This Privacy Policy explains how we collect, use, share, and protect personal information when you use Trupari. It is written to satisfy our obligations under the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA / CPRA), and the Australian Privacy Principles (APPs).

1. Who we are

Trupari is operated by Can Unlimited (ABN 42813703398), a sole-trader business registered in Victoria, Australia, trading as "Trupari". Our registered business address is held on the Australian Business Register and is available on request to the contact below. We are the data controller for personal data described in this Policy.

Privacy questions or data-rights requests: [email protected]. We have not appointed a separate Data Protection Officer; the privacy mailbox is monitored by the business operator.

2. What we collect

• Account data: email address; your password (stored only as an Argon2 hash, never in plaintext); if you enable two-factor authentication, a TOTP secret and single-use recovery codes (the recovery codes are stored hashed); a per-user API key.
• Profile data (optional): company name; Slack webhook URL (if you set one up).
• Product data: the currency corridors you create, your published rates, competitor rates you enter, and the benchmark snapshots / AI summaries the system generates from them.
• Billing data: subscription status, plan tier, and a Paddle customer ID. Payment-card details are handled by Paddle as Merchant of Record and never reach our servers.
• Operational logs: request timestamps; IP addresses (used for rate-limiting, abuse detection, and audit trails); user-agent strings; error events; audit-log entries for sensitive actions (login, password change, 2FA setup, plan change, API-key rotation).
• Cookies and similar: see Section 9 below.

3. Legal basis (GDPR / UK GDPR)

Purpose	Legal basis
Providing the service you signed up for	Contract (Art. 6(1)(b))
Billing and tax records	Contract + Legal obligation (Art. 6(1)(b), 6(1)(c))
Rate-limiting, abuse detection, security	Legitimate interests (Art. 6(1)(f))
Transactional emails (welcome, password reset, payment receipt, trial expired)	Contract (Art. 6(1)(b))
Product improvement using aggregated/de-identified data	Legitimate interests (Art. 6(1)(f))
Optional marketing communications	Consent (Art. 6(1)(a)) - you can opt out at any time

4. How we use it

• To operate the benchmarking service you signed up for.
• To deliver transactional emails (the ones above).
• To bill you, prevent abuse, and respond to support requests.
• To produce aggregated, de-identified statistics that improve the product (e.g., "what's the typical USD/INR spread across all customers"). We never publish information that could identify you or your customers.

5. What we never do

• We do not sell your personal data to anyone.
• We do not share your published rates or competitor entries with other customers.
• We do not use your data to train AI or machine-learning models. Generated text summaries come from Google Gemini. The prompt contains a single corridor's numbers plus two pieces of text you typed yourself: the corridor's label and the name of any competitor you added. It contains no account identifier — no user ID, no email address, no API key. Because the label and competitor name are free text, please avoid putting anything confidential in them if you would rather it were not processed by Google.
• We do not knowingly collect data from anyone under 18.

6. Who we share it with

We use the following sub-processors. Each of them processes data on our instructions under a written data-processing or equivalent contract, with appropriate safeguards for international transfers. Google Fonts is the one exception and is listed for completeness rather than as a processor: your browser requests those files directly from Google, so no data of ours is passed to them and no such contract applies. The row below sets out exactly what that request discloses.

Sub-processor	Purpose	Location
Google Cloud (Cloud Run, Cloud Logging, Secret Manager)	Application hosting, operational logs, secret storage	Australia (australia-southeast1)
Firebase Hosting (Google)	Static website delivery	Global CDN
Supabase	Managed Postgres database	AWS region as configured at account level
Cloudflare	CDN, DDoS protection, WAF, DNS	Global edge
Paddle.com Market Limited	Billing and payments as Merchant of Record	UK / Ireland / global per Paddle
Google (Gemini API)	Generating plain-English benchmark summaries from corridor numerics	Per Google AI region policy
Loops	Transactional email delivery	USA
Formspree	Delivery of messages you send us through the in-app contact form	USA
Google Fonts	Web fonts on our public pages. Your browser requests these directly from fonts.googleapis.com and fonts.gstatic.com, which discloses your IP address and browser user-agent to Google. No account data is involved, and no cookie is set by these requests.	Global CDN

We are working to serve these font files from our own domain, which would remove the request to Google entirely. Until then it is listed above so the disclosure matches what your browser actually does.

If we add a new sub-processor, we will update this list at least 14 days before the change takes effect. You can object to a new sub-processor at [email protected]; if we cannot accommodate the objection, you may cancel your subscription and receive a prorated refund for any unused prepaid term.

7. International data transfers

Trupari is operated from Australia. Sub-processors may store or process data in the EU, the United Kingdom, the United States, or elsewhere. Where personal data of EU / UK residents is transferred outside the EEA / UK, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission (2021/914/EU), and the UK International Data Transfer Addendum where applicable;
• Adequacy decisions where the destination country has one;
• Supplementary technical measures (TLS in transit, encryption at rest, access controls).

8. Retention

Account, product, and operational data is retained while your account is active and for 30 days after cancellation to allow reactivation. Billing records are retained for 7 years. The ATO requires most business records to be kept for at least five years from the later of when the record was made and when the transaction was completed; we keep billing records longer than that minimum so they still exist through any amendment period or dispute about a payment. Audit-log entries are retained for 2 years. You may request earlier deletion by email; we will action it unless we are legally required to retain the data. When an account is deleted — by you or by the automatic sweep — billing records are stripped of everything that identifies you (your account link and the raw payment-provider payload) and only the transaction skeleton is kept for the remainder of that period.

