1. Who we are
Decision Keep is operated by Growpay Technologies Pty Ltd (ACN 656 964 180), trading as Decision Keep. Decision Keep is the independent, tamper-evident witness for automated decisions. We provide a managed ledger that records, signs and lets your auditors verify the automated decisions your organisation makes. This policy explains what personal information we handle, how, and your rights.
2. Automated decision-making — what we disclose (APP 1.7–1.9)
From 10 December 2026, the Australian Privacy Act 1988 (Cth) requires APP entities to disclose, in their privacy policy, how they use computer programs to make decisions that could reasonably be expected to significantly affect an individual's rights or interests. The disclosures in this section are structured to the three limbs of APP 1.8 and follow the OAIC's APP Guidelines, Chapter 1, version 2.0 (updated 30 September 2026).
2.1 Who the obligation falls on, and what “arranged for” means
The transparency obligation sits with the APP entity that uses the personal information to make the decision — not with the vendor who supplies the software. Under APP 1.7(a), “arranged for” captures situations where a computer program is operated by someone else but a different entity is responsible for arranging for it to make the decision: procuring a screening system, directing staff to draft assessments with an AI tool, or contracting a provider to approve or decline a case automatically. An APP entity with a contract in place may still owe APP 1.7–1.9.
Decision Keep itself makes no decisions about individuals. It is an out-of-band evidence layer that records decisions others have already made, so it holds no personal information about the individuals those decisions concern. It does hold the personal information of account holders (Section 3), which is why the rest of this policy applies to you as an individual.
2.2 When the obligation applies (APP 1.7)
The three conditions in APP 1.7 must all be met. An APP entity must have arranged for a computer program to make, or to do a thing substantially and directly related to making, a decision (a); the decision could reasonably be expected to significantly affect an individual's rights or interests (b); and personal information about that individual is used in the program's operation (c). “Computer program” takes its ordinary meaning and is read broadly — pre-programmed rules, AI and machine-learning models, generative AI tools and chatbots all fall within it.
“Significantly” means more than trivial, with the potential to considerably influence the individual's circumstances. It can depend on the person's situation: the same outcome can be trivial for one person and significant for a child, a person with a disability, or someone experiencing vulnerability. Rights and interests expressly in scope include access to essential banking and credit, healthcare, housing, employment, education, utilities and telecommunications. An effect that is beneficial also counts.
2.3 Kinds of personal information used (APP 1.8(a))
When an organisation pipes a decision through Decision Keep, each record stores the inputs needed to evidence it: the system that made the decision (e.g. Salesforce, Oracle, SAP), the agent or model, the version, the decision type, the payload (the inputs to the decision), and governance metadata such as confidence, risk, routing outcome and the human verifier identifier where a person was involved. Raw payloads always remain under the organisation's own control; only a cryptographic fingerprint of the content is retained in the public record so the content is never exposed.
Where an organisation uses several programs across a decision class — for example a range of fraud-prevention tools that score identity, location, device and account behaviour to permit, flag or deny access — it may describe them as a range of prevention technologies rather than separating out each program. This is the grouping approach the OAIC contemplates, provided the description is still meaningful to a reasonable person.
2.4 Kinds of decisions made solely by the program (APP 1.8(b))
For a decision with a AUTONOMOUS routing outcome, no human reviewed or overrode it before it took effect: it was made solely by the operation of the computer program. The record captures this explicitly so the organisation can disclose exactly which of its decisions fall into this category. Where an Australian law or a code binding on the organisation requires a human to be involved, the organisation must not rely on a purely automated decision in that context.
2.5 Kinds of decisions where the program does a related thing (APP 1.8(c))
This limb is broader than 2.4 and is the one most often missed. A decision is in scope where the program does a thing substantially and directly relatedto making the decision — “substantially” meaning real or of substance rather than nominal, and “directly” meaning directly connected to the decision. It does not matter whether the output is advisory or determinative. A scholarship panel that considers a ranking but can disregard it is still captured. For a decision with an ASSISTED or ESCALATED routing outcome, a human was in the loop, but automation still played a substantial part in supporting that human's decision — for example by scoring risk, recommending an action, or surfacing the inputs. The record stores the routing outcome and rationale, and the human verifier's identifier, so the organisation can explain the substantial part automation played.
2.6 What “decision” and “rights or interests” mean (APP 1.9)
APP 1.9 is definitional rather than a separate disclosure limb. Making a decision includes refusing or failing to make one, and doing a thing includes refusing or failing to do it. A decision may affect rights or interests whether they are adversely or beneficially affected. Using a program to record a decision does not, by itself, trigger APP 1.7 for the customer: the test is whether the customer arranged for the program to make, or substantially and directly support, a decision affecting an individual.
