Privacy Policy

Effective 19 July 2026

1. About This Policy

This Privacy Policy explains how Alystrx Pty Ltd (ACN 700 412 120) (we, us, our) collects, holds, uses, and discloses personal information in connection with the SecondQuote service (the Service).

We are bound by the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We have designed the Service with data minimisation as a core principle.

2. Who We Are

Alystrx Pty Ltd is an Australian private company. SecondQuote is a product operated by Alystrx Pty Ltd. For privacy enquiries:

Email: privacy@secondquote.app

3. How the Service Works

The Service supports two usage modes:

• Anonymous use: you may submit a quote and receive a result without creating an account. Your email address and a session identifier are collected to support optional account creation after the fact.
• Authenticated use: you create an account using your email address via email verification: we send a single-use sign-in code (with a fallback link) to your email address. Account creation is prompted at payment or when you elect to save your result. Once authenticated, your submissions and results are linked to your account.

4. What Information We Collect

4.1 Information you provide

When you use the Service, we collect:

• Your name, collected at account creation.
• Your email address. In anonymous use, this is encrypted before storage. In authenticated use, it is managed by Supabase Auth and used to deliver your sign-in code.
• The text of the trade quote you submit for analysis. This may include details of the work described, pricing, and the trading name or contact details of the tradesperson who issued the quote.
• Details you enter about the quote, including trade type, job size, postcode, and urgency.

4.2 Information generated by the Service

When we analyse your quote, we record:

• The analysis result, including verdict band, comparability confidence, pricing risk signal, scope clarity, and completeness indicators.
• A session identifier used to link an anonymous submission to an account if you subsequently sign up.
• The date and time of your submission.

4.3 Account and authentication data

If you create an account, Supabase Auth stores:

• Your email address and authentication tokens.
• The date and time of account creation and last sign-in.

We store your name in a profiles table linked to your account. We do not store passwords. Authentication is handled exclusively via single-use codes and fallback links sent to your email address.

4.4 Feedback data

We collect optional feedback linked to your submission:

• Immediate feedback: a usefulness signal (thumbs up or down) and optional comment captured on the result page.
• Return feedback: when you return to the Service in a subsequent session, you may be prompted to indicate whether you proceeded with the quote. This signal is linked to your prior submission via your account.

4.5 Information we do not collect

• Payment card details. Payments are processed directly by Stripe, Inc.
• Files or images. Any file content is converted to plain text in your browser before transmission. No files reach our servers.
• Device identifiers or advertising identifiers.

4.6 Information about tradespersons

The quote text you submit may contain information about the tradesperson who issued it, including their business name, ABN, or contact details. We wish to be clear:

• We do not use tradesperson-identifying information for any purpose other than analysing the quote you submitted.
• We do not contact, profile, rate, or publish information about tradespersons.
• SecondQuote is not a review or ratings platform.

5. How We Use Your Information

• To deliver the analysis result to you.
• To authenticate you and manage your account.
• To link anonymous submissions to your account when you sign up after an anonymous submission.
• To capture and store feedback linked to your submissions.
• To improve the accuracy and calibration of our analysis engine using retained submission data.
• To develop aggregated, de-identified market intelligence. See Section 8.
• To detect and address errors, abuse, or misuse of the Service.
• To respond to privacy enquiries or complaints.

We do not use your information for targeted advertising or behavioural profiling.

6. How We Store and Protect Your Information

6.1 Storage location

All submission and account data is stored in a cloud database operated by Supabase, Inc., hosted in the Sydney, Australia region (AWS ap-southeast-2). Data does not leave Australia as part of normal Service operation, with the exception of AI processing described in Section 7.

6.2 Security measures

• Email addresses in anonymous submissions are encrypted before storage using a keyed encryption method.
• Authenticated account credentials are managed by Supabase Auth. We do not store passwords.
• All data in transit is encrypted using TLS (Transport Layer Security).
• Database access is controlled using Row Level Security (RLS) policies. Service accounts may only access the rows and columns their role permits.
• Database credentials are not exposed in client-side code.

