Privacy Policy

1. Who we are

Mount Bensley Pty Ltd (ACN 686 491 476, ABN 92 686 491 476), an Australian company registered in New South Wales, operates solstral.com and the Solstral platform ("Solstral", "we", "us"). Mount Bensley Pty Ltd is the entity responsible for personal information handled through the platform, and also trades under the registered business name Adcrayons. This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and, where applicable, the GDPR for individuals in the EEA/UK.

2. Two roles, two datasets

As a controller, we collect information about our own customers and site visitors: account details (name, email, company), billing information, support correspondence, and usage telemetry. As a processor, we host Customer Data — the contact records our customers store in their workspaces. Our customers control that data; if your information appears in a customer's workspace, contact that organisation first, and we will assist them with your request.

3. What we collect and why

• Account data — to create and secure your account, provide support and send service notices (contract performance).
• Billing data — processed by our payment provider; we do not store full card numbers (legal obligation and contract).
• Usage telemetry — feature usage and diagnostics, to operate and improve the Service (legitimate interests).
• Site analytics — privacy-conscious, consent-gated analytics on the marketing site (consent).
• Email interaction data — opens, clicks, bounces and complaints on email sent through the platform, processed on behalf of the sending customer.

4. What we never do

We do not sell personal information. We do not use Customer Data to train machine-learning models. We do not send marketing to our customers' contacts.

5. Storage and security

Data is hosted on Amazon Web Services in Sydney, Australia (ap-southeast-2), encrypted at rest and in transit. Access is role-restricted, logged and protected by MFA. See our Security page for the full control set.

6. Disclosure

We share personal information only with the sub-processors published at solstral.com/legal/subprocessors and listed in our DPA, with professional advisers under confidentiality, or where required by law. Where a public authority asks us for personal information we follow the procedure in section 7 below, and we will challenge overbroad demands where lawful.

Most of those providers are located outside Australia — principally in the United States — so using the Service involves cross-border disclosure under Australian Privacy Principle 8. The list names each provider's location and what it can access.

7. Requests from public authorities

We receive requests for personal information from courts, law-enforcement agencies, regulators and other public authorities. We have a written policy governing how those are handled, and it applies to every request in every country. All requests route to a single point of contact (our Director); no one else may confirm, deny or respond, and no record is searched before the review below is complete.

Legality review. Nothing is disclosed until we have established that the request is compulsory rather than voluntary, that the authority has jurisdiction over us, that the instrument is valid on its face, that a specific legal basis exists and that the scope actually follows from it, and that we are the right party at all. We are an Australian company and Customer Data is hosted in Australia; a foreign authority generally cannot compel us directly without a recognised cross-border arrangement or an order enforceable in Australia. Any request that is not plainly valid and plainly narrow goes to a lawyer before we respond.

Challenging over-broad requests. We object where a request is invalid, exceeds the authority’s power, lacks a valid basis, is disproportionate in scope, or seeks data we hold as a processor without the controller being involved. We escalate from written objection, to negotiated narrowing, to formal challenge through counsel where the defect is material. We do not comply while challenging unless compelled to, and we do not treat an unanswered objection as consent to disclose.

Data minimisation. Where we must comply, we disclose only the individuals, categories and period the instrument compels — nothing adjacent. We never grant bulk access, direct system access, credentials or a standing feed, and we never build tooling for an authority. Third-party personal information incidental to a request is redacted.

Documentation. Every request is logged, with the review findings, any objection made, and what was ultimately disclosed and why.

Where you are the controller. If the data sought sits in your workspace, you are the controller and we are the processor. Our default position is that the authority should approach you directly, and we say so in writing wherever the law allows. Where a non-disclosure order is attached we seek to have it lifted, narrowed or time-limited so that we can tell you.

8. Retention

Account data is retained while your account is active and for up to 7 years afterwards where required for tax and legal purposes. Customer Data is deleted within 30 days of workspace termination. Backups age out on a rolling schedule of no more than 35 days.

9. Your rights

You may request access to, correction of, or deletion of your personal information, object to processing, or request portability by emailing hello@solstral.com from the address we hold for you. We respond within 30 days and we do not charge for a request. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

If you are in the EEA or the United Kingdom, the GDPR and UK GDPR give you the rights below over personal information for which we are the controller. You exercise any of them by emailing the same address, and we will not treat you differently for asking.

• Access — a copy of the personal information we hold about you, and confirmation of how and why it is processed.
• Rectification — correction of information that is inaccurate, and completion of information that is incomplete.
• Erasure — deletion of your personal information where we have no overriding legal basis or obligation to keep it.
• Restriction of processing — to have processing paused while a dispute about the accuracy of the data, or about our legal basis for holding it, is resolved.
• Portability — the information you provided to us, in a structured, commonly used, machine-readable format, and transmitted directly to another provider where that is technically feasible.
• Objection — to processing we carry out on the basis of our legitimate interests, and at any time to direct marketing.
• Withdrawal of consent — where processing relies on your consent, such as the site analytics described in section 10, you may withdraw it at any time. Withdrawing consent does not affect processing already carried out before you withdrew it.
• Not to be subject to a decision based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. We do not make decisions of that kind — see section 14.

You may also lodge a complaint with the supervisory authority in the EEA or UK country where you live or work, or where you believe the issue arose, without contacting us first.

If your personal information appears in a customer’s workspace rather than in our own records, that customer is the controller and we act on their instructions. Contact that organisation first; we will assist them in responding to you within the same timeframes.

10. Cookies

The marketing site uses only essential cookies plus consent-gated analytics. The application uses session cookies necessary to keep you signed in. We honour withdrawal of consent at any time via the cookie banner.

11. Google user data (calendar and email integrations)

Connected Google Calendars

If you choose to connect a Google account to Solstral's scheduling and meetings features, we access your Google Calendar data through Google's authorised OAuth APIs, requesting only the minimum scopes needed:

• Read for availability — we read your calendar's free/busy information (the calendar.events.freebusy scope) and the list of calendars you are subscribed to (the calendar.calendarlist.readonly scope) solely to calculate the times you are available, let you choose which calendars count, and prevent double-booking on your booking pages. We do not read the contents of your events.
• Write for booked events — when a meeting is booked, rescheduled or cancelled, we create, update or delete the corresponding event on your calendar (the calendar.events scope), including generating a Google Meet link where you enable it.
• Account identification — we read your Google account email address (the userinfo.email scope) to identify and label the connected calendar.

Connected Gmail mailboxes

If you choose to connect a Google account to Solstral's connected-inbox feature (Settings → Your connected inbox), we access that mailbox through Google's authorised OAuth APIs, requesting only the minimum scopes the feature needs:

• Read your own messages — we read the messages in the mailbox you connected (the gmail.readonly scope) so your one-to-one correspondence appears inside Solstral: in a mailbox visible only to you, and — where the person you are corresponding with matches a contact or company record in your workspace — on that record's timeline, so your team can see the conversation history beside the deal it belongs to. We need the message body, not only its headers, because the timeline shows what was actually said; that is why the narrower gmail.metadata scope is not sufficient. We never modify, label, archive or delete anything in your mailbox, and we never access a mailbox you have not personally connected.
• Send on your behalf — when you reply from Solstral, we send that message from your own address (the gmail.send scope) so it arrives as you and threads correctly in the recipient's mail client. gmail.send is the narrowest scope capable of sending; every alternative would additionally grant read, draft or delete access we neither need nor want.
• Account identification — we read your Google account email address (the userinfo.email scope) to identify and label the connected mailbox.

Messages pulled from a connected mailbox are stored as activities in your own workspace, encrypted at rest, and are visible only to you unless a message is attached to a record your colleagues can already see. Bulk and marketing email is never sent through Gmail — it goes out from your workspace's own verified sending domain. You can disconnect at any time from Settings, which revokes our access immediately, and you may ask us to delete synced messages by emailing hello@solstral.com.

What we sync, and for how long. We sync only forward from the moment you connect: messages that arrive after that point. We do not backfill your mailbox history, and messages older than the connection are never read. Synced messages are kept as activities in your workspace for as long as you keep them there — they are CRM records like any other, and your team can delete individual messages, or all of them, at any time. Disconnecting stops the sync and revokes our access immediately. Everything is deleted within 30 days of workspace termination, and backups age out on a rolling schedule of no more than 35 days.

We use this Google user data only to provide the user-facing features described above, and only while your Google account remains connected — you can disconnect at any time from the app, which revokes our access. OAuth tokens are stored encrypted and are never logged in plaintext. We do not sell Google user data, do not transfer or share it with third parties except as necessary to provide the feature you requested (or for security or legal reasons), do not use it for advertising of any kind, and do not use it to train machine-learning models. We do not allow humans to read it except with your affirmative consent, for security, or where required by law.

