Privacy Policy
Last updated: 22 October 2026
1. About this Privacy Policy
3 Steps Data respects the privacy of the people and organisations that use our website and services.
This Privacy Policy explains how FLATWORLD INTEGRATION PTY LTD (ACN 617 309 789), trading as 3 Steps Data (“3 Steps Data”, “we”, “us” or “our”), handles personal information in connection with our website, services and business operations.
3 Steps Data is deliberately designed so that the 3 Steps Data platform does not need to store customer account, identity or billing personal information.
Payment and billing information is handled by independent payment providers.
Customers decide what information they place inside their own Data Vaults and make available through their Data Connections.
Our approach is straightforward: we provide the infrastructure. We do not operate an advertising business, build commercial behavioural profiles from your Data Connections, sell your personal information or monetise the relationships created through the service.
2. Who we are
The 3 Steps Data service is provided by:
FLATWORLD INTEGRATION PTY LTD
ACN 617 309 789
trading as 3 Steps Data
Postal address:
PO BOX Q301
QUEEN VICTORIA BUILDING NSW 1230
AUSTRALIA
Privacy enquiries:
enquiries@3stepsdata.com
3. Different types of information
It is important to distinguish between information handled by the 3 Steps Data platform and information handled through other services.
3.1 3 Steps Data platform information
The 3 Steps Data platform does not store customer account, identity or billing personal information such as your name, email address, organisation, billing address or payment-card details as part of your Data Vault account.
The platform may process technical information necessary to operate and protect the service, including service events, security events, timestamps, system identifiers and technical information required to establish, maintain and secure Data Vaults and Data Connections.
3.2 Customer Content
Customers choose what data, documents, files and other information they place inside their Data Vaults.
That information is referred to in this Privacy Policy as Customer Content.
Customer Content may contain personal information if the Data Vault operator chooses to store personal information within the service.
3 Steps Data does not determine what Customer Content is placed in a Data Vault, whether it is accurate, who it relates to, who should receive it or what another participant should do with it.
3.3 Payment information
Payment and billing information is handled by independent payment providers.
We currently use Stripe and may make additional payment providers available over time.
Those providers may collect and store personal information, billing information, payment credentials and transaction information as necessary to process payments, prevent fraud and meet their own legal, security and regulatory obligations.
3.4 Website information
Our public website may use cookies or similar technologies required for the website to function.
Where enabled, website analytics may also process technical information such as IP address, browser or device information, pages viewed, referral information and similar usage information.
Website information may be processed by our website, hosting or analytics providers rather than by the 3 Steps Data platform.
4. Our role in relation to Customer Content
The Data Vault operator determines what information is placed in their Data Vault, which Data Connections are created, what information is made available through those Data Connections and what permissions apply.
Where applicable privacy laws distinguish between a data controller and processor, business and service provider, or similar roles, the Data Vault operator will generally determine the purpose and use of Customer Content and 3 Steps Data will provide the infrastructure used to process that information.
3 Steps Data does not assume responsibility for a Data Vault operator’s privacy, confidentiality, disclosure, recordkeeping or other legal obligations merely because the information is stored or exchanged using our infrastructure.
Nothing in this Privacy Policy changes any responsibility imposed on either party by applicable law.
5. Customer Content
3 Steps Data processes Customer Content only as reasonably necessary to provide, secure, maintain, recover and operate the service, comply with applicable law, or carry out instructions permitted under the applicable service agreement.
We do not use Customer Content for advertising.
We do not use Customer Content to create commercial behavioural profiles.
We do not sell or monetise Customer Content.
We do not harvest relationships represented by Data Connections to create another commercial product.
We do not represent that Customer Content is accurate, complete, lawful or suitable for any particular purpose. Responsibility for Customer Content remains with the person or organisation that controls or provides it.
6. Payment providers
Payments are processed by independent payment service providers.
3 Steps Data currently supports Stripe and may support additional providers over time.
Payment providers may collect information including names, contact details, billing information, payment credentials, transaction details and other information necessary to process payments, detect fraud and meet legal, security and regulatory requirements.
