PublishToolkit Privacy Policy

PublishScout and PublishDash

Updated 21 October 2026

1 Who we are

Carrick Investments Pty Ltd, ABN 76 644 527 275, trading as PublishToolkit (we, us or our), provides PublishScout and PublishDash. This policy explains how we collect, use, disclose and handle personal information through these services and associated PublishToolkit pages. It also explains how to contact us about your information.

Contact: support@publishtoolkit.com. Postal address: 1/1-15 Geraldton Drive, Robina QLD 4226, Australia.

This policy applies to the information we handle for these services. Third-party websites and services have their own policies. This policy does not replace any privacy or consumer rights that apply to you under law.

2 Information we collect

Account and profile information includes your first name, optional surname, email address, account identifier, role and account settings. Authentication providers handle sign-in credentials or social sign-in details according to the sign-in method you choose.

PublishDash information includes the advertising reports and files you upload, campaign and search-term information, advertised product identifiers, countries, dates, advertising spend, clicks, orders and sales. It also includes book details, images, selling prices, royalties, target ACOS, campaign mappings, recommendations, action statuses, change notes and manual performance entries you provide or generate through the app.

PublishScout information includes topics, book concepts, target-reader descriptions, notes, feedback, research requests, saved ideas, outlines, market assessments and generated results. We also obtain publicly available book and marketplace information through research services.

Membership and billing information includes trial dates, plan and entitlement details, discount eligibility, customer and subscription identifiers, payment status and invoice records. When paid services are enabled, Stripe collects payment information directly. Our app does not need to receive or store your complete card number or card security code.

Technical and support information may include IP address, browser and device information, usage and error logs, session information, support messages and communications. Providers may collect technical information while supplying hosting, authentication, payments, email or other service functions.

We do not ask you to upload Amazon customer identities, sensitive personal information, payment-card information or Amazon account passwords into reports, prompts or notes. Only provide information you are authorised to use. Avoid including unnecessary information about other people.

3 How we collect and use information

We collect information when you register, sign in, upload a report, use research features, enter book information, manage a subscription or contact us. We also receive payment updates from Stripe and technical information from the providers operating the services.

We use information to provide accounts, analyse advertising, generate research and recommendations, retain useful history, administer trials and plan limits, process payments, provide support, deliver service notices, maintain security and diagnose errors. We also use relevant information to improve reliability, investigate misuse, meet legal obligations and resolve disputes.

PublishDash currently analyses the reports you supply. It does not directly access or change your Amazon Advertising account. Recommendations and before-and-after comparisons support your decisions; you decide whether to change your campaigns.

You can choose not to provide optional information. Some information is needed for particular features, and those features may not work if it is not supplied. Where practical, you may make a general enquiry without creating an account.

4 Storage and access to uploaded reports

Base44 supplies the application platform, authentication, database and file-storage functions. Account records and uploaded files are separate types of storage and must be managed separately.

New original reports uploaded through PublishDash are stored as private files. An authenticated request is checked against the report owner or an administrator before a temporary download link is issued. The link is valid for 60 seconds; anyone holding it may be able to download the file during that period, so do not share it. Private storage does not prevent authorised platform providers from processing the file to supply their services.

Some reports uploaded before the private-storage change were stored at public file URLs. Those URLs may remain accessible to anyone who holds them until the underlying files are removed and cached copies stop being served. Replacing a report or deleting its app record does not delete its stored original or revoke an existing public link. We are working with Base44 to identify these older files and arrange appropriate preservation, deletion and cache clearing. Contact us if you have a question about an earlier upload.

Account administrators may access relevant member information to provide support, maintain the services and administer accounts. Platform providers and authorised support personnel may also process information for their service functions. An account’s permissions do not mean that its information is unavailable to these providers.

5 Providers and other disclosures

We disclose relevant information to providers needed to operate the services. Base44 hosts and processes application information. Stripe processes payments and related billing, fraud-prevention and compliance information when you use paid features. Base44’s email integration handles messages sent by the app.

PublishScout uses Base44’s AI integration and Rainforest API for relevant research functions. Research queries may include a topic, search phrase, product identifier or marketplace information. AI prompts may include your book-concept details, reader descriptions, notes, previous outputs and feedback. Do not include confidential personal information unless it is necessary and appropriate for that processing.

Base44 uses subprocessors for infrastructure, media hosting, logging, email and AI functions. Its published list includes Mongo, Render, Google Cloud, Supabase, DataDog, SendGrid, OpenAI, Anthropic and Wix. Inclusion on that list does not establish that every provider receives every item of your information.

We may also disclose information to advisers, regulators or authorities where reasonably necessary and lawful, or to investigate fraud, protect rights and manage disputes. A proposed business sale or restructure may involve controlled disclosure to advisers and prospective purchasers, subject to appropriate confidentiality and legal requirements.

We do not sell personal information as a standalone product. This does not prevent necessary disclosures to providers or lawful transfers associated with a business transaction. Stripe may process some information for its own purposes under its privacy policy, including security, compliance and service improvement.

6 Artificial intelligence and training

PublishScout uses third-party AI to generate and assess material. PublishDash generates recommendations using calculation rules rather than a generative AI call. This is separate from the platform provider’s handling of information hosted on its systems.

PublishToolkit does not train its own proprietary AI models using member reports, prompts or outputs. However, we cannot make a blanket promise that no platform or AI provider may use information for training or improvement.

