Privacy Policy

This policy explains how Lutherborrow Systems ("we," "us," or "our") handles personal information through Varify (the "Service"). It covers two groups: people who sign up for and use Varify directly, and individuals whose information our customers store in Varify as part of running their own stock-take operations (for example, a customer's staff names against count records).

We handle personal information in line with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Account information: name, email address, company name, and password (stored as a hash, never in plain text) when you or your company signs up.

Billing information: handled directly by our payment processor, Stripe. We don't store full card numbers ourselves. See Stripe's privacy policy.

Customer Data: inventory records, site/location structure, stock-take counts, and any staff names or user accounts your company creates within Varify. This data belongs to you, not us. See Terms of Service §6. We process it only to provide the Service.

Usage information: standard technical data (IP address, browser type, pages visited, timestamps) collected automatically to operate, secure, and troubleshoot the Service.

We use personal information to:

• provide, maintain, and secure the Service;
• process payments and manage subscriptions through Stripe;
• respond to support requests and send service-related communications (billing notices, security alerts, material changes to these terms);
• detect, investigate, and prevent fraud, abuse, or security incidents;
• meet legal obligations we're subject to.

We don't sell personal information, and we don't use Customer Data to train any external or third-party AI models.

We share personal information only with the service providers that run Varify's infrastructure, and only as needed to provide the Service:

• Stripe: payment processing and subscription billing;
• Railway: application hosting and database infrastructure;
• Resend: sending transactional email such as sign-in codes, password resets, and invitations;
• Cloudflare: content delivery, DNS, and DDoS protection for the frontend.

Each provider is contractually restricted to using data only to deliver its service to us. We don't share personal information with any other third party except where required by law, to enforce our Terms, or to protect the rights, safety, or property of Lutherborrow Systems, our customers, or others.

If your company needs a formal data processing agreement for its own records, see our Data Processing Addendum.

Varify's infrastructure runs on Railway, Cloudflare, and Resend, which may process or store data outside Australia. By using the Service you consent to this handling, consistent with APP 8 (cross-border disclosure).

We retain account and Customer Data for as long as your subscription is active. After cancellation or termination, we retain data for a reasonable period to allow export, then delete or de-identify it, except where we're required to keep it longer for legal, tax, or dispute-resolution purposes.

We apply reasonable technical and organizational measures to protect personal information, including access controls scoped by company and role, encrypted credential storage, and regular security review of the Service's authentication and data-access paths. No method of transmission or storage is completely secure, and we can't guarantee absolute security.

If a data breach occurs that's likely to result in serious harm to affected individuals, we'll notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme under the Privacy Act.

Under the Australian Privacy Principles, you can ask us to access, correct, or delete personal information we hold about you, or ask how it's been used or disclosed. If your company's data is held in Varify by an employer using the Service, your employer controls that data. Direct those requests to them first, or contact us and we'll help route it.

To make a request or raise a privacy complaint, use the contact details in section 11. We'll respond within a reasonable time. If you're not satisfied with our response, you can lodge a complaint with the OAIC at oaic.gov.au.

Varify uses essential cookies only, to keep you signed in and remember basic session state. We don't use advertising or third-party tracking cookies.

Questions about this policy, or requests relating to your personal information, can be sent to jayden@lutherborrowsystems.com.au.

We may update this policy from time to time. If a change is material, we'll provide reasonable notice (such as an email or an in-app notice) before it takes effect. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.