3 Steps Data does not store payment-card information or customer billing personal information within the 3 Steps Data platform.
We may receive or access limited payment or subscription information where necessary to confirm that payment has occurred, administer a subscription, investigate a payment issue, process a refund or meet legal requirements.
Information held by a payment provider is also subject to that provider’s own privacy policy, security arrangements and legal obligations.
7. Website cookies and analytics
Our website may use cookies or similar technologies necessary for its operation.
Where enabled, analytics services may process information about how visitors use the website.
This may include IP addresses, browser or device information, pages visited, referral information and similar technical information.
We do not use website analytics to build behavioural advertising profiles or to monetise website visitors.
Where consent or additional disclosure is required for particular cookies or analytics technologies, we will provide appropriate information or controls.
8. Communications with 3 Steps Data
If you contact 3 Steps Data by email, through a website form or through another communications service, that service may process personal information such as your email address and the information you provide.
This information is not stored as customer identity information within the 3 Steps Data platform.
It may be retained within the relevant communications service where reasonably necessary to respond to your enquiry, maintain business records, resolve an issue or meet legal obligations.
9. Communications between users
3 Steps Data provides infrastructure through which people, organisations and systems may exchange Customer Content using Data Connections.
3 Steps Data is not responsible for the content, accuracy, meaning, legality or consequences of communications or information exchanged between users.
A message, file or other communication being transmitted through a Data Connection does not mean that 3 Steps Data has reviewed, approved, authenticated or endorsed its contents.
Users remain responsible for deciding what information to send, what information to rely upon and with whom they communicate.
10. Data Connections and service information
A Data Vault operator can see and manage the Data Connections associated with their Data Vault.
This may include information about a Data Connection, its permissions, status and technical events required to operate it.
3 Steps Data processes the technical information necessary to establish, secure and maintain those Data Connections.
We do not monitor Data Connections for advertising or commercial behavioural profiling.
11. Service monitoring
We monitor the service to keep it healthy, available, secure and protected from abuse.
This is service and infrastructure monitoring.
It is not commercial monitoring of the relationships created through Data Connections.
We do not use activity inside Data Connections to create advertising profiles or another commercial product.
12. How information may be used
Information handled by 3 Steps Data may be used where reasonably necessary to provide and operate Data Vaults and Data Connections, maintain security, prevent abuse, operate Trust Verification, administer subscriptions, respond to communications, maintain service reliability, meet legal obligations or protect our legal rights.
Where applicable law requires a particular legal basis for processing personal information, we will rely on the legal basis appropriate to the circumstances.
13. No advertising, selling or behavioural profiling
3 Steps Data does not sell personal information.
We do not use Data Connections to target advertising.
We do not build commercial behavioural profiles from activity inside Data Connections.
We do not harvest customer, supplier, adviser or partner relationships to create another commercial product.
You pay us for the service. We provide the service. That is our business model.
14. Service providers
We may use independent providers to support parts of the service, website, payments, communications, infrastructure, security or business operations.
Those providers may process information required for the services they provide and are subject to their own legal, contractual and security obligations.
We do not provide Customer Content or personal information to advertisers for behavioural advertising.
15. Where Customer Content is located
The Data Vault operator chooses the region in which their Data Vault lives from the regions available through the service at the time the Data Vault is created.
Available regions may change over time.
Customer Content held inside a Data Vault is stored in the region selected by the Data Vault operator, subject to the service configuration selected by the operator.
16. Disaster recovery
Where optional disaster-recovery protection is enabled, the Data Vault owner chooses the available region in which the disaster-recovery copy is maintained.
Disaster-recovery copies retain the same underlying individual encryption and security model used for the associated Data Vault.
Disaster-recovery protection includes Customer Content and authorised participant uploads contained within the Data Vault.
Disaster-recovery copies are deleted automatically within one month after deletion of the associated Data Vault unless deleted earlier in accordance with the service.
