Privacy Policy

This Privacy Policy describes how Retention Track Pty Ltd (ABN 28 682 975 373) (we, us, our) collects, uses, stores and discloses personal information in connection with the paymentclaims.ai platform (the Platform). It applies to information collected through the Platform, our websites, our emails, and any related services. By accessing or using the Platform you consent to the practices described below.

1. Who we are

The Platform is owned and operated by Retention Track Pty Ltd, a company registered in Australia. Our registered office is at Unit 15, 5 Murphy Street, O'Connor, Western Australia 6163. The Platform serves customers in Australia and New Zealand. You can contact us about this Policy at privacy@retentiontrack.com.

2. Information we collect

The categories of personal information we collect depend on how you interact with the Platform. They may include:

• Account information: name, work email address, password (hashed), profile image, and the organisation and company you belong to.
• Workspace content: information you enter about your business, counterparties, contracts (including contract items and variations), payment claims, payment schedules, retention and retention releases, documents you upload, and related correspondence.
• Business identifiers:ABN, ACN or NZBN details you enter for your companies and counterparties, together with the registry records we retrieve when verifying them (see section 6). For sole traders, these records can include an individual's name.
• Communications: emails you send to us, support requests, invitations you send to other users, and notification preferences.
• Technical data: IP address, browser type and version, device identifiers, time-zone setting, operating system, and pages or features accessed.
• Usage and analytics data: product analytics and session replay events captured by PostHog to help us understand how the Platform is used (see section 10).

We do not knowingly collect special-category personal information (such as health, biometric or political data) and we ask that you do not upload such information to the Platform.

3. How we collect information

• Directly from you when you create an account, complete forms, upload documents, configure your workspace, or contact us.
• From other users in your organisation when they invite you or record information about counterparties or contracts you work on.
• From public business registries (the Australian Business Register and the New Zealand Business Number register) when you or another user in your organisation looks up a business identifier.
• Automatically from your device and browser when you use the Platform, including through cookies and similar technologies (see section 10).
• From our service providers (such as our authentication, hosting, email, AI and analytics providers) acting on our behalf.

4. Why we collect information

We use personal information to provide, secure and improve the Platform, including to:

• create and administer your account, authenticate you, and manage organisation and company memberships;
• deliver the core features of the Platform (preparing and tracking payment claims, recording payment schedules, managing retention, and related records);
• process documents you upload so that the Platform can extract and pre-fill contract and claim details for your review (see section 5);
• process payment of the per-claim fees described in our Access Terms, and keep records of your purchases;
• send transactional emails such as account confirmations, password resets, invitations, claim submissions, and notifications you have opted into;
• respond to your enquiries and provide customer support;
• monitor performance, diagnose issues, detect and prevent fraud or abuse, and otherwise keep the Platform secure;
• understand how the Platform is used and improve it; and
• comply with our legal, regulatory and contractual obligations.

5. AI document processing

The Platform includes AI-assisted features that read documents you upload (such as contracts, payment claims and payment schedules) to transcribe, classify and extract information from them, so that the Platform can pre-fill drafts for your review. To provide these features we send the relevant documents and data to Anthropic, whose Claude models perform the processing via API.

• Under Anthropic's commercial API terms, inputs and outputs are not used to train Anthropic's models.
• Extraction results are staged in the Platform for your review — nothing extracted by AI takes effect until a user in your organisation confirms it.
• If you do not want a document processed by these features, do not upload it to an AI-assisted flow; the underlying records can always be entered manually.

6. Who we share information with

We share personal information only where necessary to operate the Platform or as permitted by law. Our key sub-processors are:

• Supabase — managed PostgreSQL database, file storage and authentication infrastructure.
• Vercel — application hosting and edge delivery.
• Inngest — durable background-job orchestration (for example email dispatch and document-processing pipelines).
• Resend — transactional email delivery (account confirmations, password resets, invitations, claim notifications).
• Anthropic — AI processing of documents and data for the extraction features described in section 5.
• Google — address autocomplete (Google Maps Platform / Places API): as you type an address into the Platform, the partial text is sent to Google to return matching address suggestions.
• PostHog — product analytics (see section 10).

When you use a registry lookup, we send the business identifier you entered to the relevant government registry — the Australian Business Register (operated by the Australian Taxation Office) or the New Zealand Business Number register (operated by the Ministry of Business, Innovation and Employment) — and store the record returned.

When you enter an address (for a company, counterparty or contract site), we send the text you type to Google's Places API to offer address suggestions. We store only the address you keep; the suggestions themselves are provided by Google.

