Privacy policy
Pilot version, 11 November 2026
1. Who we are
HotSeat HQ ("HotSeat") is an online tool for running crisis management exercises. HotSeat is a product of First Hour Advisory Pty Ltd (ACN 704 054 197, ABN 87 704 054 197) ("we", "us"). This policy covers HotSeat and the First Hour Advisory website, including its free tools and newsletter. We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth). You can contact our privacy officer at privacy@firsthouradvisory.com.au.
2. What personal information we collect
About account users (people who sign up or are invited to log in):
- name, email address and the role you hold in the account (owner, admin or facilitator);
- your password, stored only as a one-way scrambled code (a "hash") that we cannot read;
- when you agreed to our Terms of use and this policy, and which version;
- billing contact details and invoice history, if your organisation pays us.
About people in a customer's organisation (entered by the customer, not by the person themselves):
- name, job title, crisis team role, usual location (on site or remote) and availability;
- optional email address and phone number, used for exercise contact details and call-out tests;
- what happens during an exercise, such as log entries, actions assigned to them and call-out response times.
People who contact us: the name, email address, organisation and message you send through our contact form or by email.
Technical information: a login cookie that keeps you signed in, and basic server records (such as IP address, time and page requested) used for security and fault-finding. We do not use advertising or tracking cookies.
We do not ask for sensitive information (such as health information). Please do not enter it into free-text fields.
3. How we collect it
We collect account users' details directly from them when they sign up or accept an invitation, and the details of people who contact us from what they send. Details of a customer's staff are entered by that customer. The customer is responsible for telling its staff that their details are stored in HotSeat and pointing them to this policy.
4. Why we use it
We use personal information only to:
- provide the HotSeat service, including running exercises, debrief reports and call-out tests;
- manage accounts, logins, invoices and support requests, and reply to enquiries;
- send service emails, such as password resets, invitations, call-out alerts and renewal reminders;
- keep the service secure and fix problems.
We do not sell personal information. We do not send marketing to people in a customer's organisation. We may send account owners occasional product news, and they can unsubscribe at any time.
We do not use customer exercise data to train artificial intelligence models.
5. Newsletter and free tools
Newsletter. If you sign up to our newsletter or download a free tool, we collect your name, email address and, if you choose to give them, your organisation and role. We use them to send you the tool and the newsletter you asked for, and occasional news about First Hour Advisory and HotSeat. We send these emails only with your consent, each one says who it is from, and each has an unsubscribe link that works within 5 business days. We do not sell or share your details for others' marketing. If you unsubscribe, we keep only your email address on a suppression list so we do not email you again.
Mailing service. We may use a mailing service to send newsletters. It may store your details overseas, including in the United States.
Free tools that run on your device. Some free tools, such as the redaction tool, run entirely on your own computer. The documents and text you use with them are not sent to us or anyone else, and we cannot see them.
Free tools on our website. If a tool runs on our website (such as the readiness self-check), we store your answers only if you ask us to email you the results, and then only with your contact details. We use combined, anonymous answers to improve the tool.
6. Who we share it with
We share personal information only with service providers that help us run HotSeat, and only as needed:
| Provider | What they do | Where the data is held |
|---|---|---|
| Amazon Web Services (AWS) | Hosts the app and database, and sends service and call-out emails (Amazon SES) | Sydney, Australia |
| Microsoft 365 | Our business email, where contact form messages and enquiries arrive | Australia and overseas |
| A payment provider (when card payments are introduced) | Processes card payments | Australia and overseas |
| Accounting software | Issues invoices to account owners | Australia and overseas |
We may also disclose information if the law requires it, or to our professional advisers (such as lawyers and insurers) under a duty of confidence.
7. Overseas disclosure
HotSeat data is stored in Australia. Some providers above are overseas companies (for example AWS is based in the United States) and their staff may access data from overseas for support or security purposes. Email, payment and accounting providers may store details overseas, including in the United States. We choose providers with strong security and privacy commitments.
8. How we protect it
- Data is encrypted while travelling over the internet (HTTPS) and stored in a managed database in AWS Sydney.
- Each customer's data is kept separate; the app checks which account you belong to on every screen.
- Passwords and login links are stored only as one-way hashes.
- Access to the systems is limited to First Hour Advisory's authorised people, protected by multi-factor authentication.
- Backups are kept for up to 30 days.
9. How long we keep it
We keep customer data while the customer's account is open, so exercise history and reports remain available. After an account closes we keep it for up to 90 days (so it can be restored if closed by mistake), then delete it. Backups are overwritten within a further 30 days. Invoices are kept for 5 years for tax purposes. A customer can delete individual people, exercises or a whole organisation at any time, and can ask us to delete the whole account sooner.
10. Accessing and correcting your information
Account users can see and update their own details on the Account settings page. Anyone can ask us for a copy of the personal information we hold about them, or ask us to correct it, by emailing privacy@firsthouradvisory.com.au. If your details were entered by your employer or a consultant, we may refer your request to them, as they control that information. We will respond within 30 days and will not charge for a request.
11. Data breaches
If a data breach is likely to cause serious harm, we will notify affected customers and individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
12. Complaints
If you are concerned about how we have handled your personal information, contact our privacy officer at privacy@firsthouradvisory.com.au. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
13. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with its date, and tell account owners by email about significant changes.
14. Contact us
First Hour Advisory Pty Ltd (ACN 704 054 197, ABN 87 704 054 197). Email: privacy@firsthouradvisory.com.au. Website: hotseathq.com.au. Or use our contact form.