Consensus Engine uploads: files you upload are streamed to a temporary file on the server's ephemeral, in-memory filesystem, parsed, and deleted as soon as the run finishes — whether it succeeded or failed. Nothing is written to our database or to any persistent storage, and uploads are never sent to any large language model. The temporary file exists only inside the container handling your request; when that container stops, its filesystem goes with it. If you leave or refresh the page, you will need to upload the files again.

Free rate check limits: to apply the daily fair-use limits on the free rate check, we keep a count of checks against a one-way hash of your network address and of the random identifier described in Section 9. The hash is made with a secret key and is different every day. We never store the address, the identifier or anything you entered, and each day's counts are deleted the following day.

9. Cookies and similar technologies

We use a small number of cookies and equivalents:

• Strictly necessary - first party: trupari_api_key and trupari_saved_email in localStorage (not cookies, but equivalent local data). They store your session and remember your last-used email. Without them you cannot log in.
• Functional - first party: trupari_insight_cache_v1 caches the plain-English summaries described in Section 5, together with the benchmark figures that produced them — your rate, the mid-market rate, any competitor you named and their rate, and the resulting verdict. It exists so that reloading the dashboard does not re-run the summary. Entries expire after 24 hours and are deleted when they expire. We clear this cache when you sign out, and clear every item listed here when you delete your account. trupari.freeRateDemo.used.v1 is a single true/false flag that earlier versions of the landing page set after a free rate check; it contains no rates and no personal data, is no longer used, and is deleted the next time you open the home page. trupari.freeCheck.visitor.v1 is a random identifier the free rate check sends with each check, so that its daily fair-use limit applies to you rather than to everyone sharing your connection. It is replaced with a new one every day and holds nothing about you. trupari.planIntent.v1 is kept in session storage, for the current tab only: it remembers the plan you chose on one of our product pages while you sign in, and is removed when you close the plan window or the tab.
• You can remove all of them at any time through your browser's site-data controls. Removing them signs you out; nothing is lost server-side.
• Strictly necessary - third party (Cloudflare): __cf_bm and cf_clearance are set by Cloudflare for bot-management and threat-mitigation. We cannot disable these while keeping our DDoS / WAF protection active.
• Strictly necessary - third party (Paddle): Paddle sets short-lived cookies during checkout for session continuity and fraud prevention.
• Analytics: we include no analytics script in the pages we publish, and we run no analytics product of our own. Cloudflare Web Analytics can be turned on at the network layer, in which case Cloudflare injects a cookieless beacon that counts page views; our Content-Security-Policy permits that one beacon and no other script of its kind. It sets no cookie, and it is not used to identify you or to follow you across sites.

We do not use advertising or cross-site tracking cookies. Because all cookies in current use are strictly necessary or first-party analytics, no consent banner is presented; however, you may block cookies in your browser at any time. Doing so may break login.

10. Your rights

Depending on where you live, you may have the following rights. We honour all of them for all users regardless of geography to keep things simple.

• Access the personal data we hold about you;
• Correct data that is inaccurate or incomplete;
• Delete data ("right to be forgotten");
• Export data in a portable format;
• Restrict or object to certain processing;
• Withdraw consent for any processing based on consent;
• Not be subject to fully automated decisions with legal or similarly significant effect. We do not currently make such decisions.
• Opt out of "sale" or "sharing" of personal data under CCPA / CPRA. We do not sell or share personal data; this is provided for the avoidance of doubt.

Email [email protected] from the address on your account. We will respond within 30 days (or sooner where required by applicable law).

11. Marketing communications

Transactional emails (welcome, password reset, payment receipt, trial expired) are not marketing and cannot be turned off while your account is active. Any future marketing emails will be opt-in only, and every marketing email will contain a one-click unsubscribe link.

12. Security

• All traffic is encrypted in transit (TLS 1.2+ with HSTS).
• Data is encrypted at rest by our database and hosting providers.
• Passwords are hashed with Argon2 (an OWASP-recommended password hash).
• 2FA (TOTP) is offered as an option; recovery codes are Argon2-hashed and single-use.
• Direct origin access to our backend is blocked at the edge; only requests through Cloudflare reach the application.
• Production secrets are stored in Google Secret Manager and are not committed to source control. Our source repository is local and has never been published to any hosting service. One development API key was committed to that local history in an early load-test script in January 2026 and removed shortly afterwards; it has been verified as inactive and was never valid for any customer account.
• API keys can be rotated at any time from your account screen.
• We maintain an audit log of sensitive actions.

No system is perfectly secure. If you discover a vulnerability, please email [email protected].

13. Children

Trupari is a B2B product and is not directed to children. We do not knowingly collect data from anyone under 18 years old. If you believe a child has provided us with personal data, contact [email protected] and we will delete it.

14. Complaints

• EU / EEA: you have the right to lodge a complaint with your local supervisory authority. A list is available at edpb.europa.eu.
• UK: the Information Commissioner's Office (ico.org.uk).
• Australia: the Office of the Australian Information Commissioner (oaic.gov.au).
• California: the California Privacy Protection Agency (cppa.ca.gov).

We would appreciate the chance to address your concern first; please email [email protected] before escalating.

15. Changes to this Policy

We may update this Policy from time to time. Material changes will be notified by email at least 14 days before they take effect. The "Effective" date and the version identifier at the top identify this exact wording: the version contains a hash of the document text, so it necessarily changes whenever the text does. The version recorded against your account at sign-up is the one you accepted.

16. Contact

Privacy and data requests: [email protected].