Privacy Policy

DataQuoll, formerly EmergencyAPI, is operated by SEY Solutions (ABN 13 531 353 123), a registered Australian business.

Contact: jack@dataquoll.io

When you create an account, we collect:

• Full name
• Email address
• Password (hashed by Supabase, we never see or store it in plain text)
• Company or organisation (optional)
• Country
• Intended use case
• Where you first came to our website from: the domain of the site that linked you (for example google.com), or "direct" if none did, and any campaign tag (utm_source) in that link. We keep the domain only, never the page you were on or what you searched for.

When you use the API, we also collect:

• API usage data: which endpoint each of your API keys calls, how many times per day, and the response format requested. We do not record the other search parameters you send (locations, dates, states, categories), or the responses you receive.

When you use the dashboard, we also record:

• Dashboard usage counts: for your account, how many times each dashboard tab is opened or refreshed each day, and how many times an incident's full record is opened (on the map or in the live feed). We do not record which incident, address, postcode or area you look at. Lookups on the Lookup tab, place searches on the Live incidents tab, and Declarations-tab lookups under the Organisation licence, are counted as API usage, above. A Declarations-tab lookup paid by the add-on or the wallet is counted against the add-on or the wallet instead, again without the address or postcode.

If you buy wallet credit, we also record:

• Your wallet: your balance, and each top-up and charge (when it happened, what it was for and the amount). Card details go to Stripe and never reach us.

When you sign up, log in, or confirm your email address, we also record:

• Your IP address and the browser user agent the request was sent with. These are used for two things: rate limiting, and checking whether one person has created several accounts to obtain more than one free allowance, which the Terms of Service do not allow.

A shared IP address is never treated as proof on its own. Households, offices, universities, mobile networks and VPNs routinely put unrelated people behind a single address. It is only ever a prompt for a person to review an account, and no account is ever restricted automatically on that basis.

• Account management: To create and maintain your account and API key.
• Rate limiting: To enforce fair usage and prevent abuse.
• Service improvement: To understand how the API and the dashboard are used and where to focus development, to find automated scraping of the dashboard map, and to learn how people find DataQuoll.
• Communication: To contact you about your account or service changes, and occasionally about DataQuoll plans and offers available to you as a registered user. Every offer email carries an unsubscribe link that stops them permanently. Notices about your account itself are always sent.

All account and usage data is stored in Supabase, hosted in the Sydney region (ap-southeast-2), Australia. Data is encrypted at rest and in transit.

The website and API are hosted on Vercel with global CDN distribution. No personal data is stored on Vercel beyond what is needed to serve requests.

We never sell or trade your personal data, and we do not share it with anyone for their own purposes. It reaches the following providers only because they run part of the service on our behalf:

• Supabase - database and authentication, hosted in Sydney. Holds your account record, API keys, and your usage counts including which endpoints you call.
• Vercel - website and API hosting, and Web Analytics (section 7).
• Stripe - payments. Receives your name, email address and company name when you subscribe, and handles your card details directly. We never see or store a card number. Free accounts are never sent to Stripe.
• Google Workspace - email delivery. Carries account emails such as sign-up confirmation, password resets and service notices, which means it necessarily carries your email address.
• Google Analytics - traffic measurement on our public pages. See section 7.

Each processes data on our behalf under its own terms. Stripe, Google Analytics and Vercel Web Analytics operate outside Australia, so data handled by those three may leave the country. Your account record, API keys and usage data stay in Sydney.

We set three kinds of cookie:

• Supabase session cookies - strictly necessary to keep you logged in. They carry no tracking data.
• Google Analytics cookies (_ga and similar) - set on our public pages to count visitors. They are not set on the dashboard, settings or any signed-in account page.
• First-visit cookie (dq_ft) - set when you visit our website without one. It holds the domain of the site that linked you, or "direct", and any campaign tag (section 2), and lasts up to 90 days. It is used only if you create an account from that browser: what it holds is stored with the account and the cookie is deleted. A later visit starts a new one.

We do not use advertising cookies, and we do not sell or share cookie data for advertising.

We use Google Analytics to count visits to our public pages: the homepage, the map, documentation, pricing and the guides. It sets cookies, records your IP address and is operated by Google outside Australia. It is not loaded on any signed-in page. You can opt out with Google's browser add-on, or any tracker-blocking extension. Doing so has no effect on the service or the API.

We use Vercel Web Analytics on the website and the dashboard. It counts page views without cookies, recording the page address, the referring site, and your browser, operating system, device type and country. It is operated by Vercel, which also hosts the site.

Inside the dashboard we also keep our own dashboard usage counts, per account: how often each tab is opened or refreshed and how often an incident's full record is opened. They help us improve the dashboard and find automated scraping of the map and the feed. They are counts only, stored in our own database in Sydney, never shared, and kept for 400 days. The dashboard usage counts are made on our server; a blocker does not stop them.

Under the Australian Privacy Act 1988, you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate information
• Delete your account and all associated data

To exercise any of these rights, email jack@dataquoll.io. We will respond within 30 days.

We retain your data for as long as your account exists. If you delete your account, all personal data is removed, including your usage history.

Per-endpoint usage records are kept for 400 days, then deleted automatically. That is long enough for one year-on-year comparison and no longer.

Your wallet balance and its history are kept while the account exists, and deleted with it. Stripe keeps its own record of each payment.

Dashboard usage counts are kept for 400 days, then deleted automatically, and straight away if you delete your account.

IP addresses and browser user agents recorded at signup, login and email confirmation are kept for 90 days, then deleted automatically. They are also deleted immediately if you delete your account.

You can request deletion at any time by emailing jack@dataquoll.io.

DataQuoll aggregates emergency incident data from official Australian government feeds. This data describes incidents (location, type, status) and does not contain personal information about individuals involved in those incidents.

We do not collect, store, or process any personal data about people affected by emergency incidents.

We may update this policy from time to time. The "Last updated" date at the top of this page will always reflect the most recent version. Significant changes will be posted here.

If you have questions about this privacy policy or how we handle your data: