Privacy

Privacy Policy

Last updated: 15 October 2026

This policy explains what personal information SteadyPoint Cyber collects, why we collect it, who we share it with, and the choices and rights you have. We handle your information in line with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

1. Who we are

SteadyPoint Cyber (“SteadyPoint”, “we”, “us”, “our”) helps Australian small businesses understand and improve their cyber security. Our website is www.steady-point.com.

For anything to do with your privacy or this policy, contact us at hello@steady-point.com.

[ADD: ABN, e.g. “ABN 00 000 000 000” — or delete this line]   [ADD: business/postal address — optional, delete if you'd rather not list one]

2. The personal information we collect

We only collect what we need to provide what you've asked for. Depending on how you use the site, that can include:

• Your email address — when you subscribe to unlock our free template library. Subscribing is what opens the library, so we also record your consent to receive our emails, and the fact that you confirmed the address by clicking the link we sent you.
• Your email address for the weekly briefing — when you subscribe through the form on our blog, we collect your email address, and record when you subscribed and that you confirmed the address by clicking the link we sent you.
• Your Cyber Checkup answers — when you complete our free online cyber assessment, we collect the answers you give. If you choose to have your results sent to you, we also collect your name and email address for that purpose. If you tick the optional box on that form, we also record your consent to receive our subscriber emails.
• Anything you send us directly — for example, the contents of an email you send to us, and your contact details.
• Basic technical information — like a general (non-precise) location, browser type and the pages you visit, which our hosting and form providers process automatically to serve the site securely and prevent abuse.
• How you use the site, and how you got here — the pages you view, the links you use, and which campaign or ad brought you to us. This is collected by our analytics and advertising tools, which set cookies on your device. Section 7 explains exactly what these are and how to turn them off.

We do not ask for sensitive information (such as health, financial account or government identifier details) through this website, and we ask that you don't send it to us.

3. How we use your information

We use the information above to:

• give you access to the free templates you requested, deliver your Cyber Checkup results, and send you emails about the book if you reserved a copy;
• send you the weekly briefing, if you subscribed to it through our blog;
• respond to your enquiries and provide the services you've asked for;
• send you our subscriber emails, including the weekly briefing, with practical cyber security guidance, template updates and news about our products and services (subscribing, and confirming your address, is also what unlocks our free template library);
• keep the website working, secure and free from abuse;
• understand how the site is used, so we can improve it;
• measure our advertising, and show our ads to people who have visited the site or who resemble our visitors; and
• meet our legal obligations.

We don't sell your personal information. We don't use it to make automated decisions that have a legal or similarly significant effect on you. Which ads you're shown on Meta's platforms is decided automatically, and section 7 explains how to change that.

4. Consent and marketing

We only email people who asked us to. There are four places you can give us your email address on this site, and they work differently.

The template library

Our free template library is subscriber-only, and we use confirmed opt-in (sometimes called double opt-in). To unlock it, you enter your email and tick the box confirming you'd like to receive our emails with practical cyber security guidance, template updates, and information about our products and services. The box is unticked by default, and it's your choice whether to subscribe: if you'd rather not, you simply don't submit the form, and the free templates stay locked.

We then send you one email with a confirmation link, and the library opens when you click it. Until you confirm, the templates stay locked and we don't send you our subscriber emails. If you never confirm, your address stays inactive: it sits unconfirmed with our email provider and in our form records, it isn't marketed to, and you can ask us to delete it at any time.

The Cyber Checkup

The Cyber Checkup works differently: subscribing is not a condition of using it. You can complete the Checkup and get your results without joining our list. There's a separate box, unticked by default, offering a short follow-up series that explains what to actually do about your results — one email every couple of days for ten days. Ticking that box is the only thing that adds you to our list. Leave it unticked and we'll send your results and nothing else.

If you do tick it, you'll get the same confirmation email described above, and the series only starts once you've clicked the link. When the ten days are up we'll keep you on the list for our general guidance emails until you unsubscribe. The box says so before you tick it, and every email carries the unsubscribe link.

The weekly briefing

The form on our blog subscribes you to the weekly briefing: roughly one email a week describing a real cyber incident in a business about your size, with three practical things you can do about it. It uses confirmed opt-in, so you're only added once you click the link in the confirmation email we send. The briefing list is separate from our other lists, and every email carries an unsubscribe link. You can also unsubscribe by emailing hello@steady-point.com.

The book waitlist

If you reserve a copy of the book, we use that email address to send you emails about the book, such as when preorders open and when it's available, and for nothing else. Reserving a copy doesn't add you to our subscriber list. If you want that as well, subscribe through the template library, the Cyber Checkup or the weekly briefing on our blog.

Your consent record, and unsubscribing

When you subscribe, we record your email address, the date and time, where you subscribed from, the exact wording you agreed to, and the fact that you confirmed the address — so we can demonstrate that consent was given. Every email we send identifies SteadyPoint, includes our contact details, and carries a working unsubscribe link. You can unsubscribe at any time — from that link or by emailing hello@steady-point.com — and we'll action it promptly. Unsubscribing stops future emails; it doesn't affect any templates you've already downloaded.

