Privacy Policy

1. Who we are

TrancheMate ("TrancheMate", "we", "us", "our") operates the TrancheMate compliance platform at tranchemate.com.au. We provide AUSTRAC Tranche 2 AML/CTF compliance tools to Australian accounting firms, law firms, and real estate agencies.

Our platform enables subscriber firms ("Firms") to build AML/CTF compliance programs, manage client due diligence (CDD) records, and maintain audit-ready compliance documentation as required under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).

TrancheMate operates in two capacities:

• As a data controller: for personal information we collect directly from Firm principals and staff who register and use the platform (account data, subscription information).
• As a data processor on behalf of Firms: for personal information that Firms collect from their own clients through our CDD intake tools (client identity documents, KYC data). Firms are responsible for their own obligations to those individuals under the Privacy Act and the AML/CTF Act.

2. What personal information we collect

2.1 Firm and account data

When a Firm registers and uses TrancheMate, we collect:

• Firm name, Australian Business Number (ABN), Australian Company Number (ACN)
• Profession type (accounting, legal, real estate)
• Compliance officer name and appointment date
• Principal and staff user names, email addresses, and passwords (stored as bcrypt hashes — we never store plaintext passwords)
• Subscription and billing details (processed by Stripe — see section 5)
• IP addresses and browser/device information collected in server logs

2.2 AML/CTF program content

Answers provided in the AML/CTF Program Builder wizard, including firm structure, designated services, client risk profile, and governance arrangements. This information is used to generate compliance documentation.

2.3 Client due diligence (CDD) records

Firms use TrancheMate to collect identity and KYC information from their own clients. This data, stored on behalf of the Firm, may include:

• Client full legal name, date of birth, residential address
• Photo identity documents (passport, driver's licence)
• Entity structure information (directors, beneficial owners, trustees)
• Source of funds declarations
• Politically Exposed Person (PEP) and sanctions declarations

TrancheMate stores this data as a processor on behalf of the Firm. Firms bear responsibility for their own compliance obligations to their clients under the Privacy Act and the AML/CTF Act.

2.4 Suspicious matter and transaction records

SMR and TTR records logged by Firm staff, including event descriptions, transaction amounts, and AUSTRAC reference numbers. These records are immutable once created (required for audit integrity under the AML/CTF Act).

2.5 Compliance calendar data

Dates, event types, and reminder preferences for compliance obligations. No sensitive personal information is contained in these records.

3. How we collect personal information

We collect personal information:

• Directly from you when you register, complete a wizard, log records, or contact us
• From Firm staff when they initiate CDD intake processes for their clients
• From Firm clients who complete a CDD intake form via a token-secured public link (no TrancheMate account required)
• Automatically via server logs, which record IP addresses and request metadata for security and operational purposes
• From Stripe — confirmation of payment events (we receive confirmation of successful payment; full card data is handled exclusively by Stripe and never passes through our servers)

We collect personal information only by lawful and fair means, and not in an unreasonably intrusive way.

4. Why we collect and use personal information

We collect and use personal information for the following purposes:

• Providing and operating the TrancheMate platform and its five compliance modules
• Processing subscription payments via Stripe
• Sending transactional email — account confirmations, compliance reminders, CDD intake links, and receipts
• Generating AML/CTF compliance documentation on behalf of Firms
• Storing CDD, SMR, and compliance records as required by the AML/CTF Act
• Responding to support requests and complaints
• Improving the platform (aggregated, anonymised analytics only)
• Complying with our legal obligations, including any obligations under the AML/CTF Act and Privacy Act

We will not use or disclose personal information for a secondary purpose unless: (a) the individual would reasonably expect us to; (b) we have consent; or (c) we are required or authorised by law.

5. Disclosure to third parties

We do not sell, rent, or trade personal information. We may disclose personal information to:

5.1 Infrastructure and service providers

• Akamai Technologies (Sydney, ap-southeast-2): Our hosting provider. All application data and uploaded files are stored on Akamai infrastructure located in Sydney, Australia.
• Stripe Inc.: Payment processing. Stripe receives billing information necessary to process subscription payments. Stripe is PCI DSS Level 1 certified. See Stripe's Privacy Policy.
• Email delivery provider: A third-party SMTP service is used to deliver transactional email. Email content may include your name and compliance reminder details.

5.2 Legal and regulatory disclosure

We may disclose personal information where required or authorised by Australian law, including:

• In response to a valid court order, subpoena, or regulatory request
• To AUSTRAC or other government agencies where we are required to do so under the AML/CTF Act or other applicable law
• To prevent, detect, or investigate suspected fraud, illegal activity, or a threat to safety

5.3 Business transfers

If TrancheMate is acquired, merged, or its assets transferred, personal information may form part of the transferred assets. We will notify affected users of any such transfer and the new entity's privacy policy before any change in data handling occurs.

