Privacy Policy

What we collect

• Account details: your name, email address and a securely hashed password. If you choose “Continue with Google”, Google gives us your name, email address, profile photo link and a Google account identifier; if you already have a Chainsight account with the same verified email address, the two are linked. We never see your Google password.
• Organisation details: your company or supplier organisation’s name, optional ABN, the people in it and their roles.
• Due diligence content you or your organisation add: questionnaires, answers, uploaded PDF documents, cited excerpts, review notes, concerns, actions and outcomes.
• Billing details for reporting companies (when billing is switched on): handled by our payment provider. We keep a customer reference and subscription status, not card numbers.
• Technical information: sign-in session cookies, and server logs such as IP address, browser type and times of requests, used to keep the service secure and working.

Please don’t put workers’ names, identity or immigration documents, or case details about individuals into Chainsight. The service isn’t designed to hold them.

How we use it

• To provide the service: create and secure your account, run your organisation’s workspace, and show each organisation only what it is allowed to see.
• To send account emails, such as email verification and important notices about the service.
• To bill reporting companies, prevent misuse, fix problems, and meet our legal obligations.

We don’t sell personal information, we don’t use it for advertising, and Chainsight doesn’t use AI to analyse your content.

Who can see your information

A reporting company sees what its suppliers submit to it, and only the documents a supplier chooses to share. Suppliers can stop sharing a document at any time; excerpts already included in a submitted response stay with that response. A company’s internal notes, concerns and risk assessments are never shown to suppliers.

People in organisations you work with on Chainsight can see your name on the records you work on, such as a response you approve. A reporting company can also see a supplier’s profile while the supplier shares it.

We use these service providers to run Chainsight, and they process information on our behalf:

• Supabase: database, sign-in and file storage, hosted in Sydney, Australia.
• Vercel: website and app hosting. The app runs in Vercel’s Sydney region; requests may pass through Vercel’s global network on the way.
• Google: only if you choose to sign in with Google.
• An email delivery service, to send account emails.
• Stripe: payments for reporting companies, when billing is switched on.

Some of these providers are based in, or may process information in, the United States and other countries. We choose providers with strong security practices and only share what they need to provide their service.

Security and retention

Information is encrypted in transit, access is restricted by organisation and role, and submitted responses and document versions are kept unchanged so the record stays reliable. We keep your information while your account or organisation is active, and for as long as needed for the record and our legal obligations. Contact us to close an account or ask for information to be deleted, and we will tell you what we can remove.

Access, correction and complaints

To update your name, or to ask for access to or correction of the personal information we hold about you, email hello@citruscan.com. If you have a privacy complaint, email us and we will respond within 30 days. If you’re not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Changes to this policy

We will update this page when our practices change, and tell account holders by email about significant changes.