Privacy Policy

Forensik Labs Pty Ltd (ABN to be confirmed), trading as Forensik, is bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, why, who we share it with, and how you can see, correct or complain about it.

We collect personal information about two groups of people: the users of your organisation’s account, and the recipients of your orders (your customers, the receivers of each consignment).

Account details. Name, work email, password (stored only as a one-way hash), your organisation’s name, business address and ABN, and the role of each user. We use these to create and secure your account, send account emails and bill you.

Freight data and recipient details. Orders, consignments, carrier invoices, rate cards and claims, imported from your store, your carrier files or uploads. These include recipient details from orders: your customers’ (receivers’) names and suburb, state and postcode, and imported files can contain street addresses, phone numbers and email addresses. We hold this on your behalf, only to run the service for you: work out expected freight costs, audit invoices and prepare recovery claims. We do not use it to contact your customers.

Connection credentials. Access tokens and API keys for the stores and carriers you connect, stored encrypted, used only to fetch and send the data the connection needs.

Billing details. Your billing contact, plan and usage counts. Card details are entered with Stripe and never reach us.

Usage and security records. IP address, browser, sign-in times, failed sign-ins and an audit log of changes. We use these to keep accounts safe (rate limits and account lockout), investigate problems and show your administrators who changed what.

Waitlist and enquiries. Your email, any answers you choose to give (such as order volume and carriers), the page you arrived on and the referral link you used. We use these to tell you about launch and, if you asked, to follow up your enquiry.

Website cookies. Only with your consent, analytics and advertising cookies on our public website. See our Cookie Notice.

We collect most information from you directly or from the systems you connect. If you do not give us the account details we ask for, we cannot provide an account. You can browse our public website and join the waitlist without giving your name.

AI features are off until your organisation switches them on. When they run, we remove receiver names, phone numbers, email addresses and street addresses before anything is sent to the AI provider. We do not use your data to train AI models.

Users in your organisation, according to their role. A small number of Forensik staff, to support you and keep the service running: support staff see receiver names, phone numbers and street addresses masked to suburb and postcode, and must record a reason to unmask them. Every staff access is written to a log staff cannot change, and your administrators can see it in Settings.

We do not sell personal information, and we do not share it for other businesses’ marketing.

We use the providers below to run Forensik. Each receives only what it needs and is bound by contract to protect it. Some are based overseas, so your information may be disclosed to recipients in these countries:

• Hosting and database provider (to be confirmed) (To be confirmed): runs the app and stores its database and backups.
• Stripe (United States and Australia): subscription billing, payment processing and tax invoices.
• Anthropic (United States): ai features: reading pdf rate cards, suggesting column mappings, reading carrier replies and writing summaries.
• Resend (United States): sends account, invitation, alert and waitlist emails.
• Sentry (United States): error monitoring, so we can find and fix faults.

We take reasonable steps to make sure these providers handle personal information consistently with the APPs. The full, current list is on our Sub-processors page. We will name where our production database is stored once that is decided.

We also share data with the stores and carriers you connect, because you ask us to, and with authorities where the law requires.

Data travels over encrypted connections, each organisation’s data is kept apart inside the database, stored connection credentials are encrypted, and staff sign in separately with two-factor login. See our Security page. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.

We keep your information while your organisation is subscribed. After it ends you have 30 days to export your data; we then delete it, except records we must keep by law (such as tax records, usually 5 years). De-identified, aggregated data already created (section 3) is kept, because it contains no personal information. Waitlist details are kept until you unsubscribe or ask us to delete them.

You can ask for the personal information we hold about you and ask us to correct it. Most account details can be changed in Settings. Otherwise email (contact email to be confirmed). We will respond within 30 days. We may need to confirm who you are, and we will tell you in writing if we refuse and why.

If you are a receiver whose details a Forensik customer gave us, please contact that business first; we will help them answer you.

We send launch and product news only to people who asked for it or are customers. Every marketing email has an unsubscribe link. Account and security emails are part of the service and are sent regardless.

If you think we have mishandled your personal information, email (contact email to be confirmed) with the details. We will acknowledge it within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC): online at www.oaic.gov.au or by phone on 1300 363 992.

We will post any change here with a new date, and email customers about a material change.