Privacy Policy
GoNinja ("we", "us") provides read-only cloud security and compliance scanning and Terraform generation at goninja.com.au. We take privacy seriously — this page explains, in plain language, what we collect, why, where it lives, and your rights. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).
What we collect
- Account details — your email address and a securely hashed password, managed by AWS Cognito. If you enable two-factor authentication, the TOTP secret is stored by Cognito, not by us.
- Billing — payments are processed by Stripe. Your card details go directly to Stripe and are never seen or stored by GoNinja. We keep only your subscription status and Stripe customer reference.
- Cloud scan data — the configuration metadata and security findings produced when you scan an account you have connected (for example: resource names, settings, and misconfiguration findings). We never collect your cloud credentials — access works through a read-only IAM role that you create and can delete at any time (see our Security page).
- Usage basics — standard technical logs (timestamps, IP addresses, request paths) needed to operate and secure the service.
What we never do
- We never sell your data. To anyone. Ever.
- We never store your cloud passwords, access keys, or secrets. Scanning is name-matched and read-only; secret values are never read.
- We never modify anything in your cloud account — the access role is read-only by design.
Where your data lives
All GoNinja data is stored in the AWS Sydney region (ap-southeast-2), encrypted in transit (TLS) and at rest. Scan results and generated Terraform are stored in encrypted storage tied to your account.
Third parties we rely on
- Amazon Web Services — hosting and storage (Sydney region).
- Stripe — payment processing.
- Google Workspace — sending transactional email (verification codes, alerts) from support@goninja.com.au.
Each processes data only as needed to provide their service to us.
Retention and deletion
We keep your account data while your account exists. If you close your account — or email us and ask — we delete your account data and scan history within 30 days, except where we're legally required to keep billing records.
Your rights
You can ask us to access, correct, or delete your personal information at any time. Email support@goninja.com.au and we'll respond within 2 business days. If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
Changes
If we make material changes to this policy, we'll note the new effective date here and, for significant changes, email account holders.