Privacy Policy

Last updated: [VERIFY: insert publication date]

1. Introduction & Who We Are

What this means in plain English: We’re an Aussie company that runs a software platform for landscaping businesses. This policy explains what info we collect from you, what we do with it, and the rights you have over it.

Smart Solutions AI Pty Ltd (ACN 690599332), trading as Trade Solutions AI (“TSAI”, “we”, “us”, “our”), is an Australian proprietary limited company that operates a cloud-based customer relationship management (CRM) and business management platform built specifically for Australian landscaping contractors (the “Platform”).

We are bound by the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (the “APPs”) set out in that Act. This policy describes how we handle personal information in line with those obligations.

This policy applies to: - Visitors to our website (tradesolutionsai.com.au) - Subscribers to any TSAI plan (Starter, Growth, Elite) - Members of our coaching community (free tier and paid VIP tier) - Anyone who contacts us through email, phone, or our support channels

2. Information We Collect

What this means in plain English: We collect the basics needed to run your account, take payment, deliver the service, and improve it. We also store the CRM data you put into the Platform (your customers, leads, jobs, quotes and invoices) on your behalf.

We collect the following categories of information:

2.1 Personal information

  • Full name

  • Email address

  • Phone number

  • Postal or business address

  • Job title or role within your business

2.2 Business information

  • Business / trading name

  • Australian Business Number (ABN)

  • Business address

  • Business website and social handles (if supplied)

  • Subscription tier (Starter, Growth, or Elite) and coaching tier (free or VIP)

2.3 Payment information

  • Billing name and address

  • Payment card or bank details — these are collected and processed by Stripe, our payment processor. TSAI does not store full card numbers on its own systems. We retain only the limited transaction metadata that Stripe returns (e.g. last four digits, card brand, transaction ID, billing status).

2.3 Payment information

When you use the Platform, you upload or generate information about your own customers, leads and jobs, including: - Contact details for your leads and customers - Quote, invoice, job and project data - SMS and email message content sent through the Platform - Calendar bookings and pipeline data - Any files, photos or documents you attach to jobs

This data is yours. You are the data controller (or, under the APPs, the “APP entity”) for the personal information of your own customers that you load into the Platform. We act as your service provider in handling it.

2.5 Usage and technical information

  • Log data: IP address, browser type, device type, operating system

  • Pages visited, features used, time spent in the Platform

  • Referring URLs and click paths

  • Cookies and similar tracking technologies (see Section 10)

  • Crash reports and diagnostic data

2.6 AI and conversation data

The Platform includes AI-assisted features (for example, AI-drafted replies, AI-generated quote text, or chatbot interactions). When you use these features we may collect and retain: - The prompts and inputs you provide to the AI - The outputs generated by the AI - Metadata about the interaction (timestamp, feature used, model version)

We use this information to deliver the feature to you, to debug and improve performance, and — in de-identified or aggregated form — to improve our AI models and prompt design. See Section 3.5.

2.7 Coaching community content

If you join the coaching community (free or VIP), we collect: - Posts, comments and reactions you submit - Direct messages sent through the community - Attendance at live sessions or webinars

2.8 Information collected from third parties

We may receive limited information about you from: - Stripe (payment status, chargebacks) - Google Analytics and Meta Pixel (aggregated website analytics) - Referral partners (if you signed up via a referral link)

3. How We Use Your Information

What this means in plain English: We use your info to give you the service you paid for, take payment, give you support, send you the right messages, and make the product better.

3.1 Service delivery

  • Setting up and administering your account

  • Providing the features of your subscription tier

  • Hosting the CRM data you upload

  • Sending transactional emails and SMS (account confirmations, password resets, billing notifications)

  • Providing access to the coaching community

3.2 Billing and payments

  • Processing subscription payments through Stripe

  • Issuing tax invoices and receipts

  • Managing failed payments, refunds and chargebacks

  • Meeting our record-keeping obligations under Australian tax law

3.3 Customer support

  • Responding to enquiries and support tickets

  • Diagnosing and resolving technical issues

  • Onboarding and training

3.4 Marketing (with your consent)

  • Sending product updates, tips and offers — only where you have opted in or where permitted under the Spam Act 2003 (Cth)

  • Promoting the coaching community and related events

  • You can unsubscribe at any time using the link in any marketing email, or by emailing [email protected]

3.5 AI training and improvement

  • Improving the accuracy and usefulness of AI features

  • Debugging AI outputs

  • Training and fine-tuning models on de-identified or aggregated data only — we do not use identifiable customer CRM data (i.e., the personal

  • information of your customers) to train AI models without your express consent

  • [VERIFY: confirm with founder whether TSAI fine-tunes any models on customer data, or only uses third-party models via API. The wording above assumes the latter.]

