Privacy Policy

Effective: [DATE TBD] · Last updated: [DATE TBD] · Version: 1.0

01Scope & who this applies to

This policy applies to anyone who:

• Visits the Tagline marketing website (tagline.cloud)
• Creates an account on the Tagline platform
• Is invited to a property by an account holder (managers, agents, viewers)
• Contacts us by email or via an in-product support form

"Personal information" has the meaning given by the Australian Privacy Act and PDPA — information or an opinion about an identified or reasonably identifiable individual. In the Tagline context this primarily means account-holder identifiers (name, email) and staff contact details — animal records, paddock data, and NLIS tag information are generally not personal information, but they are still treated as confidential business information of the account holder.

02What we collect

Account information

• Name and email address (required to create an account)
• Password (stored hashed via Supabase Auth; we never see your plain-text password)
• Optional display name
• Role within a property (owner, manager, reconciliation agent, viewer)

Property and farm information

• Property Identification Code (PIC), property name, area, and notes
• Paddock boundaries (mapped polygons) and management events
• Contacts — agents, abattoirs, transporters, vets, suppliers (business contact details that you choose to enter)

Animal and compliance data

This is the core of the platform. It is not personal information about an individual, but it is business-confidential to the property owner:

• NLIS IDs, RFIDs, visual tag numbers
• Animal records (sex, breed, birth year, lifecycle status)
• Treatment history, batch numbers, withholding clear dates
• NVD numbers and kill sheet records
• Embryo transfer programs, breeding records, EBVs

Usage and technical data

• IP address and approximate location (derived from IP)
• Browser type, operating system, device class
• Request logs (URL path, response code, duration) — retained 90 days then auto-purged
• The build version (commit SHA) of the application served to you

Voluntary submissions

• Bug reports — when you click the in-app "Report a problem" button, a GitHub Issue is created in our private bug-tracking repository containing your description, the page URL, the build SHA, and your email. You choose what to include in the description.
• Photos and PDFs you upload (chemical labels, supplier invoices, kill sheets) — used to extract structured data via our AI extraction layer, then stored against your property.

What we do NOT collect

• Biometric data
• Government identifiers (TFN, Medicare, etc.)
• Financial information beyond invoice details you choose to upload
• Sensitive information as defined under APP 3 (health, race, sexual orientation, religion, etc.)

03How we collect it

• Directly from you when you sign up, log in, or enter data into the platform
• From your authorised colleagues when they invite you to a property
• Automatically via server logs, browser headers, and authentication tokens
• From the NLIS database when you upload a Device Query Report or when (in future releases) you authorise a direct NLIS API call
• From Integrity Systems / MyMLA when you authorise a direct eNVD API call (in future releases — current eNVD support is via manual upload of NVD scans)

04Why we collect it

We collect personal information for the following purposes:

1. To provide the service — operate the Tagline platform, store your records, and present them back to you and your authorised colleagues
2. To meet your compliance obligations — generate the NLIS, eNVD, LPA, and BREEDPLAN reports you need to satisfy regulatory and program requirements
3. To secure your account — authenticate you, log access for audit, detect abuse
4. To respond to you — answer support requests and bug reports
5. To improve the product — analyse usage in aggregate to fix bugs and prioritise features
6. To meet our legal obligations — respond to lawful requests from regulators

We do not sell personal information. We do not use your data to train AI models on your behalf or anyone else's. When we use AI extraction (e.g. label-to-batch), your files are processed by our API provider (currently Anthropic) under their commercial terms that prohibit training on customer data.

05Data residency & hosting

Tagline's production data is currently hosted in Singapore:

• Database — Supabase Pte. Ltd. (Singapore project on AWS Asia Pacific (Singapore) ap-southeast-1)
• Application server — Render Services, Inc. (Singapore region)
• File storage — same Supabase project, same region

We have engineered the platform to deploy equivalently to AWS Asia Pacific (Sydney) ap-southeast-2 for Australian data residency. We will migrate any property or organisation to a Sydney-hosted instance on request, at no additional cost, as part of the move to a properly multi-region deployment in 2026.

06Cross-border disclosure (APP 8 / PDPA)

Disclosure required under APP 8 of the Privacy Act 1988 (Cth):

Because we currently host your data in Singapore, your personal information will be disclosed to overseas recipients in the following countries:

• Singapore — Supabase and Render data centres (primary processing)
• United States — Supabase Inc., Render Services, Inc., Mapbox Inc., Anthropic PBC, Resend Inc., and GitHub Inc. (these are the corporate entities holding the service contracts; data processing for Australian customers is performed in Singapore where the provider supports a regional deployment)

Singapore is recognised by the Office of the Australian Information Commissioner as having a binding privacy framework (the PDPA) that provides comparable protection to the Australian Privacy Principles. Where overseas providers are located in the United States, we rely on their written commitments (data processing addenda, SOC 2 attestations, and equivalent terms) to provide APP-equivalent protection.

