Privacy Policy

This Privacy Policy explains how Mercury Road Equipment Pty Ltd (ABN 36 614 422 187) (“we”, “us” or “our”) collects, uses, shares and protects your personal information when you use Tradeflux (the “Service”), including the Tradeflux iOS app. We handle personal information in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

Tradeflux is voice-first by design. To make the voice and AI features work, your information is sent to third-party AI processors — that’s an inherent part of how the product functions and can’t be avoided if you use those features. Sections 4 and 5 set out exactly who receives what, and why.

1. Who we are

Mercury Road Equipment Pty Ltd is the entity responsible for your personal information. You can reach us about privacy at vlad@dfortix.ai.

2. What we collect

• Account information — your email address and/or Australian mobile number, and a password if you set one (stored only as a secure hash). If you sign in with Google, Microsoft or Apple, we receive your name and email address from that provider.
• Business profile — your business name, ABN, GST status, address, contact details and the bank details you enter for your invoices.
• Client and contact information — the names, email addresses, phone numbers and addresses of the clients you quote and invoice, which you enter or speak.
• Document and books data — quotes, invoices, credit notes, jobs, expenses, line items, amounts, notes and payment records, and the PDF documents the Service generates from them.
• Voice data — when you use voice features, the audio you speak, the transcript generated from it, and your language preference.
• Usage analytics — events about how you use the product: which features you used, how long steps took, error codes, retries, and whether you worked by voice or by hand. These events are metadata only — they never contain transcript text, document content or your clients’ details.
• Technical and delivery data — a session cookie, a language-preference cookie, standard request logs (such as IP address and browser type) used for security and rate limiting, email delivery and bounce events from our email provider, SMS delivery status, and metered usage of voice, SMS and documents attributed to your account for billing and cost control.

3. How we use your information

We use your information to:

• provide the Service — creating, drafting (including by voice), rendering and emailing quotes, invoices and credit notes, and keeping your books;
• look up your ABN and GST status so your documents are tax-correct;
• track payments, jobs and the status of your documents;
• process your subscription, included-document allowance and payments;
• sign you in and verify it’s you — including sending one-time codes by SMS or email;
• improve the Service — including reviewing how the voice assistant performed (see section 4) and analysing the aggregated, de-identified usage statistics described in section 7;
• secure your account, prevent misuse and enforce fair-use limits; and
• respond to you and meet our legal obligations.

4. AI and your data

The voice assistant is built on third-party AI services, and using it means your data is processed by them:

• Speech and conversation — ElevenLabs. When you use voice features, your voice audio and the live transcript are processed by ElevenLabs, along with the business profile, document draft and client details the assistant needs to act for you. ElevenLabs retains conversation recordings and transcripts on its platform, where we can access them for support and quality purposes.
• Understanding and drafting — large language models. Your transcript and that working context are processed by a large language model (currently Google’s Gemini, via ElevenLabs) to understand your request and draft documents and actions in real time.
• Quality review — Anthropic. We periodically review recent voice conversations to find and fix assistant mistakes, including by processing transcripts with Anthropic’s Claude models to evaluate the assistant’s performance. Transcript text is processed for that evaluation but is not kept in our own database.

These providers process your data to deliver the Service, as our processors under their own terms. We do not use your data to train our own AI models, we don’t sell it, and we don’t allow it to be used for third-party advertising. Remember that AI output can be wrong — you review every document before it’s sent (see our Terms of Service).

5. Who we share it with

We share information with the following providers so the Service can function. We only share what each one needs for its specific purpose.

• ElevenLabs (voice AI — United States). Voice audio, transcripts and the assistant’s working context, as described in section 4. This is the most significant sharing of your data and only happens when you use the voice features.
• Google (United States). The Gemini language model behind the voice assistant (via ElevenLabs); the address text you type or speak, sent to the Maps Places API for suggestions and standardisation; and sign-in, if you use a Google account.
• Anthropic (United States). Voice-conversation transcripts, processed for the quality review described in section 4.
• Stripe (billing — United States). Your email, subscription status and document usage to manage your subscription and process payments. Stripe collects your payment details directly under its own terms; we don’t store full card numbers.
• Apple (United States). If you subscribe through the iOS app, Apple processes the purchase against your Apple Account and tells us your subscription status; we never see your payment details. Apple also handles sign-in if you use “Sign in with Apple”.
• Microsoft (United States). Sign-in, if you use a Microsoft account.
• ClickSend (SMS — Australia). Your mobile number and the one-time codes we text you to sign in.
• SMTP2GO (email — Australia). Your client’s email address and the document being delivered, plus the delivery and bounce events that tell us whether it arrived.
• Australian Business Register (Australia). ABN and business-name queries to confirm your business and GST details.
• Hosting / database. Your account, document and books data are stored in our database to operate the Service.

We do not sell your personal information, and we don’t share it for third-party advertising. We may disclose information where the law requires it.

6. Overseas disclosure

Some of the providers above are located, or process and store data, outside Australia — principally in the United States. Where your information goes overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, including by sharing only what each provider needs and engaging providers with appropriate security practices.

7. Usage analytics and statistics

We measure how the product is used — how long it takes to raise an invoice, where people get stuck, whether voice or manual entry was used, and what errors occurred. These events are deliberately metadata only: they record field names, durations, counts and error codes, never what you said or typed. We use them, and aggregated statistics derived from them, to fix friction and decide what to build. Aggregated statistics cannot identify you. We don’t use third-party advertising or cross-app tracking SDKs.

8. Voice is optional

Voice features require sending your audio and transcript to the AI providers above — there’s no way to provide real-time voice invoicing without that. If you’d rather not have your voice processed this way, you can simply not use the voice features: every field in Tradeflux can be entered and edited by hand, and the manual path doesn’t send audio or transcripts to the voice providers. The iOS app only accesses your microphone while you’re using the voice assistant, with your permission.

9. Storage and security

We take reasonable steps to protect your information, including hashing passwords, storing only a hash of your session token, encrypting data in transit, and verifying the authenticity of billing and delivery webhooks. No method of transmission or storage is completely secure, but we work to protect your information from misuse, interference, loss and unauthorised access, modification or disclosure.

10. How long we keep it

We keep your information for as long as your account is active and as long as we need it to provide the Service, comply with our legal obligations (including tax and financial record-keeping requirements), resolve disputes and enforce our agreements. You can delete your account and its associated data at any time from the account menu in the app, or ask us to do it. When information is no longer needed, we take reasonable steps to destroy or de-identify it.

11. Your rights

Under the Australian Privacy Principles you can ask us to access or correct the personal information we hold about you, and you can ask us to delete it. You can also delete your account and its data yourself, at any time, from the account menu in the app. To make a request, email vlad@dfortix.ai. We’ll respond within a reasonable time and may need to verify your identity first.

12. Cookies

We use an essential session cookie to keep you logged in and a preference cookie that remembers your language. We don’t use advertising or tracking cookies.

13. Children

Tradeflux is intended for businesses and is not directed at anyone under 18. We don’t knowingly collect personal information from children.

14. Data breaches

If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

15. Changes to this policy

We may update this Privacy Policy from time to time — including when we add features or change providers. If we make material changes we’ll take reasonable steps to let you know. The “last updated” date above shows when it was last revised.

16. Contact and complaints

If you have a question or a privacy complaint, contact us at vlad@dfortix.ai and we’ll work to resolve it. If you’re not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au. You can also read our Terms of Service.