Privacy Policy

TradeOps AI is a business operations software service operated by the legal operator to be published before external launch. Privacy enquiries may be sent to the privacy contact to be published before external launch. This policy explains how the TradeOps platform handles personal information. Each subscribing business remains responsible for its own handling of customer and worker information and for providing any notices and consents required for its activities.

Where the Privacy Act 1988 (Cth), the Australian Privacy Principles or another privacy law applies to TradeOps, those legal obligations apply independently of this policy. Some Australian small businesses may qualify for exemptions in limited circumstances, but this policy does not rely on an exemption to justify weaker security or undisclosed handling. Publishing this policy does not itself opt an otherwise exempt small business into the Privacy Act under section 6EA. Nothing in this policy limits any statutory privacy right or cause of action that cannot lawfully be limited, including the statutory tort for serious invasions of privacy where it applies.

• Account and identity information such as names, work contact details, roles, authentication and MFA status.
• Business records entered into TradeOps, including customer contact details, enquiries, quotes, jobs, invoices, payments, schedules, service history, files, photos and notes.
• Communications content and metadata for email, SMS, calls, portal messages and support interactions where those features are used.
• Operational and financial workflow information, including accounting, calendar, payment, payroll-control and integration metadata. TradeOps does not require customers to store full payment-card numbers in TradeOps.
• Security, device and usage information such as audit events, access events, delivery status, error diagnostics and rate-limit/security signals.
• AI inputs and outputs where AI-enabled features are used, including prompts, transcripts, summaries, classifications and proposed actions.
• Integration credentials and tokens needed to connect third-party services. These are treated as secrets and are not intentionally exposed through normal browser data exports.

TradeOps is not designed for unnecessary sensitive information. Customers should avoid entering health, biometric, government identifier, criminal-record or other sensitive information unless it is genuinely required, lawful and appropriate for their own business process. Customers must not place passwords, authentication codes, private API keys, full payment-card numbers or other secret credentials into free-text fields or uploads unless a TradeOps feature expressly requests and secures that data for that purpose.

Information may be collected directly from account users, from a subscribing business, from that business's customers through booking pages or portals, from connected communications, calendars, accounting or payment providers, and automatically through normal security and service logs. Where a business gives TradeOps information about another person, that business is responsible for having a lawful basis and giving required notices unless TradeOps has expressly agreed to do that on its behalf.

• Provide, secure, authenticate, maintain and support the TradeOps service.
• Run customer-requested workflows such as CRM, quoting, job management, invoicing, payments, reminders, reporting and integrations.
• Deliver communications requested by a subscribing business and record provider delivery evidence.
• Detect abuse, fraud, security incidents, duplicate transactions and operational failures.
• Provide support, investigate complaints, enforce contracts and comply with law.
• Improve reliability and product performance using aggregated or de-identified information where reasonably practicable.

TradeOps may use software and AI to summarise information, classify enquiries, draft communications, prioritise work, extract structured data, recommend actions and assist receptionist or workflow functions. The information used can include account details, customer communications, enquiry/job records, scheduling information and other Customer Data relevant to the requested feature. TradeOps is designed so consequential customer, financial or operational actions can require human approval. TradeOps is not intended to autonomously make employment, credit, insurance, legal eligibility, medical or similarly high-impact decisions.

From 10 December 2026, APP 1 introduces additional privacy-policy disclosure requirements where an APP entity arranges for a computer program to use personal information to make, or do a thing substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests. TradeOps will update this policy before enabling any such platform use. Customers must not configure TradeOps to make high-impact automated decisions without appropriate human review, lawful authority, transparency and any other legally required safeguards.

TradeOps may use service providers for cloud database/authentication/storage, hosting, email, SMS/telephony, payments, AI, observability, support, calendars and accounting integrations. Core Supabase project data is presently hosted in Sydney, Australia. Other providers can process information in Australia, the United States and additional countries in their published infrastructure/subprocessor networks, depending on the feature and Customer-selected integration. See the Subprocessor & Provider List for the current provider categories and known location information.

TradeOps does not sell personal information, operate as a data broker, or disclose Customer Data for unrelated advertising. Where Australian Privacy Principle 8 applies to an overseas disclosure, TradeOps will take reasonable steps required by law and will remain accountable to the extent required by applicable law.

Where the OpenAI API is used, OpenAI currently states that API inputs and outputs are not used to train its models by default unless the API customer explicitly opts in to data sharing. Other AI providers, if later enabled, will be assessed and disclosed according to their applicable business data terms.

TradeOps uses layered controls including tenant isolation, role-based access, MFA requirements for privileged actions, server-only secrets, audit logs, signed/private access patterns, rate limits, encrypted transport provided by hosting services, recovery controls and provider delivery/reconciliation evidence. No internet service can promise absolute security or uninterrupted availability, and this policy does not make such a promise.

Information is retained while reasonably needed to provide the service, meet legal/accounting/security requirements, resolve disputes and maintain legitimate audit evidence. When personal information is no longer required and the Privacy Act requires destruction or de-identification, reasonable steps will be taken to delete, de-identify or put it beyond use. Backup copies may remain for limited recovery periods and will not be intentionally restored for ordinary use after valid deletion except where necessary for recovery, security or law.

TradeOps maintains incident-response and recovery procedures. Where the Notifiable Data Breaches scheme applies and there are reasonable grounds to suspect an eligible data breach, TradeOps will take reasonable steps to complete the assessment within 30 calendar days, treating 30 days as a maximum rather than a target. If there are reasonable grounds to believe an eligible data breach occurred, TradeOps will notify the OAIC and affected individuals as soon as practicable where required and will take reasonable remedial steps to reduce likely harm.

Requests to access or correct personal information held by TradeOps, or privacy complaints, may be sent to the published privacy contact. We may need to verify identity before releasing information. We aim to acknowledge and investigate complaints promptly and ordinarily provide a substantive response within 30 days where practicable. If the Privacy Act applies and a person remains dissatisfied after giving us a reasonable opportunity to respond, they may contact the Office of the Australian Information Commissioner.

TradeOps distinguishes operational/service communications from marketing. A subscribing business using TradeOps to send commercial electronic messages is responsible for having required consent, keeping evidence of that consent, accurately identifying the sender and contact details, and providing a functional unsubscribe mechanism. Australian commercial electronic-message unsubscribe requests must generally be honoured within 5 working days and the mechanism must remain functional for the legally required period. TradeOps may suppress delivery where an unsubscribe or legal block has been recorded.

TradeOps is a business service and is not directed to children. Customers must not knowingly use TradeOps to collect children's personal information unless they have a lawful and appropriate reason, necessary notices/consents and safeguards.

We may update this policy as the product, providers or law changes. Material changes will be published with an updated version/effective date, and where appropriate we will provide account notice.