3.6 Product improvement and analytics

  • Understanding which features are used (and which aren’t)

  • Identifying bugs and performance issues

  • Planning the product roadmap

3.7 Legal and compliance

  • Complying with Australian laws and regulations

  • Responding to lawful requests from regulators, courts or law enforcement

  • Enforcing our Terms of Service

  • Protecting our rights, property or safety, or that of our users or the public

4. Legal Basis for Processing

What this means in plain English: Australian privacy law lets us collect and use personal info when we need it to deliver our service, when you’ve agreed, or when the law requires it.

Under the Privacy Act and the APPs, we collect, use and disclose personal information on the following bases:

Basis

When we rely on it

Performance of a contract

To deliver the Platform and services you’ve subscribed to

Consent

For marketing communications, optional features, and any use of sensitive information

Legal obligation

To comply with tax, anti-money-laundering, or other Australian laws

Legitimate business interests

For product improvement, fraud prevention, security, and analytics — provided these don’t override your rights

Where we rely on consent, you can withdraw it at any time by contacting us. Withdrawing consent doesn’t affect the lawfulness of anything we did before you withdrew it.

5. How We Share Your Information

What this means in plain English: We don’t sell your data. We do share it with the trusted suppliers we need to run the Platform — and only what they need to do their job.

We share personal information with the following categories of recipients:

5.1 Sub-processors (service providers)

Sub-processor

Purpose

Location

What they receive

GoHighLevel (HighLevel Inc.)

Underlying SaaS platform infrastructure — the Platform is white-labelled on top of GoHighLevel

United States

All Platform data including account details, CRM data, messages, AI logs

Stripe

Payment processing

United States / Australia

Billing name, address, payment method details, transaction history

Email & SMS providers (via GoHighLevel)

Sending transactional and marketing emails and SMS

Primarily United States

Billing name, address, payment method details, transaction history

Google Analytics

Website analytics

United States

Anonymised website usage data, IP address

Meta Pixel

Website analytics and advertising attribution

United States

Anonymised website event data, IP address

[VERIFY: any additional sub-processors — e.g. customer support tool, error monitoring, cloud storage, AI model providers like OpenAI / Anthropic]

We require all sub-processors to handle personal information consistently with the Privacy Act and the APPs.

5.2 Anonymised or aggregated data

We may share anonymised or aggregated statistics (e.g. “the average TSAI user sends 42 quotes per month”) with partners, in marketing materials, or in industry reports. This data cannot reasonably be used to identify any individual user.

5.3 Legal and regulatory disclosures

We may disclose personal information if required by law, court order, or to a regulator (such as the Office of the Australian Information Commissioner), or where we reasonably believe disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business transfers

If TSAI is acquired, merged, or sells some or all of its assets, your information may be transferred as part of that transaction. We will notify you of any such change and your choices at that time.

5.5 We do not sell your personal information

We do not sell, rent or trade your personal information.

6. International Data Transfers

What this means in plain English: Some of the services we rely on — including the platform itself — are hosted overseas, mostly in the United States. We take steps to make sure your data is handled to Australian privacy standards even when it leaves the country.

The Platform is built on GoHighLevel, which is hosted in the United States. As a result, by using the Platform you acknowledge that your personal information (and the personal information of your customers that you upload) will be transferred to, stored and processed in the United States and potentially other countries where our sub-processors operate.

Under Australian Privacy Principle 8 (Cross-border disclosure of personal information), before disclosing personal information overseas we take reasonable steps to ensure the overseas recipient does not breach the APPs. The steps we take include:

  • Choosing sub-processors who publish their own privacy and security commitments and who hold recognised certifications (e.g. SOC 2)

  • Including contractual data protection obligations in our agreements with sub-processors

  • Limiting the personal information shared to what each sub-processor actually needs

  • [VERIFY: any additional safeguards specific to TSAI — e.g. standard contractual clauses, encryption at rest, data residency options]

You should be aware that overseas recipients may be subject to foreign laws (such as US law enforcement access laws) that differ from Australian law.

If you have specific concerns about overseas storage, please contact us at [email protected] before subscribing.

7. Data Retention

Type of data

Retention period

Account and subscription data

For the life of your account, plus 7 years after cancellation (to meet Australian tax and record-keeping obligations)

CRM and customer data you uploaded

For the life of your account. On cancellation, you have [VERIFY: 30 / 60 / 90] days to export your data. After that, we delete or anonymise it within [VERIFY: 60 days]

Billing and payment records

7 years from the date of the transaction (Australian tax law)

Marketing data and email lists

Until you unsubscribe, plus a short suppression-list period to honour your opt-out

Support tickets and correspondence

[VERIFY: e.g. 3 years] from resolution

AI conversation logs

[VERIFY: e.g. 12 months] in identifiable form; longer in de-identified form

Website analytics

Per the retention settings of Google Analytics and Meta Pixel (typically 14–26 months)

Coaching community posts and messages

For the life of the community, unless you delete or request removal

We may retain information for longer where required by law, to resolve disputes, or to enforce our agreements.