Base44’s published guidance states that workspace data may be used for AI training on plans other than Enterprise, while Enterprise workspaces have an automatic training exclusion. Base44’s Data Processing Addendum separately restricts processing of personal information. The applicable contract, workspace plan, configuration and type of information affect permitted uses. Do not assume that using calculation-based features excludes hosted information from provider processing.

Information sent through an AI feature may be processed, retained or reviewed under the applicable provider arrangements. We will update this policy when those arrangements or the features materially change.

7 Processing outside Australia

We are based in Australia, but providers may store or process information overseas. Base44 identifies the United States as its default hosting location. Its published subprocessor list identifies US-based services and Wix in Israel. Stripe describes international processing that can include the United States and India and service providers in the European Union.

The exact locations depend on the service and configuration and may change. Overseas processing can occur even where a particular storage region is selected. We do not promise Australian-only storage or processing. You can contact us for information about the arrangements relevant to your account.

8 Cookies and similar technologies

The services use browser storage and session technologies for authentication, settings and related functionality. PublishDash stores authentication and app parameters in local browser storage. Providers may also use cookies and technical signals for security, payment processing and platform operation.

The landing page loads Inter and Playfair Display fonts from Google Fonts; doing so involves a request from your browser to Google’s servers, which can disclose connection information such as your IP address. Third-party pages, social sign-in and embedded media may have their own technologies and policies.

You can manage cookies and storage through your browser, but blocking necessary technologies may prevent sign-in or other functions. Any optional analytics or advertising technologies must be disclosed with appropriate choices where required by law; this policy is not consent to undisclosed tracking.

9 Communications

We may send account, security, billing and important product-service messages. If we send promotional communications, we will do so in accordance with applicable consent and marketing requirements and provide a way to unsubscribe or contact us to opt out. Opting out of marketing does not necessarily stop essential service messages.

Creating an account or accepting the Terms does not by itself authorise unrelated marketing. We do not add members to Booksy.buzz or AI Implementation Lab marketing lists merely because they use PublishToolkit.

10 Retention and deletion

We retain account information and relevant content for the purposes described in this policy, including maintaining saved work and historical analysis while you keep an account. Trial expiry and subscription cancellation do not automatically delete your account, reports or saved research.

You may request account and data deletion by emailing support@publishtoolkit.com from your registered email address. We may verify your identity before acting. We will assess the request, remove or de-identify information we are able and required to remove, and explain any information that must remain and why.

Deletion must address profile records, related database records, uploaded files and relevant provider-held information separately. Removing a user profile or report record does not by itself erase all of these. Platform logs, file storage and backups may have technical limits; some information may require provider assistance to remove. We do not promise immediate or complete erasure of every copy.

We may retain information where reasonably necessary for legal, accounting or tax obligations, fraud prevention, security, disputes or enforcing rights. Backup copies can remain until overwritten or expired under the relevant provider’s procedures. Stripe may independently retain payment information to meet its own obligations.

We do not promise permanent storage. If we introduce a material retention limit or plan to remove retained work, we will provide notice where appropriate and required. The applicable retention periods and deletion process must be consistent with our legal obligations.

11 Access correction and other rights

You can update available profile details in the app or contact support@publishtoolkit.com to request access, correction or deletion. Tell us which service and information your request concerns. We may ask for reasonable information to verify your identity, without requesting more than necessary.

We will respond within the period required by applicable law or otherwise within a reasonable period. Where a request cannot be fulfilled, we will explain the relevant reason and available complaint options, subject to lawful restrictions.

Depending on the laws that apply, you may also have rights to data portability, restriction, objection or withdrawal of consent. Withdrawing consent does not invalidate earlier lawful processing, and some processing may continue under another lawful basis. Contact us so we can assess the rights applicable to your circumstances.

12 Security and incidents

We use account permissions and provider security features to help protect information. No online system is completely secure. Protect your credentials and contact us promptly if you suspect unauthorised access or disclosure.

If a data incident occurs, we will assess it, take appropriate response steps and provide notifications to affected people or regulators where required. We do not guarantee that every incident can be prevented.

13 Children

The services are intended for authors, publishers and people managing publishing or advertising work, rather than for children. Please do not supply children’s personal information in prompts, reports or notes unless necessary, lawful and authorised. Contact us if you believe a child’s information has been provided inappropriately.

14 Complaints and changes

Send privacy questions or complaints to support@publishtoolkit.com, addressed to Carrick Investments Pty Ltd, trading as PublishToolkit. Describe the issue and the outcome you are seeking. We will investigate and respond within the timeframe required by applicable law or otherwise within a reasonable period.

If the issue is not resolved, you may be able to complain to the Office of the Australian Information Commissioner at www.oaic.gov.au or another relevant regulator, depending on its jurisdiction and the laws applying to your information.

We may update this policy when the services, providers or legal requirements change. The published policy will show its update date. We will give notice of material changes where appropriate or required. A privacy-policy update does not replace any separate consent required by law.

15 Provider information

Base44 privacy policy: https://base44.com/privacy-policy

Base44 Data Processing Addendum: https://base44.com/dpa

Base44 subprocessors: https://base44.com/dpa/exhibitc

Base44 training and storage guidance: https://docs.base44.com/Community-and-support/Privacy-and-security

Stripe privacy policy: https://stripe.com/privacy

Provider policies can change. These links provide further information and do not replace our responsibility to describe our own practices accurately.