PRIVACY
POLICY.

This draft explains the intended CardAudit data flow. Update it with your legal business name, ABN, contact address and final providers before launch.

Information collected

We may collect your name, email address, order details, card details, uploaded card photographs, consent records, payment status and communications.

Payments

Payment information is intended to be handled by Stripe. CardAudit should not store full payment card numbers on its own systems.

Image storage

Card images and completed reports are intended to be stored in private cloud storage. Access links can be time-limited. Images should not be publicly searchable.

Use

Information is used to process orders, assess submissions, communicate with customers, deliver reports, manage disputes and maintain service records.

Retention

Set and publish a retention period before launch. A reasonable operational starting point could be automatic deletion of source images after a defined period following report delivery, unless the customer separately consents to longer retention.

Service providers

The production build is prepared to use Supabase for order and file storage, Stripe for payments and Resend for transactional email. Their own privacy terms also apply to their processing.

Contact and access

Add a working privacy contact email before launch so customers can request access, correction or deletion where applicable.