Privacy Policy

Revenue Rescue is supplied by ON TRACK by TRACE, ABN 36 530 564 761, Queensland, Australia.

Revenue Rescue is designed to handle only information reasonably required to provide the service and to keep customer workspaces separated.

Whether ON TRACK is legally an APP entity in a particular period or activity depends on the Privacy Act 1988 (Cth), including turnover and applicable exceptions. Where the Australian Privacy Principles apply, ON TRACK must comply with them. Revenue Rescue also adopts an APP-aligned privacy-by-design baseline for Australian deployments even where legal coverage requires customer-specific confirmation.

Depending on configuration, Revenue Rescue may process user names, business email addresses, authentication and account details, workspace membership and role information, operational records supplied or synchronised by a customer, findings, action notes, recovery evidence references, support records, inbound business email information, audit events and service-security metadata.

Where paid billing is enabled, Revenue Rescue may retain limited billing references such as a Stripe customer or subscription identifier and payment status. Full payment-card numbers are not intended to be stored by Revenue Rescue.

Clinical notes, diagnoses, bank credentials, government identity documents and unrelated sensitive free text are not required for the ordinary Revenue Rescue service and should not be supplied unless a separately approved use specifically requires them.

Information may be collected directly from users, from authorised customer uploads, through approved system integrations, from approved inbound business email, from support interactions and automatically through essential security and service logs.

Users and customers must only provide information they are authorised to provide. Customer onboarding must define the approved source, fields and purpose before real-data use.

Information is used to authenticate users, enforce workspace permissions, run configured detection rules, display findings, manage actions, record recovery evidence, produce authorised reports, maintain audit history, administer billing where enabled, operate approved inbox/reply functions, provide support and protect service security.

For pilot validation, Revenue Rescue is designed to provide a privacy-minimised proof view containing only the minimum evidence needed to demonstrate system performance instead of requiring ON TRACK to browse unrestricted operational records.

Revenue Rescue is not designed to sell customer information or use customer operational data for unrelated advertising.

Revenue Rescue uses deterministic rules to identify operational exceptions and generate decision-support findings. A suitably authorised person remains responsible for business decisions by default.

Some approved configurations can create/send an invoice or send an overdue-invoice reminder after customer authority, evidence and provider-permission gates pass.

From 10 December 2026, if Revenue Rescue is configured to use Personal Information to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an Individual's rights or interests, the Privacy Policy will describe the relevant kinds of Personal Information and decisions where required by APP 1.

Information may be disclosed to contracted infrastructure, database, security, communications, integration and support providers only where reasonably required to operate the service or satisfy a lawful obligation.

Where paid checkout is enabled, payment information is provided to Stripe for payment processing. Stripe handles that information under its own terms and privacy practices.

A customer's authorised administrators and users may see information according to their workspace role and permissions.

Some contracted technology providers may process or receive information outside Australia depending on the provider and configured service. Before unrestricted real-data production use, ON TRACK records the configured provider/cross-border position and, where practicable and required, the likely overseas recipient countries for the customer deployment.

Where APP 8 applies, the responsible APP entity must take reasonable steps in the circumstances before disclosing Personal Information to an overseas recipient to ensure the recipient does not breach the APPs (other than APP 1), unless a statutory exception applies. Section 16C accountability must also be considered.

The current customer agreement/data schedule may provide the configured provider-country information or a maintained provider schedule where legally appropriate.

Revenue Rescue uses safeguards including authentication, role-based access, tenant scoping, protected production cookies, audit controls, controlled integration credentials, secret-management controls and production release checks. No internet service can guarantee absolute security.

Suspected unauthorised access or a data incident should be reported promptly through the Contact & support route.

Where the Australian Notifiable Data Breaches scheme applies, suspected eligible breaches are assessed reasonably and expeditiously. Revenue Rescue uses a 72-hour internal initial-assessment target where reasonably possible; this is not the statutory deadline. All reasonable steps must be taken to complete the statutory assessment within 30 calendar days, and eligible-breach notifications must be addressed as soon as practicable.

Information is retained only as required for service operation, contractual, audit, security and legal purposes, subject to the product's retention and deletion controls and any applicable customer agreement.

Where APP 11.2 applies, reasonable steps must be taken to destroy or de-identify Personal Information that is no longer needed for an authorised purpose unless a legal exception permits or requires retention.

Deletion requests may be subject to legal, security, backup, audit or dispute-preservation requirements.

An Individual may request access to or correction of Personal Information held by ON TRACK where applicable. Requests should be made through the customer's authorised administrator or the Contact & support route. Identity and authority may need to be verified before a request is actioned.

Where the relevant record is controlled by the customer rather than ON TRACK, ON TRACK may coordinate the request with the customer's authorised privacy contact.

A privacy concern or complaint may be submitted through the Contact & support route or the privacy contact stated in the applicable ON TRACK proposal/agreement. The complaint will be assessed, relevant information may be requested, and an outcome or next step will be provided within a reasonable period.

Where the Privacy Act applies, a complainant may be able to take an unresolved privacy complaint to the Office of the Australian Information Commissioner after first raising it with the relevant entity. Nothing in this policy limits any other right to contact an applicable regulator.

Revenue Rescue operational notifications, password/security messages, inbox alerts and invoice/account reminders are intended to be factual/operational and not promotional.

Factual service messages must not be mixed with sales offers, cross-selling or promotional banners. The secure inbox reply function is not approved as an unsolicited marketing or bulk-marketing tool.

If an electronic message is commercial under the Spam Act 2003 (Cth), the approved sender must ensure the required consent basis, sender identification/contact information and compliant unsubscribe facility, and must honour unsubscribe requests within the legally required period.

This policy may be updated when the service, provider arrangements, privacy practices or legal requirements change. The effective date shown on the policy identifies the current published version.