Privacy Policy

Effective date: 11 July 2026 · Practices informed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles

Contents

1. Who We Are

Locatalyze is the trading brand of VSG Group Australia Pty Ltd (ABN 47 683 197 819) ("we", "us", "our"), based in Perth, Western Australia. We operate the location screening platform at www.locatalyze.com.

Locatalyze handles personal information using practices informed by the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Whether we are legally required to comply with all APPs depends on factors such as annual turnover and related exceptions. We do not claim in this policy that Locatalyze is necessarily an APP entity. Regardless, we aim to be transparent and responsible with customer information.

Contact: hello@locatalyze.com

2. What Information We Collect

Information you provide

Information collected automatically

• IP address and approximate location (city/region level)
• Browser type, device type, and operating system
• Pages visited and features used (via anonymised analytics)
• Error logs for debugging purposes

What we do NOT collect (and ask you not to send)

• Tax file numbers, bank login credentials, card numbers, or identity documents for Expert Review
• Raw employee or customer personal records for Expert Review
• Government identifiers (TFN, driver's licence) as a product requirement
• Health or sensitive information as a product requirement
• Information about children under 18
• Biometric data

Expert Business Review document upload is not enabled in the current release. If you paste seller-provided financial figures into intake, treat them as confidential business information you are authorised to share. Remove unnecessary personal information first. We do not use Expert Review materials for marketing or model training.

Expert Business Review — additional notice

When you buy the Expert Business Review we collect the minimum information needed to deliver the service: intake answers, optional linked report identifiers, expert written summary and short call notes, booking metadata if scheduling is configured, waitlist email if capacity is full, and payment metadata via Stripe.

Purpose: deliver the purchased review and consultation, communicate about status, booking and refunds, improve service quality, and meet legal obligations.

Access: you (the purchasing customer) and authorised Locatalyze operators/admins. Support and Expert Review notifications use hello@locatalyze.com.

Service providers: may include hosting (e.g. Vercel), database (Supabase), payments (Stripe), email (Resend), analytics (PostHog — without capturing document contents or sensitive intake fields in analytics), and scheduling (Calendly) if/when configured. Some providers process data outside Australia — see Overseas Disclosure.

Storage and retention: stored with our primary application database under access controls. Retained while needed to deliver the service, handle disputes/refunds, and meet record-keeping needs, then deleted or de-identified when no longer required. You may request access, correction or deletion by emailing hello@locatalyze.com.

Complaints and breaches: privacy complaints and suspected data breaches should be sent to the same contact. We aim to respond promptly and will assess whether notification obligations apply.

3. Why We Collect It

We collect personal information only for the following purposes:

We will never sell your personal information to third parties. Ever.

4. Third-Party Services

We use the following third-party services. Each has its own privacy policy:

5. Data Storage and Security

Your data is stored in Supabase's managed database infrastructure. Supabase uses industry-standard encryption at rest and in transit (TLS 1.2+). Our application is hosted on Vercel's cloud infrastructure.

We implement reasonable technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. However, no internet transmission is completely secure and we cannot guarantee the absolute security of your data.

If we become aware of a data breach, we assess whether it is likely to result in serious harm and whether notification obligations apply (including under the Notifiable Data Breaches scheme where we are an APP entity). Where notification is required or prudent, we will notify affected individuals and, where applicable, the OAIC. We do not claim that every incident must be reported.

6. Data Retention

We retain personal information only for as long as reasonably needed for the purposes described in this policy, to meet legal, tax, security, and dispute-handling requirements, and then delete or de-identify it where practicable. Exact schedules vary by system; we are refining documented retention periods over time.

• Account data — kept while your account is active. When you delete your account in-product, authentication and profile records are removed. Linked reports are de-identified and unlinked (street-level address and share links removed; suburb-level artefacts may remain for integrity and abuse prevention). Some operational copies may remain briefly in backups. Payment invoices may remain with our payment provider for tax and accounting.
• Report data — kept while linked to your account. You can delete individual reports in-product. After account deletion you lose dashboard access to those reports; de-identified artefacts are not usable as your login. For a fuller purge of remaining artefacts, email hello@locatalyze.com.
• Payment records — payment providers and tax rules typically require multi-year retention of transaction records (often around 7 years in Australia).
• Server and error logs — retained for a limited period for security and debugging, then rotated by our hosting providers.
• Marketing contacts — kept until you unsubscribe or we remove inactive contacts.

7. Disclosure of Personal Information

We will only disclose your personal information to third parties:

• To the third-party service providers listed in Section 4, as required to operate the Platform
• Where required or authorised by Australian law (e.g. in response to a court order or request from the Australian Taxation Office)
• To protect the rights, property, or safety of Locatalyze, our users, or the public
• In connection with a sale or merger of the business, where the acquirer agrees to be bound by this Privacy Policy

We will never sell, rent, or trade your personal information to any third party for marketing purposes.

8. Access, Correction and Deletion

Consistent with responsible privacy practice (and APP-style expectations where they apply), you can ask us to:

• Access — provide a copy of the personal information we hold about you
• Correction — correct inaccurate, incomplete, or outdated personal information
• Deletion — delete your account and associated personal information (subject to legal retention needs). You can also use in-product account deletion where available
• Opt-out — unsubscribe from marketing communications at any time
• Complaint — raise a privacy concern with us; you may also contact the OAIC

Email hello@locatalyze.com. We aim to respond within 30 days. Purchased reports remain available in your account while it is active; export or retrieve them before deletion if you need a local copy.

9. Cookies and Analytics

We use strictly necessary cookies and similar technologies to maintain your login session and protect the service. We do not use advertising cookies for third-party ad targeting or remarketing.

Optional analytics tools (Google Analytics, Microsoft Clarity, and PostHog on our production site) help us understand usage. They may set cookies or use local storage. Where available, we reduce identifiable detail (for example IP anonymisation in Google Analytics). Australia does not impose an EU-style cookie consent wall for this setup; we provide a clear preference control instead.

Manage optional analytics: Analytics preferences. Choosing "Essential only" stops optional analytics loading in that browser after you save (reload if scripts already started).

10. Marketing Communications

We send marketing emails (such as weekly insights) only when you subscribe or otherwise give clear consent. Creating an account alone is not treated as unlimited marketing consent. Marketing consent is separate from accepting the Terms.

Every marketing message identifies Locatalyze and includes an unsubscribe option. One-click unsubscribe links are provided where available; you can also email hello@locatalyze.comwith subject "Unsubscribe". We honour unsubscribe requests and do not automatically re-add you after you opt out. Transactional emails about your account, payments, or reports are not marketing.

11. Children's Privacy

The Platform is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a person under 18, we will take steps to delete it promptly.

12. Overseas Disclosure

Some service providers process data outside Australia. Confirmed and likely regions include Japan (primary database and authentication on Supabase in the Tokyo / ap-northeast-1 region), the United States (for example Vercel, Stripe, OpenAI, Anthropic, PostHog, Google, Microsoft), and European hosting for some workflow tooling (for example n8n Cloud). Exact regions for other providers can change as they update their infrastructure. We do not claim that personal information never leaves Australia.

We use reputable providers and take reasonable steps appropriate to our size to protect information transferred overseas. Where APP 8 formally applies to us, we will take the steps that principle requires.

13. Complaints and Contact

If you have a complaint about how we handle your personal information, contact us first. We aim to resolve privacy complaints within 30 days.