AI features and your mail. Solstral’s optional AI features (section 14) are the one circumstance in which content from a connected mailbox leaves our systems, and they act only when a person in your workspace invokes them. If you ask the assistant to summarise a thread or help draft a reply, the message content that request needs is sent to our model provider — named in our sub-processor list — solely to produce the answer you asked for. It is never used to train machine-learning models, not ours and not the provider’s; it is retained by them only transiently for abuse monitoring and then deleted; and it is never used for advertising. Nothing is sent unless someone uses an AI feature, and an owner or admin can switch AI off for the entire workspace in Settings → AI, which prevents any mailbox content reaching a model provider by any route.

Solstral's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

12. Meta Platform Data (Instagram, Facebook and Threads)

If you connect a social account to Solstral's social engagement features, we access data from Meta's platforms through their authorised APIs — on your instruction, and only for accounts you own or administer. You connect through Meta's own login and consent screens; we never ask for or store your password for those platforms. We request the minimum permissions each feature needs:

• Instagram — instagram_business_basic to identify the connected professional account, instagram_business_manage_comments to read and reply to comments on that account’s own posts, instagram_business_manage_messages to receive and send that account’s direct messages, and instagram_business_content_publish to publish the feed posts you schedule from your content calendar.
• Facebook Pages and Messenger — pages_show_list so you can choose which Page to connect, pages_read_engagement and pages_read_user_content to read that Page’s own posts and the comments left on them, pages_manage_posts to publish, edit and delete the posts you schedule, pages_manage_metadata to subscribe the Page to notifications so new comments and messages reach your inbox, pages_manage_engagement to reply to and hide comments on that Page’s posts, and pages_messaging to receive and send that Page’s Messenger conversations.
• Threads — threads_basic to identify the connected profile, threads_content_publish and threads_delete to publish and remove the posts you schedule, threads_read_replies and threads_manage_replies to read, answer and hide replies to your own posts, and threads_keyword_search and threads_profile_discovery to find public posts and profiles relevant to keywords you configure.

Through those permissions we receive the connected account's identifiers (account id, username or Page name, profile picture), and the content, sender identifier and timestamp of messages and comments sent to that account, together with delivery and engagement metadata. Where the sender matches a record in your workspace, the conversation is attached to that record.

How we use it. Only to provide the features you connected the account for: showing those conversations in your workspace's shared inbox, attaching them to your CRM records, sending the replies your team writes or the rules you configure, and reporting on your own account's engagement. For this data we act as a processor and you are the controller — the same as for the rest of your Customer Data.

What we never do. We do not sell Meta Platform Data, do not license or broker it, do not use it for advertising, ad targeting, audience building or profiling, do not use it to make eligibility decisions, and do not use it to train machine-learning models. We do not share it with anyone except the sub-processors published at solstral.com/legal/subprocessors that host and operate the service, or where required by law. We do not allow humans to read it except with your affirmative consent (for example when you raise a support request), for security, or where required by law. Access tokens are encrypted at rest with a dedicated key, are never logged in plaintext, and are held only for as long as the connection exists.

Automated replies. Where you enable automated replies, disclosure that the reply is automated is on by default, every automated conversation offers a handoff to a person on your team, and sending stays within each platform's messaging-window rules — free-form only inside the customer-care window, and approved templates outside it. You are responsible for having the consent each platform’s rules require before messaging someone.

Solstral's access to and use of information received from Meta's APIs adheres to the Meta Platform Terms and the Meta Developer Policies, including their restrictions on the use, sharing and retention of Platform Data.

Deleting Meta Platform Data

You can end the connection and remove the data at any time, by any of these routes:

• Disconnect the account in Solstral at Settings → Social accounts. We stop receiving messages and comments from that account immediately and send nothing further from it. You can also revoke our access directly from Instagram's apps and websites settings, Facebook's business integrations settings, or Meta Business Manager.
• Delete the conversations in your workspace — an admin can remove them at any time.
• Ask us to erase everything by emailing hello@solstral.com from the address on the account, naming the connected account. We confirm and complete the erasure — including any stored access tokens — within 30 days.

When a workspace is terminated, its social conversations and tokens are deleted within 30 days, and backups age out on a rolling schedule of no more than 35 days. If you are a member of the public whose message to a business appears in that business's Solstral workspace, contact the business you messaged — it controls that data, and we will assist it with your request.

13. Zoom

If you connect a Zoom account to Solstral’s scheduling and meetings features (Meetings → Calendar → Video conferencing, the same panel as Settings → Calendar), we access that account through Zoom’s authorised OAuth APIs, on your instruction and only for the account you personally connect. Each user connects their own Zoom account through Zoom’s own consent screen; there is no account-wide installation, and we never ask for or store your Zoom password.

