Privacy Policy

• Customers: Business entities and individual customers that subscribe to, license or trial the Service.
• Users: Individuals who access the Service under a Customer account (for example, employees, contractors, or the Customer themselves where they are an individual).
• Website visitors and others who interact with us (for example, via support channels or marketing pages).

• Third-party websites, apps or services that we do not own or control; or
• Personal information collected by Customers outside the Service.

Information provided when a Customer (business or individual) signs up or manages their account, for example:

• Legal entity or individual name (and, where relevant, trading name and ABN/ACN);
• Business or mailing address and billing details;
• Primary and secondary contacts (name, role, email, phone);
• Subscription, billing and payment information.

Information about individual Users authorised by a Customer, such as:

• Name and contact details (for example, email address);
• Usernames, user IDs, and authentication identifiers;
• Role, permissions, and access groups;
• Activity and audit logs relating to use of the Service.

Data entered or ingested into the Service by or on behalf of a Customer, which may include (depending on configuration):

• Product catalogue data (for example, product names, SKUs, categories, attributes);
• Inventory, stock movements, counts, and valuation data;
• Pricing, promotions, and transactional or order-related information;
• Tags, notes, comments, labels, or other metadata created by Users.

This data is generally business or operational data. However, it may occasionally contain Personal Information (for example, a person's name or email address in a note). Where it does, we treat it as Customer Personal Data.

To the extent Operational Data contains Personal Information (for example, a person's name on a label):

• The Customer is the controller of that Personal Information (under GDPR); and
• We act as the processor, handling it only as directed by the Customer and in accordance with this Policy and any applicable DPA.

We automatically collect limited technical data when you use the Service, such as:

• IP address, device and browser type, operating system;
• Access times, pages viewed, and actions taken in the Service;
• System performance metrics, error logs and diagnostic information;
• Identifiers associated with cookies, SDKs or other tracking technologies.

We use this information primarily to operate, secure, and improve the Service (see Section 7).

• Authenticating Users and managing access control;
• Hosting, processing and analysing Customer and Operational Data as configured by the Customer;
• Managing accounts, subscriptions, billing and Customer support;
• Providing integrations and features requested by the Customer.

• Monitoring for suspicious or unauthorised activity;
• Preventing, detecting and investigating fraud, abuse or security incidents;
• Enforcing our acceptable use, security and access policies;
• Supporting our SOC 2 controls and internal governance.

• Sending administrative notifications (for example, login alerts, security notices, system updates);
• Responding to enquiries and support requests;
• Providing important information about changes to the Service or this Policy.

• Analysing aggregated and de-identified usage trends;
• Developing new features and enhancements;
• Conducting product research and performance tuning.

We use aggregated and/or de-identified data where possible so that individuals cannot reasonably be identified.

Where permitted by law, we may use your contact details to send you product updates, newsletters or invitations to events. You can opt-out at any time via the unsubscribe link in our emails or by contacting us (see Section 16).

We use carefully selected third-party service providers ("Sub-processors") to help us deliver the Service, including cloud infrastructure, AI services, logging tools, payment providers, and support platforms. Each Sub-processor is engaged under a written agreement requiring appropriate security measures.

We may also disclose Personal Information:

• To professional advisers (for example, lawyers, auditors, insurers) under confidentiality obligations;
• Where required by law, court order, or regulatory authority;
• To investigate suspected fraud, security incidents or violations of our Terms of Use;
• In connection with a merger, acquisition, financing or sale of all or part of our business.

Where we disclose Personal Information to overseas recipients, we take reasonable steps to ensure they handle the information consistently with the APPs, including entering into contracts that require overseas recipients to handle Personal Information in accordance with Australian privacy requirements.

For Personal Data subject to the GDPR transferred outside the EEA/UK, we only transfer to countries with adequate protection or implement appropriate safeguards such as Standard Contractual Clauses (SCCs).

We implement appropriate technical and organisational measures to protect Personal Information, including:

To the extent commercially and technically feasible, Customer and User data is stored and processed within a designated geographic region (for example, Australia). Some supporting services and backups may operate in multiple regions as part of our high-availability and disaster recovery design.

You may request confirmation of whether we hold Personal Information about you, and access to or correction of that information.

To exercise any of the above rights or to make a complaint, please contact us using the details in Section 17. If you are not satisfied with our response, you may contact the OAIC or the relevant EU/UK data protection authority.