Privacy policy

Last updated 1 October 2026

Sales Ops is a sales operations app for businesses. This policy explains what information it holds, why, where it is kept and what you can ask of us. It is provided by the operator of Sales Ops (“we”).

Two kinds of information, two roles

Your business's data: the customers, products, orders, invoices, visit notes, photos and call records you import or connect. Your business decides what goes in and who sees it; we hold and process it only to run the service for you. In privacy law your business is the responsible party (or controller) for this data and we are its operator (or processor).

Account information: who you are as a user, and the details your business gave when it signed up. For this, we are the responsible party.

What we collect

Your name and work email, and a password, which our sign-in provider stores only as a secure hash. We never see it.
When a business signs up: its name, country, phone, address, industry and team size, and who signed it up.
The business data you bring in by spreadsheet or by connecting your own systems (for example Unleashed, Skynamo, Xero or 3CX). We only read from them what the app needs, and only write back where the app says so, such as placing an order in Unleashed.
A record of important changes (who changed settings, team access, integrations) so your admins can review them.
Technical information needed to keep the service safe and working: error reports, which leave out what you typed and your cookies, and your IP address, used briefly for bot checks and to limit repeated sign-in attempts.

What we don't do

We don't sell or rent information, or use it for advertising.
We don't use tracking or advertising cookies. We use two cookies, both needed for the app to work: one keeps you signed in, and one remembers which company you're working in when you belong to more than one. Page-view statistics are counted without cookies.
One business never sees another's data, and within a business, reps see only their own accounts.

Where it is kept, and who helps us

The database and the app run in Sydney, Australia (Neon on Amazon Web Services, and Vercel).
Files you upload (logos, visit photos, deal sheets, planogram pages) are stored privately with Vercel Blob.
Emails (invitations, notifications, campaigns) are sent by Resend.
Live updates and chat messages are delivered by Ably; they carry record references, not your business data.
Short-lived counters and caches (sign-in limits, for example) may be kept with Upstash.
Driving routes are worked out by an OpenStreetMap routing service from the stops' map positions only.
Error reports go to Sentry, hosted in Germany.
Cloudflare Turnstile checks that a business sign-up comes from a person.

Each of these providers processes information only to provide their service to us. If you are outside Australia, your information is transferred there; we rely on these providers' contractual and security commitments when it is.

How we protect it

Everything travels encrypted (HTTPS).
Keys you save to connect other systems are encrypted again before they are stored (AES-256).
Sign-in needs a confirmed email; repeated failed attempts are slowed down; access is by invitation within each business.

How long we keep it

Your business's data: for as long as your business uses the service.
The record of important changes: 2 years.
Error and sync logs: 90 days.
Business sign-ups that are never approved, and accounts whose email is never confirmed: deleted after 30 days.
If your business stops using the service, contact us. We delete its data within 30 days, after giving your admins the chance to export it (Settings → Import data → Export).

Your rights

You can ask to see the information we hold about you, have it corrected or deleted, or object to how it is used. For your business's data, your business's admins can usually do this in the app, and we will help them. Contact support@medinox.com.au. If you are not satisfied with our answer, you can complain to your local data protection authority, such as the Information Regulator in South Africa or the Office of the Australian Information Commissioner.

Changes

If we change this policy in a way that matters, we will tell your business's admins before it takes effect. The date at the top shows the current version.