8. Your Rights Under the Australian Privacy Act

What this means in plain English: You can ask to see what we have on you, fix it if it’s wrong, ask us to delete it, or complain if you think we’ve done the wrong thing.

You have the following rights:

8.1 Right to access

You can request a copy of the personal information we hold about you. We’ll respond within a reasonable timeframe (usually within 30 days) and free of charge in most cases.

8.2 Right to correction

If your personal information is inaccurate, out-of-date, incomplete, irrelevant or misleading, you can ask us to correct it. If we agree, we’ll correct it as soon as practicable. If we disagree, we’ll tell you why and you can ask us to attach a statement noting the correction you requested.

8.3 Right to deletion

You can ask us to delete your personal information. We’ll honour the request unless we’re required or permitted by law to keep it (for example, tax records).

8.4 Right to withdraw consent

Where we rely on your consent, you can withdraw it at any time. This won’t affect the lawfulness of anything we did before you withdrew consent.

8.5 Right to opt out of marketing

You can unsubscribe from marketing emails using the link in any email, or by contacting us. You’ll still receive transactional and account-related messages.

8.6 Right to complain

If you think we’ve breached the Privacy Act or the APPs, please contact us first at [email protected]. We’ll acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): - Website: https://www.oaic.gov.au - Phone: 1300 363 992 - Post: GPO Box 5288, Sydney NSW 2001

8.7 How to exercise your rights

Email [email protected] with details of your request. We may need to verify your identity before acting on it.

9. Security Measures

What this means in plain English: We take reasonable steps to protect your data. No system is bulletproof, but we use industry-standard measures.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. Our security measures include:

  • Encryption in transit (TLS / HTTPS) for all data exchanged with the Platform

  • Encryption at rest for stored data (provided by GoHighLevel and other sub-processors)

  • Access controls — staff access to personal information is restricted on a need-to-know basis

  • Multi-factor authentication available for user accounts [VERIFY: confirm MFA is offered / required]

  • Vendor due diligence — we choose sub-processors with recognised security certifications where possible

  • Incident response — we have processes in place to investigate, contain and respond to suspected data breaches

  • Notifiable Data Breach scheme — if a data breach is likely to result in serious harm, we will notify affected individuals and the OAIC in line with the Privacy Act 1988 (Cth) Part IIIC

You also play a role in keeping your data safe: choose a strong password, don’t share your login, and tell us straight away if you think your account has been compromised.

10. Cookies & Tracking

What this means in plain English: Our website uses cookies — small files stored in your browser — to make it work properly and to help us understand how people use it.

We use two types of cookies and similar tracking technologies:

10.1 Essential cookies

Needed for the website and Platform to function — for example, keeping you logged in or remembering items in a form. These cannot be switched off.

10.2 Analytics and marketing cookies

We use Google Analytics and the Meta Pixel to understand website usage and measure the performance of our marketing. These tools may set cookies that track your activity across our website and, in some cases, other websites.

You can: - Disable cookies in your browser settings (some Platform features may stop working) - Opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout - Manage Meta advertising preferences: https://www.facebook.com/adpreferences

[VERIFY: if a cookie consent banner is implemented on the website, describe how users can manage preferences through it]

11. Children’s Privacy

What this means in plain English: TSAI is a business tool. It’s not for kids.

The Platform is a business-to-business (B2B) service intended for use by adults operating a landscaping business. It is not directed at, designed for, or intended for use by anyone under the age of 18.

We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected information from a child, please contact us at [email protected] and we’ll delete it.

12. Changes to This Policy

What this means in plain English: If we change this policy, we’ll update it here. For significant changes, we’ll let you know directly.

We may update this Privacy Policy from time to time to reflect changes in our practices, the Platform, or the law. The “Last updated” date at the top shows when it was last changed.

For material changes, we’ll notify you by: - Email to the address registered against your account, and / or - A prominent notice in the Platform or on the website

Your continued use of the Platform after the updated policy takes effect means you accept the changes.

13. Contact Us

What this means in plain English: Got a question, request, or complaint? Email us.

For any privacy-related question, request or complaint, please contact our Privacy Officer:

Email: [email protected]

Post: [VERIFY: insert postal address for written enquiries]

We’ll respond as quickly as we can — usually within 7 days for acknowledgement, and 30 days for a full response.

© 2026TradeSolutions AI. All rights reserved.