Privacy Policy

1.1 Business Account Information. When you create a GoLifto account, we collect information about your business including company name, ABN, registered address, contact phone number, and contact email address.

1.2 User Information. For each person who accesses the GoLifto platform on your behalf, we collect: full name, email address, and a hashed (not readable) version of their password. We also record the date and version of their Terms of Service acceptance.

1.3 Customer and Supplier Data (Your Business Data). In providing the GoLifto platform, we process the business data you enter, including: your customers' names, company names, ABNs, contact details, and addresses; your suppliers' names and contact details; your sales, quotes, purchase orders, and invoices; your product catalogue and inventory. This data belongs to you. We process it solely to provide the service.

1.4 Payment and Billing Information. We collect subscription billing information including billing address and subscription tier. Payment card details are collected and processed directly by Stripe — GoLifto does not store full card numbers. We do store Stripe customer and subscription identifiers to manage your billing relationship.

1.5 Usage and Log Data. We automatically collect technical information when you use the platform, including: IP address, browser type and version, pages visited, timestamps of actions, and error logs. This data is used to maintain platform security, diagnose issues, and improve the service.

1.6 Integration Data. If you connect GoLifto to third-party services such as Xero, Shopify, 17Track, or Cin7, we may receive and process data from those services as directed by you. That data is subject to the terms and privacy policies of those third-party platforms.

1.7 Communications. If you contact GoLifto for support, we retain records of those communications to assist you and improve our service.

We use personal information for the following purposes:

• Providing the Services — operating the platform, processing orders, generating documents, and enabling integrations;
• Account management — creating and managing your account and user access;
• Billing — processing payments, issuing invoices, managing subscription changes, and dunning for failed payments;
• Communications — sending transactional emails (account confirmations, invoices, payment reminders, trial expiry notices, and order confirmations);
• Security — protecting accounts, detecting unauthorised access, and preventing fraud;
• Platform improvement — understanding how the platform is used during the alpha phase to fix bugs and prioritise features;
• Legal compliance — meeting our obligations under Australian law including tax, accounting, and record-keeping requirements.

We do not use your Customer Data for any purpose other than providing the Services to you. We do not sell, rent, or trade your personal information or Customer Data to third parties for marketing or any other commercial purpose.

Where applicable, we process personal information on the following bases:

• Contract performance — processing is necessary to provide the Services under these Terms;
• Legitimate interests — platform security, fraud prevention, and service improvement (balanced against your privacy interests);
• Legal obligation — where required by Australian law (e.g. tax record-keeping);
• Consent — where you have expressly provided consent, such as agreeing to these Terms at account creation.

4.1 Third-Party Service Providers. We share information with trusted third-party service providers who assist us in operating the platform. These providers are contractually bound to process data only on our behalf and in accordance with applicable privacy laws. Our key sub-processors are:

4.2 Business Transfers. If GoLifto is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any such transfer and provide you with choices as required by applicable law.

4.3 Legal Requirements. We may disclose personal information if required to do so by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect the rights, property, or safety of GoLifto, our customers, or the public.

4.4 With Your Consent. We may share information in other ways with your explicit consent.

5.1 Storage Location. Customer data is stored on servers hosted by Supabase, using PostgreSQL. Supabase operates infrastructure in the United States and other locations. By using GoLifto, you consent to your data being transferred to and stored in these locations. Supabase complies with applicable data protection standards.

5.2 Security Measures. We implement appropriate technical and organisational security measures including: encryption of passwords using bcrypt hashing; HTTPS/TLS encryption for all data in transit; access controls limiting employee access to personal information; row-level security enforced at the database level; Stripe-hosted payment processing (we never touch raw card data).

5.3 Alpha Phase Caveat. During the alpha testing phase, security controls are still maturing. We strongly recommend you do not store highly sensitive personal information (such as government-issued identity document numbers) in the GoLifto platform during the alpha phase. We cannot guarantee the same security standards as a production environment.

5.4 Breach Notification. In the event of a data breach that is likely to result in serious harm, we will notify affected individuals and, where required, the Office of the Australian Information Commissioner (OAIC) as soon as practicable, in accordance with the Notifiable Data Breaches scheme.

6.1 Active Accounts. We retain personal information and Customer Data for as long as your account is active and for a reasonable period thereafter to enable you to reactivate, export data, or for us to resolve disputes.

6.2 After Cancellation. Following cancellation or termination of your account, we retain your data for 30 days to allow you to request an export. After this period, personal information and Customer Data are deleted from production systems. Residual copies may exist in backups for a further period before they are cycled out.

6.3 Legal Obligations. Certain information (such as tax invoices and financial records) may be retained for longer periods where required by Australian law (typically 5–7 years for financial records under the Income Tax Assessment Act).

6.4 Usage Logs. Technical log data is retained for security and diagnostic purposes for a period of up to 12 months.

7.1 Session Cookies. GoLifto uses session cookies to maintain your login state. These are essential to the operation of the platform and cannot be disabled without preventing you from using the service.

7.2 No Advertising Tracking. GoLifto does not use advertising tracking cookies, retargeting pixels, or third-party analytics that profile you for marketing purposes.

7.3 Future Analytics. We may in future introduce limited, privacy-respecting analytics to understand platform usage patterns. We will update this policy and notify you before doing so.

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights:

• Access — you may request access to the personal information GoLifto holds about you;
• Correction — if you believe information is inaccurate, out of date, or incomplete, you may request correction. Most information can be updated directly within the platform;
• Anonymity — where practicable, you may interact with us without identifying yourself. However, using the GoLifto platform requires an identified account;
• Complaints — you have the right to complain if you believe we have handled your personal information in breach of the Privacy Act. Please raise complaints with us first using the contact details in Section 12. If you are unsatisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC).

To exercise any of these rights, contact us at the details in Section 12. We will respond within a reasonable time (typically 30 days). We may need to verify your identity before processing a request.

The GoLifto platform is a B2B business tool and is not directed at or intended for use by children under the age of 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately and we will take steps to delete it.

The GoLifto platform may contain links to third-party websites or services (such as Stripe, Xero, or Shopify). This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you use in connection with GoLifto.

We may update this Privacy Policy from time to time. We will notify you of material changes via email to your registered address and/or an in-platform notification at least 14 days before the changes take effect.

The version of this Privacy Policy that applied when you created your account is recorded in our system. You may request a copy of the version you accepted at any time.

For privacy enquiries, requests to access or correct your personal information, or to lodge a complaint:

Privacy Officer
GoLifto Pty Ltd
ABN: 37 696 944 242
14A Hemsworth Ave, Northmead NSW 2152
Email: privacy@golifto.com

We aim to respond to all privacy enquiries within 30 days. If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.