Privacy policy

Gundesk is operated by [Operator legal name] (ABN [ABN]) (“we”, “us”). This policy explains how we handle personal information in the Gundesk service and on this website, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Gundesk is used by licensed firearms dealers. When a dealer records information about its customers, suppliers and other people in Gundesk, the dealer decides what is collected and why, and we handle that information on the dealer's behalf to provide the service. For information about the people who use Gundesk (dealer owners and staff) and about businesses that subscribe, we are responsible.

If you are a dealer's customer, the dealer's own privacy notice also applies, and the dealer is usually the best first contact about your records.

About people who use Gundesk

• Name, email address, role, the premises you work at and your stored signature.
• Sign-in details handled by our authentication provider, such as multi-factor settings and sign-in events.
• What you do in the service, recorded in an audit log.

About subscribing businesses

• Business and trading names, dealer licence details and premises addresses.
• Billing contacts and payment records. Card details are held by our payment provider, not by us.

Records a dealer keeps in Gundesk

• Names, addresses, dates of birth and contact details of customers, suppliers and other parties.
• Firearms licence numbers, categories and expiry dates, permit to acquire details, and images of licences and permits.
• Firearm storage addresses.
• Firearm particulars and the transaction history that links them to people, signatures and photographs.

The Privacy Act does not classify firearms licence or holdings data as “sensitive information”, but we treat it as high risk: together it shows who keeps which firearms where. Amnesty surrenders can be recorded without identifying the person, as s 87(2A) of the Firearms Act 1996 (Vic) allows.

Technical information

IP addresses, browser and device details, and request logs, used to run and secure the service. Our logs record identifiers, not the content of customer records.

• From dealers and their staff, when they enter or import records.
• From a dealer's customers directly, through forms and tablet signing sessions the dealer sends or sets up.
• From services a dealer chooses to connect, such as an online store, cloud folders or a shop mailbox.
• Automatically, when you use the website or the service.

• To provide the service: the register, permits, returns, signing and the rest.
• To secure the service, prevent misuse and keep an audit trail.
• To support users, and to bill subscribing businesses.
• To meet our legal obligations.
• To improve Gundesk using aggregated or de-identified information that does not identify anyone.

We do not sell personal information, use it for advertising, or use a dealer's records for any purpose of our own.

We use these service providers to run Gundesk:

• Render: hosts the application and its database, in Singapore.
• Cloudflare R2: stores uploaded documents such as licence and permit images, configured for its Oceania (Australian) region. Documents are encrypted before upload.
• WorkOS: authentication and single sign-on, in the United States.
• Stripe: billing and card payments, in the United States and other countries.
• Only when a dealer turns the feature on: Twilio (SMS, United States), our email delivery provider, and Anthropic (reading uploaded documents to pre-fill forms, United States).

Dealers must show their register to police and answer notices from Victoria Police under the Firearms Act 1996 (Vic). We disclose information to others only where the law requires or authorises it, such as a warrant or court order, and we will tell the affected dealer unless the law prevents us.

Gundesk's application and database are hosted in Singapore, so personal information in the service is disclosed to and stored there. Authentication, billing and optional services involve the United States. Uploaded documents are stored in Australia.

Before disclosing information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs: contracts that limit use to providing their service, and technical controls. Licence numbers, dates of birth and storage addresses are encrypted field by field before they reach the database, so the hosting provider stores them only in encrypted form.

• Encryption in transit (TLS) and at rest, plus field-level encryption (AES-256-GCM) for licence numbers, dates of birth and storage addresses.
• Documents encrypted with a per-document key before upload, and downloaded only through the application after an access check.
• Each business's records isolated by row-level security in the database.
• Role-based access, multi-factor authentication and single sign-on.
• A hash-chained audit log, so changes and deletions can be detected.
• No firearm particulars in SMS or email notifications.

More detail is on our security page.

A dealer must keep each register entry for five years (Firearms Act 1996 (Vic) s 87(5)), so register entries and their particulars are kept for at least that long. Other dealer records are kept for seven years by default, which the dealer can change. Account and billing records are kept while the subscription is active and as long afterwards as tax and other laws require.

When information is no longer needed for any purpose allowed by law, we destroy it or de-identify it. When a subscription ends, the dealer can export its records first.

You can ask for the personal information we hold about you, and ask us to correct it, by emailing hello@gundesk.com.au. If the information is a dealer's record, we will pass your request to the dealer and help them respond. We reply within 30 days. Corrections to register entries are made as amendments, so the original stays visible, as the law requires.

If we suspect a data breach we assess it promptly, and within 30 days. If it is likely to result in serious harm, we notify the affected dealers, the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Gundesk sets one cookie, needed to keep you signed in. Your light or dark theme choice is kept in your browser's local storage. We use no analytics, advertising or tracking cookies.

Contact us at hello@gundesk.com.au or write to [Operator legal name], [Postal address], Victoria, Australia. We acknowledge complaints within 5 business days and aim to resolve them within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We may update this policy; the date at the top shows the latest version.