17. Other information may be processed outside the Data Vault region
The selected Data Vault region applies to Customer Content stored within that Data Vault.
It does not necessarily determine where independent payment providers, website providers, communications providers or other service providers process their own information.
Those providers may process information in other countries in accordance with their own services and legal obligations.
18. Security
3 Steps Data uses technical and organisational measures designed to protect Customer Content and the service against unauthorised access, misuse, loss, alteration and disclosure.
Data Vaults are designed around individual encryption and access controls.
3 Steps Data does not maintain a general administrative back door that allows personnel to browse Customer Content within a Data Vault.
No online service can guarantee absolute security.
Data Vault operators remain responsible for selecting appropriate permissions, protecting credentials and verification information, deciding what information they make available through Data Connections and maintaining any independent records or continuity arrangements appropriate to their circumstances.
19. Trust Verification
3 Steps Data provides a Trust Verification mechanism that allows a user to check whether a Data Connection or service link is an authentic 3 Steps Data link.
A user may copy the verification token displayed by the 3 Steps Data service and check that token using the 3 Steps Data Trust Verification service.
Trust Verification verifies the authenticity of the relevant 3 Steps Data link.
It does not verify or guarantee the identity, authority, trustworthiness, conduct or intentions of the person, organisation or system at the other end of the Data Connection.
Users remain responsible for deciding whether to communicate, connect, disclose information or proceed with a transaction or relationship.
20. Downloaded information
A Data Vault operator may allow another participant to download information through a Data Connection.
When information has been legitimately downloaded, the resulting copy is outside the Data Connection.
The permissions associated with the Data Connection no longer control that downloaded copy.
3 Steps Data cannot control how a recipient uses, stores, copies, forwards or distributes a legitimately downloaded copy.
21. Retention and deletion
Customer Content remains subject to the actions of the Data Vault operator and the retention and deletion behaviour of the service.
A Data Vault operator may delete Customer Content or the Data Vault itself in accordance with the functionality provided by the service.
3 Steps Data may retain limited technical, transaction, security or legal records where reasonably necessary to protect the service, resolve disputes or satisfy applicable legal obligations.
We do not retain information indefinitely merely because it has previously been processed by the service.
22. Access, correction and privacy rights
Because 3 Steps Data does not maintain customer account or identity personal information within the Data Vault platform, many requests concerning personal information contained in Customer Content should be directed to the Data Vault operator that controls that information.
If you believe 3 Steps Data itself holds personal information about you through a payment, communication, website interaction or another business process, you may contact us.
Depending on the laws that apply to you, you may have rights relating to access, correction, deletion, restriction, objection, portability or withdrawal of consent.
We may need to verify your identity before responding to a privacy request.
Requests may be sent to:
23. Privacy complaints
If you believe 3 Steps Data has mishandled personal information, please contact:
Privacy Officer
FLATWORLD INTEGRATION PTY LTD
trading as 3 Steps Data
Email: enquiries@3stepsdata.com
Postal address:
PO BOX Q301
QUEEN VICTORIA BUILDING NSW 1230
AUSTRALIA
Please provide enough information for us to understand and investigate the issue.
We will respond within a reasonable period.
You may also have the right to complain to the privacy or data-protection regulator responsible for your jurisdiction.
24. Data breaches
We maintain processes for responding to suspected or confirmed security incidents.
Where applicable law requires notification to affected people or a regulator, we will act in accordance with those requirements.
25. Changes to this Privacy Policy
Our service, infrastructure and legal obligations may change.
We may update this Privacy Policy to reflect those changes.
The current version will be published on this website together with its effective date.
Where an update materially changes how personal information is handled, we will take reasonable steps to communicate that change where appropriate.
26. Contact
Questions about this Privacy Policy may be sent to:
FLATWORLD INTEGRATION PTY LTD
ACN 617 309 789
trading as 3 Steps Data
PO BOX Q301
QUEEN VICTORIA BUILDING NSW 1230
AUSTRALIA