5. Who we share your information with

We don't sell or rent your information. We share it only with the service providers who help us run the site and deliver these services, and only so they can do that work for us:

• Netlify — hosts our website, including the Cyber Checkup itself, and receives and passes on our template-library and Cyber Checkup form submissions.
• MailerLite — our email provider. It stores subscriber email addresses, sends the confirmation link and our updates, and handles unsubscribes.
• Make — connects these systems to each other: it receives your Cyber Checkup submission, records it in our Google spreadsheet, and passes your name, business and email address to MailerLite when you've consented to our emails.
• Google — stores Cyber Checkup responses in Google Sheets, provides the analytics that tell us how the site is used, and serves the fonts our pages load.
• Meta — runs our advertising on Facebook and Instagram, and receives the site activity described in section 7 so those ads can be measured and targeted.

We may also disclose information where the law requires or authorises it — for example, to respond to a valid request from a regulator, or to protect our rights or the safety of others.

6. Overseas storage and processing

Some of our service providers are based, or store data, outside Australia. In practice, your information may be handled in the United States (our website and form hosting; Google, which stores our Cyber Checkup responses and provides our analytics and fonts; and Meta, which runs our advertising) and the European Union (MailerLite, our email provider, which is based in Lithuania, and Make, our integration provider), and in other countries where our providers operate. We take reasonable steps to use reputable providers, but we can't guarantee that overseas recipients handle information in exactly the same way as an Australian organisation would.

7. Cookies, analytics and advertising

We use cookies and similar technologies for three things: keeping the site working, understanding how it's used, and measuring our advertising. Here's each one plainly.

Keeping the site working

When you confirm your subscription and the template library opens, your browser stores a small marker on your own device (in “local storage”) so you don't have to use the confirmation link again on that browser. That marker is not your email address and isn't sent anywhere — it just tells your browser the library is unlocked. It's per-browser, so confirming on your phone won't unlock the library on your laptop; opening the same confirmation link there will. You can clear the marker any time through your browser settings. Our hosting and form providers may also set essential cookies needed to keep the site secure.

Understanding how the site is used

We use Google Analytics 4 to see how people find and move through the site: which pages are visited, which links are used, roughly where visitors are located, and which of our own campaigns brought them here. It sets cookies on your device and sends this activity to Google, which acts as our service provider for it. We use it to understand what's working, not to identify you personally, and we don't upload your email address or your Cyber Checkup answers to it.

Measuring our advertising

We advertise on Meta's platforms (Facebook and Instagram), and we use the Meta Pixel on this site to measure whether those ads work. It records that a browser visited certain pages or took certain actions — starting the Cyber Checkup, for example — and reports that back to Meta. Meta may match that activity to a Facebook or Instagram account, which means it can be used to show you our ads later, and to help Meta build audiences of people similar to our visitors. We don't send Meta your Cyber Checkup answers.

We don't sell your personal information to anyone, including Google or Meta. But we want to be straight with you: advertising and analytics tools of this kind involve sharing behavioural data with large overseas platforms that have their own commercial interests in it.

Turning it off

You have real options here, and none of them stop you using the site or the templates:

• Block or clear cookies in your browser settings, or browse in a private window.
• Install Google's Analytics opt-out browser add-on.
• Adjust what Meta can use in your Facebook or Instagram ad preferences.
• Use a browser with tracking protection built in, or an ad/tracker blocker. We don't try to detect or defeat these.

Our pages also load fonts from Google Fonts; when they do, Google may receive your device's IP address as part of serving those font files.

8. How long we keep your information

We keep personal information only as long as we need it:

• Subscriber details — your email address and consent record — are kept until you unsubscribe or ask us to delete them. If you unsubscribe, we may keep a minimal record of that request so we don't email you again.
• Unconfirmed addresses — if you start the subscription but never click the confirmation link, the address stays unconfirmed with our email provider until we clear it from the list, and isn't used for marketing in the meantime. You can ask us to remove it at any time.
• Cyber Checkup answers are kept so we can provide your results and improve the assessment; we remove or de-identify them when they're no longer needed.
• Analytics and advertising data is kept according to the retention settings of the tools described in section 7. Google Analytics data is retained for a limited period and then deleted automatically; data held by Meta is subject to Meta's own retention practices, which we don't control.

You can ask us to delete your information sooner — see Your rights.

9. Keeping your information secure

We take reasonable steps to protect your information from loss, misuse and unauthorised access — including collecting as little as we can, transmitting the site over encrypted connections (HTTPS), and working with providers that maintain their own security controls. No website or internet transmission is ever completely secure, so we can't promise absolute security, but we treat your information carefully and review how we handle it.

10. Your rights and choices

You can ask us to:

• Access the personal information we hold about you;
• Correct anything that's wrong or out of date;
• Delete your information, where we're not required to keep it; and
• Unsubscribe from our emails at any time; and
• Opt out of our analytics and advertising tracking — see section 7, which you can do yourself without asking us.

Just email hello@steady-point.com and we'll action it. We may need to confirm your identity first, and we'll respond within a reasonable time. There's no charge to ask.

11. Data breaches

If a data breach happens that is likely to cause serious harm, we'll act to contain it and will notify affected people and the Office of the Australian Information Commissioner (OAIC) where the Notifiable Data Breaches scheme requires us to.

12. Children's privacy

Our services are made for business owners and aren't directed at children. We don't knowingly collect personal information from anyone under 16. If you believe a child has given us their information, contact us and we'll delete it.

13. Changes to this policy

We may update this policy from time to time as our services or the law change. When we do, we'll change the “last updated” date at the top of this page. If the change is significant, we'll take reasonable steps to let opted-in subscribers know.

14. How to contact us — and complaints

For any privacy question or request, contact us first:

We'll do our best to sort it out. If you're not satisfied with how we've handled a privacy matter, you can contact the Office of the Australian Information Commissioner (OAIC): oaic.gov.au or 1300 363 992.