1. Who we are
Noon operates a software platform that Australian insurance brokerages rent to run their quoting, binding, payments, documents, renewals and claims under their own brand. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Contact us about anything in this policy at [email protected].
2. Two kinds of people
Brokers are the people who apply for a brokerage, sign in to the console, and run their business on Noon. For your information, we are the organisation collecting it and this policy is yours.
Brokers' customers are the people who get a quote, buy a policy, or lodge a claim on a brokerage's website. That website is the brokerage's; the brokerage collects your information under its own privacy policy, and Noon processes it on the brokerage's behalf and instructions. Where this policy talks about "customer data", that is what it means. Your first port of call for access, correction or a complaint is the brokerage, whose privacy policy is published on its own site. Section 11 says how we help.
3. What we collect about brokers
- When you apply: the brokerage's name, your name, work email and phone, your AFSL or authorised representative number and licensee, your state, and anything you write in the message. We record the IP address, browser and referring page of the application.
- When you run a brokerage: your account (name, email, role, the password you chose, stored only as a hash, and an authenticator secret if you enable one, stored encrypted), your brokerage's contacts (primary, billing, technical), its legal name and ABN for invoicing, and the insurer credentials you give us to quote with, stored encrypted and used only as you direct.
- As you work: an audit log of the actions that matter, such as sign-ins, document downloads and changes to money, staff or settings, with time, IP address and browser, kept append-only so it can be relied on. Usage of metered features (lookups, texts, AI), so we can bill you and you can see what you were billed for.
- When you write to us: what you send through the contact and support forms, stored so it isn't lost and emailed to the people who answer.
4. What we hold about brokers' customers
Whatever a brokerage's quote and policy require: identity and contact details, the insured, which may be a company, a trust or joint names, the risk being insured (a home, a vehicle, a business), answers to the insurer's questions, payment details, policy and claim records, and the communications the brokerage sent. Payment card numbers never reach us: they go to the brokerage's payment provider directly. Bank details for direct debit are encrypted at rest and purged once a policy is bound. Sensitive information, such as health or criminal history, is collected only where an insurer's questions require it and only as the customer answers it.
Every record is stamped with the brokerage it belongs to and isolated from every other brokerage's at the database itself.
5. Why we use it
To run the platform: to create and provision a brokerage, let its staff sign in, get quotes from the insurers it holds agencies with, take payments to its account, issue documents, chase renewals, lodge claims, and produce its reports. To bill brokerages and account for what they used. To keep the platform secure and honest: rate limiting, fraud and abuse detection, the audit trail. To support brokerages when they ask. To meet our legal obligations.
We do not sell personal information. We do not use customer data to train models. Where a brokerage has switched on AI features, the AI is given the information needed to answer the question in front of it and nothing more; its use is metered so the brokerage can see exactly when it ran.
6. Who we share it with
- Insurers a brokerage holds an agency with receive the quote and policy information their systems need, sent under the brokerage's credentials. This is the brokerage's disclosure, made through us.
- Service providers who run parts of the platform for us, each under contract to use the information only for that purpose: DigitalOcean (hosting, Sydney), Cloudflare (DNS and edge for our own site), Resend (email delivery), Twilio (SMS delivery), Merchant Warrior and Stripe (card and BPAY payments, taken on the brokerage's own facility and settled to its own account), and Anthropic and OpenAI (AI features, where a brokerage has enabled them).
- The brokerage itself, which can see and export everything it collected.
- Regulators and the law, where required.
7. Overseas disclosure
The platform and its database run in Sydney. Some providers in section 6 process data outside Australia: email and SMS delivery, AI features, and card payments taken through Stripe run in the United States. Merchant Warrior processes card and BPAY payments in Australia. Where that happens we take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles, chiefly by contract.
8. Security
Row-level security in the database enforces the boundary between brokerages. Direct-debit bank details and authenticator secrets are encrypted at rest. Passwords are stored as salted hashes. Every connection from a browser or an email client is encrypted in transit. Documents are served from the platform's own origin, never a public bucket. The audit log is append-only. Access to production systems is limited to named people. No system is perfectly secure; if a breach is likely to cause serious harm we will notify affected people and the OAIC as the Notifiable Data Breaches scheme requires.
9. How long we keep it
A brokerage's book is kept for as long as it is a customer and after it leaves: the ledger and the audit trail are financial records we are required to hold, and the rest is kept with them. Nothing in the book is deleted on a timer. What is swept: access logs and sign-in records after two years, usage events after two years (they back statements), the assistant's chat transcripts after one year, sign-in codes and reset links a week after they expire, and direct-debit bank details at bind or after 90 days if a policy never binds. Applications, and contact and support messages, are kept.
10. Cookies
Our own site uses Snitcher, a visitor-identification service, to work out which business a visit comes from, using the network address and a first-party cookie, so we can follow up with brokerages that have looked at the platform. It runs on noonapp.com.au only, never on a brokerage's site or panel. Snitcher's own privacy notice is at snitcher.com/privacy-policy. The console and a brokerage's customer panel set one session cookie each, needed to keep you signed in, and nothing else.
11. Access and correction
Brokers: you can see and change most of what we hold about you in the console; for anything else, email us and we will respond within 30 days.
Brokers' customers: ask the brokerage first. It holds your information and can see and correct it directly, and its privacy policy is on its site. If you can't reach it, email us at [email protected] and we will help, including by passing your request to the brokerage.
12. Complaints
Write to [email protected]. We acknowledge a complaint within five business days and aim to resolve it within 30. If you are not satisfied you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
13. Changes
We will update this policy as the platform changes and note the date at the top. Material changes are announced to brokerages by email and in the console.