Privacy Policy

This site is operated by Global Growth Portal (ABN 84 892 449 249). We are responsible for the personal information described here. This policy follows the Australian Privacy Principles.

Only what the service needs to work. Specifically:

When you create an account

Your email address, your company name, and which country you are in. Your password is never stored — only a one-way hash of it, which cannot be turned back into your password.

When you accept an NDA

The exact text you agreed to, the moment you agreed, your IP address, and your browser’s user-agent string. This is deliberate: it is what lets either side prove later what was agreed and by whom. It is kept even if access is later withdrawn.

When you pay

The amount, the GST component, what it was for, and Stripe’s reference for the transaction. We never receive or store your card number — that goes directly to Stripe on their own page.

When you publish a listing

Everything you write in it. Your teaser is public; the full details are not.

When you message another user

The messages, who sent them, when, and when they were read.

When you sign in

The time you last signed in.

Analytics, only if you agree. If you accept cookies on our banner, Google Analytics records which pages you visit and their titles, anything you type into the opportunities search, how you arrived, your device and browser, and your approximate location. We use it to see how people find and use the site, and to measure our advertising. If you reject, or ignore the banner, nothing from Google is loaded. You can change your answer at any time under Cookie settings at the foot of any page. The Cookie Notice lists every cookie we set.

• To give you an account and keep it secure.
• To take payment and issue you a tax-compliant receipt.
• To show your listing to the right people, and to keep the rest of it protected.
• To prove who accepted which NDA and when.
• To let you and another business talk to each other.
• To send you the emails listed below.
• To meet our record-keeping obligations, particularly for tax.

We do not sell your information. Your account, your listings and your messages are never shared with advertisers; the only information used to measure our advertising is the Google Analytics information above, and only if you accept it. Every email we send is about something you did — verifying your address, resetting your password, a listing decision, a receipt, an unlock. There is no marketing list.

Other users. Your company name and country appear on your listings. Once somebody unlocks your listing, the two of you can see each other in the message thread. Your email address is not shown to other users by the site.

Our service providers. We use five, and no others. Each sees only what it needs:

Stripe — payments

Your email address and the transaction. Stripe is the party that handles your card details; we never see them.

Resend — email delivery

Your email address and the contents of the emails we send you.

Supabase — database hosting

Everything in section 2 is stored there, encrypted in transit and at rest.

Vercel — website hosting

Standard server request logs, which include IP addresses.

Google — analytics, only if you accept cookies

The Google Analytics information described in section 2. Not your name, your email address, your messages, or the protected details of any listing.

Otherwise, only where we have to: if the law requires it, or to investigate a complaint, a security incident, or a suspected breach of our terms.

We are required to tell you this plainly. Our service providers store and process data outside Australia, principally in the United States. Stripe, Vercel and Google also operate in other countries as part of running a global network.

By using the site you consent to that disclosure. We take reasonable steps to work only with providers that maintain recognised security standards, but once information is overseas, Australian privacy law may not apply to it in the same way.

Your account

Until you close it, and then only what the rows below require us to keep.

Payment records, including the GST component

At least five years. Australian tax law requires it and we cannot delete them on request.

NDA acceptances

Kept indefinitely. An NDA can be relied on years later; deleting the proof of it would leave both sides worse off.

Messages

Kept while both accounts exist, so neither side loses their side of the conversation.

Email verification and password reset links

Only the hash of the link is stored, and it expires — 24 hours for a verification link, one hour for a password reset.

Server logs

Kept by our hosting provider on their own short retention schedule.

• Everything travels over HTTPS.
• Passwords are hashed, never stored or recoverable.
• Full listing details are enforced server-side. They are never sent to a browser that has not paid for them — hiding them in the page would not be protection.
• Access is granted only after payment is confirmed directly by Stripe.
• Sign-in attempts and other sensitive actions are rate-limited.

No system is perfectly secure. If a breach occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

You can ask us to:

• tell you what personal information we hold about you;
• correct anything that is wrong;
• delete your account and the information we are not required to keep — see section 6 for what we cannot delete, and why.

We will respond within 30 days. There is no charge. If we refuse a request we will tell you why in writing.

Tell us first at opportunities@globalgrowthportal.com. We will acknowledge within five business days and respond within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Email opportunities@globalgrowthportal.com. Post: Victoria, Australia.