Privacy Policy

Effective: 2026-06-02 Applies to: Attest, an ECTD product, operated from https://getattest.com.au. Operated by Jason (sole trader) under ECTD Holdings (ABN 97 305 279 416), Queensland, Australia.

---

1. What this policy covers

This policy explains what personal information Attest collects, how it is used, who it is shared with, how long it is kept, and what choices you have. It applies to:

• The Attest website at getattest.com.au
• The Attest checkout, intake forms, and deliverables
• The Attest agent-discoverable surface (/.well-known/attest.json, /services/pricing.json, etc.)

We follow the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

2. What we collect

When you buy a deliverable or submit an intake form we collect:

• Name, email, business name, country (for invoicing and delivery)
• Information you choose to submit about your service or endpoint (URL, description, current pricing, current auth method, etc.)
• Stripe checkout metadata (order ID, amount, currency, payment timestamp)

We do not collect:

• Your payment card details. Card data is collected and processed by Stripe directly. We never see, store, or transmit it.
• Government IDs.
• Health, biometric, or other sensitive information as defined in the Privacy Act.

When you visit the website we receive standard server logs (IP address, browser type, timestamp, requested URL). These logs are kept for short periods for operational and security purposes only.

3. How we use it

We use the information to:

• Deliver the readiness report, manifest pack, or endpoint kit you purchased
• Communicate about your order, follow up on intake answers, and send the deliverable
• Operate, secure, and improve the service
• Meet legal obligations (tax records, fraud prevention, dispute response)

We do not sell personal information. We do not share it for advertising.

4. Who we share it with

We rely on these third parties to operate Attest. Each has its own privacy practices:

• Stripe (payments, merchant of record) — processes your payment; their privacy notice applies to payment data.
• Supabase (audit ledger, hosted in Sydney, ap-southeast-2) — stores purchase, intake, and deliverable records.
• Vercel (hosting) — serves the website and webhook endpoint.
• Cloudflare (email routing) and Google (mailbox) — mail to our @getattest.com.au addresses is routed via Cloudflare Email Routing into a Google-hosted mailbox.

We may also disclose information where required by law (e.g. valid legal request, regulator instruction, court order) or to protect the rights, safety, or property of Attest, our users, or others.

5. Where it is stored

• Operational data: stored in Supabase Australia (Sydney).
• Email: Google Workspace (regional storage as configured by Google).
• Payment data: held by Stripe per their global infrastructure.

6. How long we keep it

• Purchase records: 7 years (Australian tax record-keeping obligation).
• Intake submissions and deliverable copies: 2 years after delivery, then deleted or anonymised.
• Server logs: 30 days.
• Email correspondence: kept while operationally useful, generally up to 3 years.

If you request deletion (see Your choices below), we will delete identifiable copies except records we are legally required to retain (such as tax records).

7. Your choices

You can:

• Ask what information we hold about you
• Ask us to correct it
• Ask us to delete it (subject to legal retention)
• Withdraw consent for future communications

Send any request to hello@getattest.com.au with the subject line Privacy request. We aim to respond within 30 days.

If you are unhappy with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

8. Cookies and tracking

Attest uses essential cookies only (session and security). No third-party advertising trackers, no behavioural advertising pixels, no analytics that share personal data with third parties.

9. Children

Attest is a business-to-business service. We do not knowingly collect information from people under 16. If you believe we have, contact us and we will delete it.

10. Agent buyers

Where an autonomous AI agent submits a purchase or intake on behalf of a principal, the principal is treated as the data subject for the purposes of this policy. The agent's principal is responsible for ensuring it has authority to submit the information.

11. Changes to this policy

We will update this page when our practices change. The Effective date at the top reflects the current version. Material changes will be communicated by email to active customers.

12. Contact

hello@getattest.com.au — Attest, an ECTD product, Queensland, Australia.