Privacy policy

Who we are

Cannonball is operated by Cannonball, an Australian company being registered, and until then by its founder (“we”, “us”), who collects and holds the personal information described in this policy. Once registration is complete, this policy will give the company’s full name and ABN.

We provide store-level shelf data to businesses. For anything about privacy, use our contact form (choose “Privacy request”).

What we collect

We collect this information from you directly, and the logs automatically when your browser talks to our server. You can read this website without giving us anything else. If you don’t provide the details needed to create an account, we can’t provide the app.

What we don’t collect

• We don’t use advertising or analytics trackers, and we don’t build profiles of visitors.
• We don’t buy personal information or combine it with data from brokers.
• The shelf data in Cannonball is about products and stores, not people. It contains no shoppers’ personal information.
• We don’t ask for sensitive information (such as health or political views), and ask you not to send it.

How we use it

We use personal information only to:

• provide, secure and support the website and Cannonball;
• reply to your messages;
• email you once when Cannonball opens, if you asked for early access;
• bill you and meet our legal, tax and accounting obligations;
• send service messages, such as alerts you set up, security notices and changes to our terms;
• improve the product, using aggregated usage information that doesn’t identify you.

We send marketing email only if you ask for it, and every marketing email has a working unsubscribe link, as the Spam Act 2003 requires. We don’t sell, rent or trade personal information, and we don’t use it for anything unrelated to the above without your consent, unless the law requires it.

Ask. When you use Ask in the app, your question and the shelf data needed to answer it are sent to an AI model provider to produce the answer. Your questions are not used to train AI models.

Cookies and tracking

This website (cannonballdata.com) sets no cookies and loads no third-party scripts, fonts or trackers, which is why there’s no cookie banner. If you choose a light or dark theme, that choice is saved in your own browser’s local storage and never sent to us.

The app (app.cannonballdata.com) uses strictly necessary cookies to keep you signed in and protect against forged requests. It doesn’t use advertising or cross-site tracking cookies.

Who we share it with

We share personal information only with service providers who help us run Cannonball, under terms that limit their use of it to providing that service:

We never share your products, rivals, notes or questions with retailers or with other customers. We may disclose information if the law requires it, or to protect someone’s safety, and if Cannonball is sold we’ll tell you before your information moves to a new owner.

Where it’s stored

Our server, its database and its logs are in Australia. Email passes through Resend in the United States, so a contact message or an early-access email address is processed there on its way to us or to you. Before we send information overseas we take reasonable steps, as Australian Privacy Principle 8 requires, to make sure the provider handles it consistently with the Australian Privacy Principles.

How long we keep it

• Website and server logs: up to 30 days, longer only while investigating a security incident.
• Early-access emails: until we’ve told you Cannonball is open, or you ask us to remove you, whichever comes first.
• Contact-form messages: as long as we need them to deal with your request, and no more than 2 years.
• Account information: while your account is open, then deleted within 90 days of closure, unless you ask sooner.
• Billing records: 7 years, as Australian tax law requires.

Security

We protect information with encryption in transit, access limited to people who need it, and regular updates. No system is perfectly secure. If a data breach is likely to cause you serious harm, we’ll notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

Your rights

You can ask to see the personal information we hold about you, correct it, export it, or have it deleted, through our contact form (choose “Privacy request”). We’ll respond within 30 days and won’t charge you for a reasonable request. If we can’t do what you ask, we’ll explain why in writing. You can deal with us anonymously or under a pseudonym when you’re only asking a question.

If you’re in the EU or UK

If the GDPR or UK GDPR applies to you, we process your information on these legal bases: to perform our contract with you (running your account), our legitimate interests (security, replying to you, and improving the service, balanced against your rights), legal obligations (tax records), and consent (early-access and marketing email, which you can withdraw at any time). You also have the rights to restrict or object to processing and to data portability, and you can complain to your local data protection authority. Transfers out of the EU or UK rely on standard contractual clauses or an equivalent safeguard.

Complaints

If you’re unhappy with how we’ve handled your information, tell us through our contact form (choose “Privacy request”) and we’ll respond within 30 days. If you’re still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes

If we change this policy in a way that matters, we’ll update the date at the top of this page and, if you have an account, email you at least 14 days before the change takes effect.