information in it, ask that organisation first. We will help it answer you.
- Information we collect for ourselves. This covers account holders, people who visit our website, join our preview list, buy a plan or contact us.
What we collect
- Account details: name, work email, organisation, role, and sign in records.
- Profile details an organisation asks for: for example an emergency contact, documents, or a Working with Children Check number and expiry.
- Activity in the apps: completions, policy acceptances, approvals, decisions and an audit log of who did what and when.
- Billing details: the plan, invoices and payment status. Billing is not switched on yet. Before it is, we will name the payment provider on our Subprocessors page. We will never see or store full card numbers.
- Preview list: if you join it, your email address, your first name if you give it, and the wording and time of the permission you gave us to email you.
- Messages: what you send us when you contact support.
- Technical information: device and browser type, and security logs that we keep to protect accounts.
Sensitive information
Some of what organisations record can be sensitive information under the Privacy Act. Examples are a reasonable adjustment a person asks for, or a report made to a register. Pythagoro is designed so that:
- reasonable adjustments need no diagnosis or documents, and are visible only to the person, their manager and people the organisation names
- confidential registers are visible only to the people the organisation names
- confidential records never appear in notifications, search or AI features
We collect sensitive information for ourselves only with consent, and only when we need it.
Anonymous reports
The anonymous report form stores no name, email or IP address, and runs no analytics. If you choose to include identifying details in a report, they are stored as part of it.
How we use information
- to provide Pythagoro, sign people in and keep accounts secure
- to bill for plans and run trials
- to answer support requests
- to send product updates and preview invitations to people on the preview list, who can leave it at any time by emailing [email protected]
- to improve Pythagoro, using information that does not identify you wherever we can
- to meet our legal obligations
We do not sell personal information. We do not use information organisations put into Pythagoro for advertising, and we do not use it to train AI models.
AI features
Assay can draft annual report text from sources an organisation has approved. Every sentence cites its source, and a person must approve the draft before anything is published. AI features never run over confidential records. This feature is not switched on yet. Before it is, we will name the AI model provider on our Subprocessors page; it will process that content only to return the draft.
Automated decisions
Pythagoro does not use computer programs to make decisions about people that could significantly affect their rights or interests. Some actions happen automatically on settings an organisation chooses, such as removing access at 23:59 on a leaver's end date, sending reminders, or moving an overdue approval to the next person. A person at the organisation sets each of these, and can see and change them. If this changes, we will update this policy before the change takes effect.
Where information is kept
Pythagoro's data is stored in Sydney, Australia. Some of our service providers may access information from outside Australia, for example to deliver our pages through a global network or to provide support. Our current providers and where they operate are listed on the Subprocessors page. We take reasonable steps to make sure they protect information consistently with the Australian Privacy Principles.
How long we keep it
- Information an organisation puts into Pythagoro is kept until the organisation deletes it or its account ends. Each organisation sets a retention period for leavers' profile details.
- When an organisation's account ends, it has 30 days to export its data. We then delete it within 90 days, and it rolls out of backups within 35 days after that.
- Billing records are kept for as long as Australian tax law requires.
Access and correction
You can ask to see or correct personal information we hold about you. For information inside an organisation's workspace, we will pass your request to that organisation. We respond within 30 days.
Security and data breaches
Access is enforced on our servers, not only on screen. Information is encrypted in transit and at rest. Every grant and revocation of access is recorded. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and we will tell any affected organisation without delay.
Cookies
See the Cookies page.
Complaints
Contact our privacy contact at [email protected]. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We will post changes here and update the date above. For a material change, we will tell account holders by email before it takes effect.