We request only the scopes the feature needs:

• meeting:write:meeting — create a Zoom meeting when an invitee books a time on your scheduling page.
• meeting:update:meeting — move that meeting when the booking is rescheduled.
• meeting:delete:meeting — delete it when the booking is cancelled.
• user:read:user — read the connected account’s email address and Zoom user ID, so we can label the connection in Settings and recognise it if you later remove the app in Zoom.

No read scope is requested. Moving a meeting changes neither its join URL nor its passcode, so the reschedule path answers from data we already hold rather than re-reading the meeting from Zoom.

What we receive and store. Your Zoom account email address and Zoom user ID; and, for each booking, the meeting ID, join URL and passcode, which are rendered into the confirmation email and the calendar invitation. These are held in our database in Sydney, Australia. OAuth refresh tokens are encrypted at rest with AES-256-GCM using a key held outside the database and are never written to logs in any form; access tokens are short-lived.

What we send to Zoom. Only the meeting topic, start time and duration. No invitee personal information is transmitted beyond the booker’s name where it appears in the meeting topic.

What we never access. Meeting content, recordings, transcripts, participant lists, chat, your Zoom contacts, or any account data beyond the two fields above. We do not sell Zoom data, do not use it for advertising or profiling, do not use it to train machine-learning models, and do not share it with anyone except the sub-processors published at solstral.com/legal/subprocessors that host and operate the service, or where required by law. We do not allow humans to read it except with your affirmative consent, for security, or where required by law.

Disconnecting and deletion. Disconnect at Meetings → Calendar. Solstral calls Zoom’s revoke endpoint and deletes the stored connection and its tokens. You can also remove the app from your Zoom account at any time (Zoom App Marketplace → Manage → Added Apps); Zoom sends us a signed deauthorisation notice, and we delete the connection and its tokens and confirm the deletion back to Zoom. Meetings already created on your Zoom account are not removed by disconnecting — delete those in Zoom if you want them gone. To have anything remaining erased, email hello@solstral.com.

14. Artificial intelligence

Solstral includes optional AI features: an in-app assistant, a website chatbot, AI steps inside automations, and AI-assisted drafting. These are the only parts of the product that send data to a third-party model provider.

• What is sent, and when. Nothing is sent unless someone uses an AI feature. When they do, we send only the content that feature needs to respond — for example the records in view, the message being drafted, or the knowledge-base article being answered from.
• Who receives it. OpenAI, in the United States, named in our sub-processor list. There is one model provider, chosen and published by us — a workspace cannot connect a different one, because that would send your data to a company we have not disclosed to you.
• Training and retention. Customer Data is never used to train machine-learning models — not ours, and not the provider's. Content sent to the model provider is retained by them only transiently for abuse monitoring and deleted within 30 days; it is never added to a training set or used for any purpose of their own.
• Turning it off. An owner or admin can disable AI for the whole workspace in Settings → AI. This is enforced in the application, not merely a setting: with AI off, no Customer Data reaches a model provider by any route, including automations.
• Records of use. We log which AI feature ran, which model was used, on whose behalf and what it did. Prompt and response content is not stored unless a workspace explicitly opts in.
• Human oversight. AI features assist people; they do not make decisions about individuals on their own. Actions that send email, delete records or act in bulk require a person to confirm them.

15. Automated decision-making

Solstral does not make automated decisions that produce legal or similarly significant effects about individuals. Customers can configure automations that route, assign, tag or score records based on rules they define — those are the customer's decisions, made with the customer's rules, and the customer is the controller for them. If we introduce any automated decision-making of our own that significantly affects individuals, we will describe it here before it takes effect, as required by the Privacy Act from 10 December 2026.

16. Recipients of email sent through Solstral

If you received a marketing email sent through our platform, the sender controls your data. Every such email includes a one-click unsubscribe that takes effect immediately across the sender's lists. To escalate abuse, email hello@solstral.com with the message headers.

17. Changes

We will post changes here and, for material changes, notify account holders by email at least 14 days in advance.

18. Contact us

Solstral is operated by Mount Bensley Pty Ltd (ACN 686 491 476, ABN 92 686 491 476), an Australian company registered in New South Wales, which also trades under the registered business name Adcrayons. Mount Bensley Pty Ltd is the entity responsible for personal information handled through the platform.

For any privacy question, to access or correct your personal information, or to make a privacy complaint, email hello@solstral.com. We acknowledge complaints within 5 business days and aim to resolve them within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to your local supervisory authority if you are in the EEA or UK.