5.4 No overseas disclosure

We do not disclose personal information to overseas recipients as a matter of ordinary practice. All infrastructure and data storage is located in Australia (see section 6). In the unlikely event an overseas disclosure becomes necessary (for example, in response to an international regulatory request), we will comply with APP 8 and take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles.

6. Australian data residency

Australian data residency is a material requirement for professional services firms subject to the Privacy Act and the AML/CTF Act. We treat it as a non-negotiable architectural constraint.

Akamai's Sydney infrastructure holds ISO 27001:2022 and SOC 2 Type II certifications at the infrastructure layer. TrancheMate's application layer operates to an ISO 27001-aligned security posture.

7. Security of your information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• TLS encryption for all data in transit (HTTPS enforced)
• Passwords stored as bcrypt hashes — plaintext passwords are never stored
• Role-based access control: principal, staff, and read-only roles restrict access to sensitive records
• Immutable audit records for CDD and SMR data (records cannot be altered once created)
• ISO 27001:2022 certified hosting infrastructure (Akamai Sydney)
• Stripe handles all payment card data — card numbers never pass through or are stored on TrancheMate servers

Despite these measures, no transmission over the internet is completely secure. If you suspect a security breach affecting your account, contact us immediately at [email protected].

8. Retention and deletion

We retain personal information for as long as necessary to provide the platform and comply with our legal obligations. Specific retention practices:

• Account and firm data: Retained while the subscription is active and for 7 years after account closure (required for tax and legal compliance).
• CDD records: The AML/CTF Act requires Firms to retain CDD records for 7 years from the date the record was made. TrancheMate stores these records on the Firm's behalf for that period.
• SMR and TTR records: Retained for 7 years in accordance with AML/CTF Act record-keeping obligations.
• Server logs: Retained for 90 days for security and operational purposes, then deleted.

When a subscription is cancelled, Firms may export all their compliance records in a full archive download before account closure. We provide a 30-day post-cancellation window to complete this export.

We will take reasonable steps to destroy or de-identify personal information that is no longer required for any purpose permitted under this policy.

9. Email communications and marketing

9.1 Transactional email

We send transactional email that is necessary to operate the platform and your account. This includes:

• Account registration confirmation and email verification
• Compliance calendar reminders (annual review, training due dates, regulatory alerts)
• CDD intake links sent to your firm's clients
• Subscription confirmations, receipts, and renewal notices

Transactional email is sent as part of the service you have contracted with us. You cannot opt out of essential transactional messages while your account remains active.

9.2 Marketing email and the Spam Act 2003

Any marketing or promotional email we send complies with the Spam Act 2003 (Cth). This means:

• We will only send marketing email to you if you have given us express or inferred consent
• Every marketing email includes our full company name and contact details
• Every marketing email includes a clear, functional unsubscribe mechanism
• We will process unsubscribe requests promptly — within 5 business days as required by the Spam Act

We do not send unsolicited commercial electronic messages. We do not purchase email lists or send cold email.

9.3 Unsubscribing

To unsubscribe from marketing communications, click the unsubscribe link in any marketing email, or contact us at [email protected] with "Unsubscribe" in the subject line.

10. Accessing and correcting your information

Under APP 12 and APP 13, you have the right to:

• Access the personal information we hold about you, subject to limited exceptions (for example, where providing access would unreasonably affect someone else's privacy)
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading

To request access to or correction of your personal information, contact us at [email protected]. We will respond within 30 days.

We may refuse access in certain circumstances as permitted by the Privacy Act. If we refuse, we will give you written reasons and advise of the available complaint mechanisms.

Note on CDD records and immutability: CDD, SMR, and TTR records stored on behalf of Firms are immutable once created — this is an audit-integrity requirement under the AML/CTF Act. Corrections to underlying personal information held in these records must be handled directly by the Firm that collected them, in accordance with the Firm's own privacy obligations to their clients.

11. Privacy complaints

If you have a complaint about how we have handled your personal information, please contact us first:

• Email: [email protected]
• Subject line: "Privacy Complaint"

We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days. If we cannot resolve the complaint to your satisfaction, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or regulatory guidance.

When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Display a notice on the TrancheMate platform dashboard for 30 days after the change takes effect
• Send an email notification to all active Firm principals if the changes materially affect how we handle their data

Your continued use of TrancheMate after the effective date of a revised policy constitutes acceptance of the updated policy.