By using Tagline you consent to the transfer of your personal information to Singapore and to the United States for the purposes set out in Section 4. If you do not consent, do not create an account. You may withdraw consent at any time by deleting your account (see Section 10).

07Third-party services

We use the following external services to run Tagline. We do not give any of them more data than they need to perform their function, and none of them are authorised to use your data for any purpose other than serving Tagline.

Each provider has its own privacy policy. We have selected providers who publish data-processing terms, are certified under recognised security frameworks (SOC 2, ISO 27001), and provide contractual commitments to data protection that meet or exceed our obligations under the APPs and PDPA.

08Retention

We keep your data only for as long as we have a lawful reason to. Specific retention periods we have committed to (these are contractual where they appear in our agreement with Integrity Systems Company; any change requires renegotiation):

Our log retention specifically excludes credentials, authentication tokens, and payment information — these are filtered out of logs at the application layer before write.

09Security

We protect your data with controls that are commercially reasonable for a B2B SaaS at our scale:

Transport & storage

• TLS 1.2+ in transit on every hop, with HSTS on the marketing site
• AES-256 at rest in Supabase (managed encryption)
• Database backups are encrypted by the provider on a rotating schedule

Access control

• Per-property authorisation — every API request is checked against an explicit access grant. One producer's data is never visible to another, even if their tag IDs collide
• Row-Level Security (RLS) with default-deny policies at the database layer, so a misconfigured query cannot leak data across tenants
• JWT verification via JWKS with asymmetric ECC P-256 keys (Supabase Auth) — no shared HMAC secrets that could be exfiltrated
• OAuth tokens for third-party APIs (e.g. MyMLA) are encrypted at rest and never logged
• Credentials are server-side only and never exposed to the browser

Engineering controls

• All changes go through pull-request review on a branch separate from the main branch
• The application enforces schema integrity at boot via assertion checks; a database in an inconsistent state fails to start rather than serve stale data
• Smoke tests run at startup against every read query to catch schema drift
• Render deployments are versioned and can be rolled back to the previous build with one click

No system can be made entirely secure. If you become aware of a security vulnerability please contact [SECURITY EMAIL] and we will respond within 72 hours.

10Your rights

Under the Privacy Act 1988 (Cth) and Singapore PDPA, you have the right to:

1. Access the personal information we hold about you. We will respond within 30 days of a written request. We do not charge a fee.
2. Correct information that is inaccurate, out of date, incomplete, or misleading. You can update most fields directly in your account; for those you cannot, email us.
3. Delete your account. We will remove your account, your personal information, and any NLIS-derived records associated with you within 30 days of receipt of the request, subject to records we are required to retain by law.
4. Withdraw consent for processing, by closing your account.
5. Port your data — we will provide a machine-readable export of records owned by you (CSV / JSON) on request.
6. Make a complaint — see Section 14.

Requests to exercise these rights should be sent to [PRIVACY EMAIL]. We may need to verify your identity (for example by confirming control of the email address on your account) before acting on a request.

11Cookies & tracking

Tagline uses a small number of essential cookies — for example, the authenticated session cookie set by Supabase Auth that keeps you logged in. We do not use these to track you across other websites.

We do not currently use any third-party analytics, advertising, or marketing tracking cookies. If we add product analytics in the future (for example a privacy-respecting analytics tool like Plausible or Fathom), this policy will be updated and a banner will be shown to existing users.

Our marketing website (tagline.cloud) may load fonts from Google Fonts. No identifying cookies are set by this; only the font files are loaded.

12Children's data

Tagline is a business-to-business service for cattle producers. It is not directed at children and we do not knowingly collect personal information from anyone under the age of 18. If you become aware that a child has provided us with personal information, please contact us and we will delete it.

13Changes to this policy

We may update this policy from time to time to reflect changes in our practice or in the law. The version number and effective date at the top of this page will be updated whenever changes are made. If a change is material (for example, we add a new third-party service that receives your data, or we change a retention period), we will notify account holders by email at least 14 days before the change takes effect.

Continued use of Tagline after a policy update constitutes acceptance of the updated terms. If you do not accept the updated terms, you may delete your account before the effective date.

14Complaints & regulators

If you believe we have breached the Australian Privacy Principles or the Singapore PDPA, please contact us first at [PRIVACY EMAIL]. We will acknowledge your complaint within 7 days and respond substantively within 30 days.

If you are not satisfied with our response, you may escalate to:

Australia — Office of the Australian Information Commissioner (OAIC)

• Online: www.oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

Singapore — Personal Data Protection Commission (PDPC)

• Online: www.pdpc.gov.sg/Complaints-and-Reviews
• Phone: +65 6377 3131

15Contact