We may also disclose personal information to our professional advisers, to related entities, in connection with a corporate transaction (such as a sale of the business), or to law enforcement or other authorities where required by law.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

7. Overseas disclosure

Several of our sub-processors are based outside Australia and New Zealand. In particular, Vercel, Resend, Anthropic, Google, Inngest and PostHog process data in the United States and the European Union. If you are in New Zealand, your information will also be processed in Australia. Where we transfer personal information overseas, we take reasonable steps to ensure that the recipient handles your information in accordance with applicable privacy laws, including (where relevant) by relying on Standard Contractual Clauses or equivalent safeguards.

8. Your rights and choices

Depending on your location, you may have the following rights in respect of the personal information we hold about you:

• access a copy of your personal information;
• request that we correct inaccurate or incomplete information;
• request that we delete your personal information (subject to legal or contractual retention requirements);
• object to or restrict certain types of processing, including analytics;
• request a portable copy of personal information you have provided to us; and
• withdraw any consent you have given.

How to make a data access or deletion request

To exercise any of these rights, email us at privacy@retentiontrack.com with the subject line “Privacy request” and a description of what you would like us to do. We may need to verify your identity before we can act on your request. We aim to respond within 30 days. Requests are currently handled manually; we will let you know if we need additional information or time.

If your account belongs to an organisation, please note that your organisation administrator may also be able to action access, correction or deletion requests directly within the Platform.

9. How long we keep your information

We retain personal information for as long as your account remains active and for a reasonable period afterwards to meet our legal, accounting and reporting obligations, resolve disputes, and enforce our agreements. When personal information is no longer required, we take reasonable steps to delete or de-identify it. Workspace content you create is retained for as long as your organisation's workspace remains active; once your organisation deletes the workspace, we will delete or de-identify the associated data within a reasonable period.

10. Cookies and analytics

We use a small number of cookies and similar technologies:

• Strictly necessary cookies that keep you signed in and remember your preferences. These are always set and cannot be disabled.
• Analytics and session replay cookies set by PostHog, which we use to measure page views, understand how product features are used, and replay sessions to diagnose issues and improve the Platform. We do not use advertising cookies, and analytics profiles are only created for signed-in users.

When session replay is enabled, text and form inputs are masked by default — we do not record what you type into the Platform.

If you would like to opt out of analytics or session replay, contact us at privacy@retentiontrack.com or configure your browser to block the relevant cookies.

11. Storage and security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encryption in transit and at rest, access controls, audit logging, and contractual obligations on our sub-processors. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

12. Children

The Platform is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

13. Additional information for New Zealand residents

If you are in New Zealand, the Privacy Act 2020 (NZ) and its Information Privacy Principles apply to our handling of your personal information. You have rights to access and correct the personal information we hold about you, which you can exercise as described in section 8. Your information may be held and processed in Australia and in the other locations described in section 7; we take reasonable steps to ensure comparable safeguards apply. If you have a privacy concern we cannot resolve, you may complain to the Office of the Privacy Commissioner at privacy.org.nz (opens in new tab).

14. Additional information for EU and UK residents

If you are located in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) and UK GDPR apply to our processing of your personal information. We act as a “controller” in respect of account information and analytics data, and as a “processor” in respect of workspace content you enter on behalf of your organisation. We rely on the following legal bases: performance of our contract with you, our legitimate interests in operating and improving the Platform, compliance with legal obligations, and (where required) your consent.

You have the right to lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner's Office (ICO); in the EU it is the data protection authority of the member state in which you live or work.

15. Additional information for California residents

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with rights to know what personal information we collect about you, to request deletion, to correct inaccurate information, and to not be discriminated against for exercising these rights. The categories of information we collect are described in section 2. We do not sell personal information.

16. Links to other websites

The Platform may contain links to third-party websites that we do not operate. We are not responsible for the privacy practices of those websites and recommend that you review their privacy policies before providing them with personal information.

17. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. If the changes are material, we will provide more prominent notice (for example, by email or via a notice in the Platform).

18. Complaints

If you have a complaint about how we have handled your personal information, please email us at privacy@retentiontrack.com. We will investigate and respond as soon as reasonably practicable. If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au (opens in new tab), to the Office of the Privacy Commissioner in New Zealand at privacy.org.nz (opens in new tab), or to the data protection authority in your jurisdiction.

19. Contact us

For any questions about this Privacy Policy or how we handle your personal information, please contact us at: