This policy explains what personal information Northing collects, why, and what you can do about it. It covers the Northing application at northing.com.au and the emails it sends. Plain English is the intent — if anything here is unclear, ask us.
Who we are
Northing is a practice-management and planning-research application for town planning firms, operated by Rogaland Pty Ltd (ABN 51 694 037 619), a Queensland company. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Two kinds of information
Northing holds two different things, and they are treated differently:
- Account information about the people who log in — collected by us, for running the service.
- Practice records — the clients, enquiries, projects, documents and correspondence a planning practice keeps in Northing. The practice collects that information under its own privacy obligations; we hold it on the practice's behalf and act on its instructions.
What we collect
When a practice signs up and people log in
- Name, email address, phone number and role of each person with a login, and the practice's name, ABN and billing address.
- Login times, the pages and actions used, and the device and browser type — the same information any web server records.
- Payment is handled by Stripe. We never see or store card numbers or bank details; we keep Stripe's references for the customer, subscription and invoices.
Practice records entered into Northing
- Client and contact details, property addresses and lot/plan numbers, enquiry and project notes, statutory dates, documents and plans, and emails sent to or received through the practice's Northing mailbox.
- Notes a person leaves for a colleague, and the record of who changed what — Northing attributes every manual change to the person who made it.
When you simply visit the public pages
- Our web server keeps standard access logs (address requested, time, browser type, a masked IP address) for 30 days, used for security and to count visits. We do not run advertising trackers on northing.com.au.
Why we use it
- To provide the service: showing a practice its own records, tracking statutory timeframes, sending the notifications a person has turned on.
- To run the AI-assisted features a practice chooses to use — drafting a scope of work or client email, reading council mapping, summarising correspondence. The relevant record (for example a planning profile or an email) is sent to our AI provider to produce the draft; see "Who we share it with".
- To look up property and planning information from government and council mapping services, which means sending them the address or lot/plan being researched.
- To bill the practice, answer support requests, and keep the service secure and working.
We do not sell personal information, and we do not use practice records for any purpose other than providing the service to that practice.
Who we share it with
We use a small number of providers to run Northing. Each receives only what it needs:
- DigitalOcean — hosting. Northing and its database run in Sydney, Australia. Nightly backups stay in Australia.
- Stripe — payments and invoicing (Stripe Payments Australia; data may be processed in the United States).
- Anthropic — the AI model behind the drafting and mapping-reading features. Content sent through its API is not used to train Anthropic's models and is retained only briefly for abuse prevention. Processed in the United States.
- AgentMail — the mailboxes that send and receive each practice's Northing email. United States.
- Sentry — error monitoring, so we learn about faults; error reports can include the page and account involved. Hosted in the European Union.
- DocuSeal — electronic signing of scopes of work, when a practice uses it.
- Xero — only if a practice connects its own Xero account, and only the invoice and contact data it chooses to send.
- Queensland Government and local council mapping and register services — receive the property address or lot/plan being looked up.
Where a provider is outside Australia, it is listed above with its location. We do not otherwise send personal information overseas. We disclose information to authorities only where the law requires it.
Where it lives and how long
- Practice records and account information are kept for as long as the practice subscribes. On cancellation the practice can export its records; we delete them 90 days after the subscription ends, and they drop out of backups within a further 14 days.
- Server access logs are kept for 30 days. Error reports in Sentry for 90 days.
- Invoices and payment records are kept for the period Australian tax law requires.
Security
All traffic to Northing is encrypted (HTTPS). Each practice's records are separated from every other practice's, and access within a practice is controlled by the roles its own administrators set. Our staff access practice records only to provide support or operate the service. Databases are backed up nightly in Australia. No system is perfectly secure; if we become aware of a breach affecting your information we will tell affected practices promptly and meet our obligations under the Notifiable Data Breaches scheme.
Cookies
Northing sets a session cookie to keep you logged in, a cookie that protects forms against forgery, and a preference for light or dark mode. None of these are used for advertising or shared with third parties.
Your rights
- Access and correction: people with a Northing login can see and edit their own account details. For information in a practice's records, contact that practice; if it asks us to, we help.
- Deletion: a practice administrator can remove a person's login at any time, and can ask us to delete the practice's data in full.
- Emails: every notification Northing sends can be turned off per person in their profile. Billing emails continue while there is an active subscription.
- Complaints: write to us first — we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
If this policy changes in a way that matters, we tell practice administrators by email before it takes effect and update the date at the top of this page.
Contact
Rogaland Pty Ltd (ABN 51 694 037 619), Queensland, Australia. Email james@rogaland.com.au or use the contact form.