Each receipt proves exactly when (the signed timestamp) and by what version a decision was made, who or what triggered it, and the routing outcome. The content hash lets auditors confirm the recorded inputs were exactly as submitted, without revealing the raw payload. Separately, where we collect personal information to make a decision about you, APP 6.2(e) requires us to advise you of the name of the computer program, its purpose, and the meaningful information about the logic utilized — which is the distinct collection-notice obligation, delivered with the notice at the point of collection.
3. How we handle your information
- Account & waitlist data: the email you provide to join the waitlist or create an account, plus your consent choices recorded at sign-up (see Section 5).
- Decision records: stored and signed with your organisation's own key. Content remains on infrastructure you control.
- Security (APP 11): each organisation has its own key; erasure is cryptographic and preserves the record anchor.
4. Your rights: access, correction and erasure (APP 12–13, APP 1.4(d))
You have the right to request access to your personal information and to request its correction under APPs 12 and 13, to have it erased under APP 11, and, where the GDPR applies, to equivalent rights under GDPR Articles 15–17. Erased decision content is cryptographically removed while the chain anchor is preserved for integrity.
To make a request, contact the organisation operating your Decision Keep instance. If your information is held by us, contact us through the enquiry form and we will action it. You do not have to follow any particular procedure or tell us why, and we cannot require a particular form of request. We will not charge for dealing with a request.
5. Consent and marketing
When you join the waitlist you are asked to accept this Privacy Policy and our Terms of Service. That consent is recorded with a timestamp and the policy version you accepted. Separately, and only if you opt in, we may send you product updates. You can withdraw marketing consent at any time using the unsubscribe link in any message, and withdrawing it does not affect the lawfulness of processing carried out beforehand.
5A. Website analytics & marketing (public site only)
On our public marketing pages only (the home page, waitlist, sign-up and login, and the public verifier), we use a third-party analytics and lead-identification service, Octolane AI (cdn.octolane.com / ingest.octolane.com), to understand anonymous site traffic and to route interested visitors to our team. This script is never loaded on the authenticated, data-sensitive routes (the ledger, settings, API and audit surfaces), and our Content Security Policy blocks those hosts there as well. As a result, no decision, receipt or evidence content is ever transmitted to Octolane or any other third party. The evidence stays sovereign to your infrastructure.
If you prefer not to be measured on the public site, you can block third-party scripts with a browser extension or privacy setting; doing so does not affect the product. Octolane processes this analytics data in the United States; it receives only anonymous, non-evidence web-traffic signals (no decision, receipt or ledger content), so no regulated personal information about individuals recorded in your ledger is transferred.
6. Overseas disclosures (APP 1.4(f)–(g))
We are an Australian entity and disclose personal information to an overseas recipient only in the limited cases below. The countries involved are the United States of America (analytics provider) and, where we engage an RFC 3161 time-stamping authority to anchor a timestamp, the United States and European Union member states. Enterprise customers are notified of any sub-processor and its location before it processes their data, and may object where they have a right to do so.
Routing data in transit through infrastructure outside Australia is a use of personal information rather than a disclosure, but we treat it the same way operationally and it does not alter who ultimately holds your information. Decision content and evidence are never disclosed to us — they remain under your organisation's control (Section 3).
7. Data breach notification
Because the ledger never exposes raw decision content and the evidence stays on infrastructure you control, the record itself is not a notifiable-breach vector for the decisions you record. Where a personal-data breach affecting you does occur, Growpay Technologies Pty Ltd (trading as Decision Keep) will notify affected individuals and the Office of the Australian Information Commissioner without undue delay where required by the Notifiable Data Breaches scheme (APP 11) and, where the GDPR applies, within 72 hours under Article 33. Notification arrangements for managed plans are set out in the Data Processing Addendum (security page).
8. Complaints (APP 1.4(e))
If you believe we have breached the Australian Privacy Principles or any binding registered APP code, tell us. We would rather hear it directly and fix it.
- Contact us through the enquiry form and set out the concern and the period it covers. A complaint to us should be in writing to be made under section 40(1A) of the Privacy Act, and we will confirm receipt in writing.
- We will acknowledge and respond, usually within 30 days. If we cannot resolve it in that time we will tell you why and how long we need.
- If we cannot resolve it, you can take the matter to a recognised external dispute resolution scheme of which we are a member, where we are a member of one.
- After that, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au. You do not need to exhaust the steps above first, but we generally prefer to try to resolve a concern first.
Enterprise customers can request a Data Processing Addendum and our SOC 2 control mapping from the security page. Privacy complaints about our own handling of your information as an account holder go to the mailbox above; complaints about a decision your employer recorded with us are directed to that organisation, as the APP entity for that decision.