Legal
This Privacy Policy explains how Cornerstone Media Pty Ltd, through Throughline, collects, uses, and protects your personal information. This is an interim version, currently under legal review. If you have questions, contact phil@cornerstonemedia.com.au.
When you create an account we collect your name, email address, and organisation name. When you use the platform we collect the content you put into it: the stories you write, any source document you upload, any text you paste in for review, any grant application material you draft, and any governance policies you upload on the Governance page. We also collect usage data and log data including IP address and session information. When you choose First Draft, Second Read or Cold Read on the screen you see after signing in, we record which one you chose and when, so we know what people come to Throughline for. We keep only your most recent choice, and it does not change what you can use. We do not collect payment card details directly. Payments are processed by Stripe.
We use your information to provide the platform, manage your account, process payments, and communicate with you about your account. We use usage data to improve the platform.
The content you put into Throughline is sent to Anthropic's API for processing. That includes uploaded documents, text you paste in for review, and grant application drafts, not only the story fields. Governance policies you upload are sent only when you run a compliance check against them. Content is sent as written, with no redaction step, so any name, figure, or unpublished finding your draft contains is sent with it. Under Anthropic's API terms this content is not used to train AI models. We do not send your account name, email address, or payment information. We hold no zero-retention arrangement with Anthropic, so provider-side retention is governed by Anthropic's own terms.
Throughline uses: Anthropic (AI processing), Vercel (hosting and site analytics), Supabase (database and authentication), Stripe (payments), and Resend (transactional and notification email). Each provider processes data in accordance with their own privacy policies.
Content is kept for as long as your organisation's retention setting allows, 365 days by default for stories and 30 days for AI request logs, and is removed when an administrator runs a data purge. Governance policies you upload are kept until you delete them on the Governance page or your account is closed. Grant application material sits outside that purge, because it represents months of unpublished work, and the researcher controls its deletion. To close your account and have its content deleted, or to request a full export of your data, contact phil@cornerstonemedia.com.au and we will action it. Billing records are retained for the period required by Australian taxation law.
Under the Australian Privacy Act you have the right to access and correct your personal information, and to ask us to delete it. To exercise these rights, contact phil@cornerstonemedia.com.au.
For privacy questions, contact phil@cornerstonemedia.com.au. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.