Privacy Policy

Effective date: 14 October 2026

1. Who we are

This policy explains how Sandra Farquhar, a sole trader trading as TrustShyft (ABN 56 708 268 607) (“TrustShyft”, “we”, “us”) handles personal information. It covers this website and the TrustShyft platform. We are based in Brisbane, Queensland, and we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Personal information we collect

From website visitors and enquirers

• Name, email address, organisation and role you enter in our contact form
• What you write in your message, and our correspondence with you
• Newsletter sign-ups, if you subscribe
• Technical information such as IP address, browser, device and pages visited (see our Cookie and Tracking Notice)

From people who use the TrustShyft platform

• Account details: name, work email, organisation, role and access level
• Sign-in and security information, such as login times and authentication records
• Decision records you create: that you reviewed an AI-assisted output, what you decided, when, and any reasons or notes you entered
• How you use the platform, such as actions taken and errors encountered

Inside decision records our customers create

Customers use TrustShyft to record human oversight of AI-assisted decisions in their own work, for example in mortgage broking or legal practice. A decision record can refer to the customer’s own clients or matters and may contain their personal information, such as names, reference numbers and details of the decision. Our customer decides what goes in. We handle that information on our customer’s behalf, under our agreement with them, and only to provide the service. We encourage customers to record references rather than full client details wherever they can.

We do not seek sensitive information (such as health information or criminal record information). Because customers control what they record, decision records may sometimes contain it, for example in a hardship or legal matter. We handle any such information only to provide the service and with the same protections as other platform data.

3. How we collect it

We collect personal information directly from you (through our website forms, by email, phone, LinkedIn or in person), when you use the platform, from our customers when they add you as a user or create decision records, and automatically through cookies and similar technology on our website.

If you would rather not give us your details, you can contact us without them, but we may not be able to respond or give you access to the platform.

4. Why we collect and use it

• To respond to enquiries, arrange demonstrations
• To provide, secure, support and improve the TrustShyft platform
• To manage our customer relationships, billing and contracts
• To send updates you have asked for, such as the Behavioural Governance for AI newsletter (you can unsubscribe at any time)
• To keep our website secure and working
• To meet our legal obligations

We do not sell personal information. We do not use customers’ decision records to train AI models. Our AI provider is OpenAI. OpenAI does not use API inputs or outputs to train its models by default, and we have not opted in to data sharing. OpenAI may retain them for up to 30 days, for example to monitor for abuse.

5. Who we share it with

We share personal information only with service providers who help us run the website and platform, under contracts that require them to protect it:

We may also disclose personal information to our professional advisers, or where the law requires it. We do not give customers’ decision records to any other customer.

6. Overseas disclosure

Some of the providers above store or process information outside Australia, in Singapore and the United States. We take reasonable steps to ensure they handle it consistently with the APPs. Platform data, including decision records, is currently stored in Singapore. We plan to move platform hosting to Australia. Some processing, such as sign-in and AI analysis, may still happen overseas after that move.

7. Automated processing and AI

TrustShyft is a record of human decisions. Its purpose is to show that a named person, not a computer program, made the decision.

• What the platform does with personal information: it stores who reviewed an AI-assisted output, what they decided, when and why, in an append-only record. It also uses computer programs to organise, search and report on those records.
• AI use: the platform uses OpenAI to help users review, summarise and report on their decision records. It does not use AI to make decisions about any person. Its outputs are suggestions that a named user must review before they are used.

We do not use automated programs to make decisions about website visitors or enquirers. Our AI Transparency Statement gives more detail, including information our customers can use for their own privacy disclosures.

8. How we keep it secure

We use encrypted connections, access controls based on each user’s role, and providers with recognised security practices. Access to customer data is limited to people who need it to provide the service. Our Security Statement describes this in more detail. No system is completely secure; if we have a data breach likely to cause serious harm, we will notify affected people and the OAIC as the law requires.

9. Retention and the append-only record

Decision records are append-only: once saved, entries cannot be edited or deleted through the platform, so the record shows what happened and when. This is what makes the record useful as evidence for our customers.

We keep enquiries for two years. Retention, export and deletion arrangements for account data and decision records will be set out in the customer agreement before any customer data is processed. Customers remain responsible for keeping their own copy for as long as their record-keeping obligations require.

10. Access and correction

You can ask for the personal information we hold about you and ask us to correct it. Email us at the address below. We will respond within 30 days.

If information in a decision record needs correcting, we (or the customer) add a correction linked to the original entry rather than overwriting it, so both the original and the correction remain visible. If your information is in a customer’s decision records, we may refer your request to that customer and help them respond.

11. Complaints

If you think we have mishandled your personal information, email us with the details. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Changes

We will update this policy when our practices change and show the new effective date at the top.

13. Contact

Privacy Officer, TrustShyft (Sandra Farquhar, ABN 56 708 268 607) privacy@trustshyft.com.au Brisbane, Queensland, Australia