6.3 Retention

We retain submission records, account data, and feedback to improve the accuracy of our analysis engine and to develop aggregated, de-identified market intelligence. Every quote submitted helps us keep benchmarks accurate for everyone who uses the service. Your de-identified data makes SecondQuote more capable for the next person who needs it.

You may request deletion of your account and personally identifiable data at any time. See Section 9. On receipt of a verified deletion request, we will delete your account, name, email, and any other directly identifying fields. Analytical fields that cannot be used to identify you will be retained in de-identified form.

7. AI Processing

The Service uses the Anthropic API to extract and interpret information from the quote text you submit. The text of your quote is transmitted to Anthropic's servers for this purpose. Before transmission, we apply an automated best-effort process that attempts to remove common contact details (such as email addresses, phone numbers, ABNs, and street addresses) from the text. This process may not remove all identifying information, and you should treat the quote text you submit as being disclosed to Anthropic.

Anthropic acts as a data processor on our behalf. This transmission constitutes a cross-border disclosure under the Australian Privacy Act. By using the Service, you consent to this disclosure. You can review Anthropic's privacy policy at anthropic.com/privacy.

8. Aggregated Data and Commercial Use

Submission data we retain is used to improve the SecondQuote engine and may be used to develop aggregated market intelligence about residential trade pricing in Australia. This data is never identifiable to you personally. If we commercialise this data, the following commitments apply:

• Data will be aggregated across a minimum threshold of submissions. Individual submissions will not be sold or disclosed.
• Data will be de-identified such that no individual homeowner or tradesperson can be identified.
• A minimum delay period will apply between collection and any commercial release.
• Raw quote text will not be included in any commercialised dataset.

9. Disclosure to Third Parties

We do not sell or disclose your personal information to third parties, except:

• Service providers acting as data processors: Supabase (database and authentication), Vercel (hosting), Stripe (payments), Anthropic (AI analysis). These providers act on our behalf and do not use your data for their own purposes.
• Legal obligations: where required by law, court order, or a regulatory authority.
• Business transfer: if Alystrx Pty Ltd is sold or merged, your information may transfer to a successor entity subject to equivalent privacy protections.

We do not sell personal information.

10. Your Rights

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and personally identifiable data.
• Make a complaint about how we have handled your information.

Contact privacy@secondquote.app to exercise these rights. We will respond within 30 days.

11. Complaints

Contact us first at privacy@secondquote.app. If unresolved, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

oaic.gov.au  |  1300 363 992

12. Cookies and Session Storage

The Service does not use advertising cookies or third-party tracking. We use browser session storage to maintain your session state. This is cleared when your session ends. Vercel may collect standard infrastructure access logs including IP addresses. This data is not linked to your submission data.

13. Children

The Service is not directed at persons under 15. We do not knowingly collect personal information from children. Contact privacy@secondquote.app if you believe a child has submitted information through the Service.

14. If the Service Is Discontinued

If we decide to shut down the Service:

• We will give at least 30 days notice by email to every user with an account or an active paid subscription. The notice will state the shutdown date, how to obtain a copy of your results before that date, and how to request deletion of your data.
• Any unused portion of a paid subscription will be refunded on a pro-rata basis, as set out in the Terms of Service.
• Deletion requests received before the shutdown date will be completed in full before wind-down proceeds.
• After the shutdown date, we will delete all personal information we hold, including accounts, names, email addresses, session identifiers, quote text, and feedback comments. Anonymised transaction records are retained for 7 years to meet Australian tax record obligations. Any analytical data retained beyond shutdown is de-identified to the standard described in Section 8.
• We will retain the secondquote.app domain for at least 12 months after shutdown so that an address you associate with the Service cannot be taken over by another party.

A sale or transfer of the business is not a discontinuation. In that case the business transfer provisions in Section 9 apply instead.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by an updated effective date. Continued use of the Service constitutes acceptance of the updated policy.

16. Contact

Alystrx Pty Ltd

Product: SecondQuote

Email: privacy@secondquote.app

Alystrx Pty Ltd  |  SecondQuote  |  privacy@secondquote.app