Privacy notice.

This notice covers visitors, prospective customers, account users and people who contact us. We control information used for our website, accounts, orders and communications. For customer-submitted information about others, we may act as a processor or service provider. Do not submit that information until any required processing and transfer terms are in place.

• Contact and account details, including name, work email, company, role and organisation membership.
• Fit-check answers and results; assessment descriptions, documents, findings and reports.
• Orders, billing details, payment status, accepted terms and correspondence. We do not receive or store full payment-card details.
• Connection, device, session and security information, plus optional analytics described below.

We receive information from you, your organisation, service providers and website interactions. Name and work email are required for a recorded fit-check result; company is optional. Without required account, order or assessment information, we may be unable to provide the relevant service.

We use information to provide fit checks and assessments, manage accounts and orders, communicate with you, protect the service, resolve disputes and meet legal obligations. Assessment material may be processed using AI to extract information, analyse it and prepare reports.

Where UK law applies, our bases are requested pre-contract steps or contract performance; legitimate interests in security, reliability, business relationships and dispute resolution; legal obligations; and consent for optional analytics. Fit-check contact details are not used for unrelated promotional email. The automated fit result is preliminary scope guidance, not approval or a decision with legal or similarly significant effects.

We share information as needed with providers of hosting, storage, authentication, AI processing, email, payments and optional analytics. We may also disclose it to professional advisers, authorities or business successors where lawful and necessary. Provider and processing details can be requested for procurement review.

We operate from Australia. Our application data and analytics are hosted in the United States. Other service providers may process information in Australia, the United States, the United Kingdom and other countries where they operate. Contact us for details relevant to your engagement.

For restricted UK transfers, an applicable adequacy decision, approved transfer agreement or other lawful safeguard is required. We have not yet documented these mechanisms for every provider and engagement, or appointed a UK representative. Required safeguards and any required representative must be in place before the relevant processing. UK organisations should contact us before submitting assessment material.

Source uploads are scheduled for deletion after 365 days, unless deleted earlier. Deleting an upload does not automatically delete information already included in assessment answers or reports.

We do not currently have one general automated deletion schedule for accounts, fit-check records, assessments, orders or communications. Retention depends on service needs, contractual terms and legal, accounting, security or dispute requirements. Records may remain until a verified deletion request or another applicable deletion process.

Contact us to request deletion. Legal exceptions may apply, and copies in backups or recipients’ records may not disappear immediately. Cookie expiry does not delete associated service records.

Essential cookies and storage support sign-in, security and fit-check continuity. The pseudonymous fit-check session cookie lasts 30 days. Optional analytics run only after you select “Accept analytics”. You can reject or withdraw consent through “Analytics preferences” without losing access to the service.

With consent, we collect a random browser identifier, public-page visits, campaign and referral information, clicks, scroll activity and fit-check step and submission events. Campaign attribution may also be saved with your submitted lead. We exclude names, emails, form contents, assessment answers, uploaded documents, reports, access tokens and sensitive URL parameters from analytics.

Private account, assessment, authentication and payment pages are excluded from analytics. Session replay is disabled. The analytics provider receives connection information; geolocation enrichment and person profiles are disabled.

The analytics plan specifies one-year event retention, but automatic deletion at that point is not yet guaranteed. Consent preferences last six months; local analytics identifiers and campaign storage last for the tab session. Withdrawing consent stops future collection and clears stored attribution, but does not erase past events or lead records; contact us to request deletion.

We respect Do Not Track and Global Privacy Control signals. External sign-in and payment services use their own necessary technologies and privacy notices.

We use access restrictions and encryption to protect information. No internet service is risk-free. See our security overview.

Depending on applicable law, you may request access, correction, deletion, restriction or a copy of your information, object to processing, withdraw consent or seek review of qualifying automated decisions. We do not discriminate against anyone for exercising a privacy right.

• Australia: you may request access or correction and complain to us. Where the Privacy Act applies, unresolved complaints may be referred to the Office of the Australian Information Commissioner.
• United Kingdom: where UK law applies, you may exercise the relevant rights above or complain to the Information Commissioner’s Office.
• United States: applicable state law may provide rights to know, access, correct, delete or obtain a copy of information and opt out of certain disclosures.

Email us with your country or US state and your request. We may verify your identity and authority. We aim to respond within 30 days, or the period required by applicable law. We will investigate complaints and explain the outcome or next step.

This business service is not directed to children under 16. We do not knowingly collect their personal information; contact us if you believe a child has provided it.

We update this notice and its effective date when practices materially change, with additional notice where required. Contact hello@trusec.ai for privacy questions, requests or complaints. Our business is based in Victoria, Australia.