Streamit privacy
How CM & VP Industries Pty Ltd, ABN 43 645 539 206 ("we"), handle personal information in Streamit. We follow the Australian Privacy Principles in the Privacy Act 1988. Updated 1 November 2026.
What we collect
- Account details: names, email addresses, mobile numbers and sign-in details for the people who use Streamit.
- Business data: what the business and its team enter into Streamit or connect to it, such as rosters, timesheets, customers, sales, bills, documents and figures read from Xero. The business that uses Streamit decides what goes in.
- Payment details: payments are handled by Stripe. Stripe holds the card details; we never see or store full card numbers.
- Enquiries: what you send us through the "Book a demo" form or by email.
- Website visits: we count visits to our website and app with Cloudflare Web Analytics, which doesn't use cookies or identify individual visitors.
How we use it
To run Streamit for your business, keep it secure, send the notifications and emails you've asked for, bill you, and answer your questions. We don't sell personal information, we don't use your business data for advertising, and we don't use it to train AI models.
AI features
Some features (such as the forecast write-up, Ask, and the AI Inbox) send the figures or messages needed for that one answer to an AI model. Staff names are blanked out where they aren't needed. We use AI providers whose terms say they process it only to give the answer and don't use it to train their models.
Where it's stored
Streamit runs on Cloudflare. Each business's data is kept in its own database on Cloudflare's platform.
Who else handles it (subprocessors)
- Cloudflare: hosting, databases, file storage, website analytics, and Workers AI for some AI features.
- Stripe: subscription payments.
- Resend: sending emails such as sign-in codes, invitations and notices.
- OpenRouter and the AI model providers it uses (such as Anthropic): the AI Inbox and some AI writing features.
- Google: our own email (support@ and privacy@).
- Xero, Podium, Microsoft, Meta and text message providers: only if your business connects or turns on those features.
Overseas
Some of these providers store or process information outside Australia, including in the United States and other countries where they run their services. We choose providers that protect information to a standard similar to the Australian Privacy Principles, and we'll tell you if that changes.
How long we keep it
We keep a business's data while it uses Streamit, and after it cancels so it can come back or download it. A business can ask us to delete its data, and we'll do so within 30 days, except anything the law requires us to keep (such as billing records).
Your choices
You can ask to see or correct your personal information. Staff should usually ask their employer first, since the business controls its own data in Streamit. A business can ask us to export or delete its data.
Security
Sign-ins are protected, two-step sign-in is available, data is sent over encrypted connections, and each business's data is kept separate. If there's a data breach that's likely to cause serious harm, we'll tell the people affected and the regulator, as the law requires.
Contact
For privacy questions or complaints, email privacy@streamitnow.au. We'll reply within 30 days. If you're not happy with our answer, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.