Privacy policy.

Last updated · 10 May 2026

1. Who we are

TrailScope is operated by Aartan Group Pty Ltd ("TrailScope", "we", "us", "our"), an Australian company. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. What we collect

• Account data — name, work email, organisation name, role, hashed password (or OAuth identifier from Google / Microsoft).
• Portfolio data you upload — client names, contact details, loan structures, settlement and balance history, commission records.
• Usage data — pages visited, actions taken inside the workspace, timestamps, IP address, browser user-agent.
• Billing data — Stripe customer ID, plan, status. Card details are collected and stored by Stripe directly; they never touch our servers.

3. How we use it

We use your information to provide the TrailScope service, authenticate you, run retention scoring and AI Insights against your portfolio, send transactional email (receipts, security alerts), and improve the product. We do not sell or rent your data.

4. AI processing

When you use AI Insights, an aggregate-only summary of your portfolio (KPIs, lender concentration, risk distribution) is sent to the configured AI provider (Anthropic, OpenAI or Google Gemini). We deliberately exclude names, email addresses, phone numbers, dates of birth and free-form notes from this context. If you bring your own API key, prompts go to your provider under your account; otherwise they go through our shared platform key with a 10-request-per-minute rate limit.

5. Where it lives

All portfolio data is stored in AWS Sydney (ap-southeast-2) via Supabase. Backups remain in the same region. Stripe, Anthropic, OpenAI and Google may process limited data outside Australia under their own contracts and certifications.

6. Security

TLS 1.2+ in transit, AES-256 at rest, Row-Level Security on every multi-tenant table. See the full architecture on our Security page.

7. Your rights

Under the APPs you can request access to, correction of, or deletion of your personal information at any time. Account holders can delete their workspace and `auth.users` record from Settings → Organisation → Delete account. For everything else, email privacy@trailscope.com.au.

8. Cookies

We use essential cookies and `localStorage` to keep you signed in and remember UI preferences (selected period, table column visibility). We do not use third-party advertising or cross-site tracking cookies.

9. Retention

Active workspace data is retained for the life of your subscription. After cancellation, encrypted backups roll off within 30 days. Audit-log entries required by the NCCP Act are retained for 7 years.

10. Changes

We'll notify account admins by email at least 14 days before any material change to this policy.

11. Complaints

Email privacy@trailscope.com.au. If you're not satisfied, you can refer the matter to the Office of the Australian Information Commissioner.