Privacy Policy

What we collect

• Account information: your email address and full name, provided when you create an account.
• Authentication data: a hashed password stored by our authentication provider (Supabase). We never see or store your password in plain text.
• Billing information: if you subscribe to Premium, payment details are handled directly by Stripe under their PCI-compliant processing. We receive only the subscription status and a customer reference; we do not store card numbers.
• Usage data: records of which races you have analysed, your remaining trial credits, and timestamps of those actions, used to operate the product.
• Abuse-prevention data: a normalised hash of your email address, your IP address, and your browser User-Agent at signup time, used to prevent trial-abuse and account fraud. These records may be retained after account closure where necessary for trial-abuse and fraud prevention; a hashed identifier is not treated as anonymous information.

How we use it

• To create and operate your account and process your subscription.
• To send transactional emails (account verification, billing receipts, trial expiry notices). We do not send marketing email without your consent.
• To detect and prevent abuse of the free trial and the platform.
• To meet our legal and regulatory obligations.

Sub-processors

We use the following third-party services to operate TurfIntel. Each is bound by its own privacy and security commitments.

• Supabase (Sydney, Australia) — authentication and database storage.
• Vercel (United States) — application hosting and edge delivery.
• Stripe (United States / Australia) — payment processing.
• Resend (United States) — transactional email delivery.
• A third-party AI provider (located overseas) — AI analysis. Only non-personal race data (race fields, form, ratings) is sent; your account identity and other personal information are not disclosed to the AI provider.
• Google (Analytics 4 & Tag Manager) (United States) — aggregated, non-advertising usage analytics: pages viewed, signups, trial starts, subscriptions, and product interactions. Used to improve the service and measure marketing performance. We do not run advertising or remarketing tags. See Google's privacy policy.
• Cloudflare (United States) — bot protection on signup, sign-in and password-reset forms via Cloudflare Turnstile. Turnstile collects minimal browser characteristics (User-Agent, screen size, behaviour signals) to verify you are a human; it does not set tracking cookies and does not identify you personally.

Where your data is stored

Your account, billing and usage data is stored in Australia (our database is hosted in Sydney). Some of the sub-processors listed above are located overseas, principally in the United States, and a limited amount of personal information (for example, your email address for transactional email, or a customer reference for billing) may be handled by them. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles, and by creating an account you consent to those overseas disclosures.

How long we keep your data

We keep personal information only for as long as we need it for the purposes described in this policy, or as required by law. In general:

• Account information (email, name): for the life of your account. Ordinary account information is deleted or de-identified within 30 days after account closure, unless one of the retention exceptions below applies.
• Billing records: retained for the period required for tax, financial record-keeping, payment reconciliation, refunds or disputes. Account closure does not erase records we are required to keep.
• Usage data (races analysed, trial credits, timestamps): ordinary account-linked usage information is deleted or de-identified within 30 days after account closure. Records needed for financial reconciliation, fraud prevention, security investigations or legal obligations are handled under those exceptions.
• Abuse-prevention data: limited identifiers, including a normalised email hash, may be retained as necessary to prevent repeat trial abuse or investigate fraud. We restrict access and review whether continued retention is necessary.
• Security logs: retained only as necessary to investigate incidents, prevent abuse, resolve disputes or meet legal obligations.

To request account closure, contact support@turfintel.ai. We verify the request, stop future subscription billing as appropriate and process deletion or de-identification through our support procedure. Ordinary account information is handled within 30 days after closure; information covered by the financial, fraud-prevention, security or legal exceptions is retained only for its required or necessary purpose. The closure process includes reviewing relevant service-provider records, logs and backups. Cancelling subscription renewal alone does not close your account or begin this retention period.

Your rights

Under the Australian Privacy Act you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your account and associated personal information, subject to our legal record-keeping obligations.
• Lodge a complaint with us, or with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email us at support@turfintel.ai. We will respond within 30 days.

Cookies and similar technologies

We use cookies that are strictly necessary to operate the service: a session cookie set by our authentication provider so you stay signed in, and a small remember-me preference stored in your browser.

We also use Google Analytics 4 (loaded via Google Tag Manager) to measure aggregated usage of TurfIntel — pages viewed, signups, trial starts, subscriptions, and product interactions. Google Analytics sets a small number of cookies (typically _ga and _ga_*) used to distinguish anonymous visitors and sessions; data is retained for the default Google Analytics period. We do not use advertising or remarketing tags, and we do not sell or share this data with third parties for marketing.

If you prefer not to be measured by Google Analytics, you can install the official Google Analytics opt-out browser add-on, or block analytics cookies in your browser settings.

Security

Data in transit is protected by TLS. Authentication tokens are scoped per-user. Service-role database access is restricted to server-side processes only. We log security-relevant events (failed signups, abuse-prevention triggers) for review.

Changes to this policy

We may update this policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be notified by email to your registered address before they take effect.

Contact

Privacy queries: support@turfintel.ai.