Privacy Policy — Marine Forge

Marine Forge (the “Platform”, “we”, “us”) is a software platform for marine service businesses to manage jobs, quotes, invoicing, inventory, purchasing and customer reporting. It is operated by Elite Marine Management Pty Ltd. This policy explains how we handle personal information and complies with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

The businesses who subscribe to the Platform and their staff who hold Platform logins, and the end clients and contacts whose details our business customers enter (vessel owners, contacts, billing details). Our business customers are responsible for the personal information they enter about their own clients; we process it on their behalf.

To provide and operate the Platform for our business customers; to send and receive the emails and push the invoices/bills a customer explicitly requests through their connected accounts; to secure the Platform, investigate issues and keep audit records; and to provide support. We do not sell personal information and do not use it for advertising.

Connections use OAuth 2.0; we never see or store the provider password. Access is limited to the specific organisation, company file or mailbox the customer authorises. Authorisation tokens (including refresh tokens) are encrypted at rest. A customer can disconnect at any time from Settings, which revokes our access. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Platform data is hosted on Australian infrastructure (Sydney), with encrypted backups in Australia. To draft report text, limited content may be processed by our AI provider (Anthropic) on servers in the United States; no accounting credentials or mailbox tokens are sent to the AI provider.

Encryption in transit (TLS 1.2 or higher) and at rest; authorisation tokens encrypted with AES-256; per-customer data isolation enforced at the database level; multi-factor authentication for administrator accounts; access controls, audit logging and least-privilege service access.

We disclose personal information only to the provider a customer has connected (to carry out the integration they requested), to service providers who host or support the Platform under confidentiality obligations, or where required by law. We do not disclose personal information to any other third party.

Business and operational data is retained while the customer’s account is active and for a reasonable period afterwards, unless deletion is requested. Security and audit logs are kept for at least twelve months. On account closure, data is deleted or de-identified within a reasonable period, except where we are required to retain it by law.

Under the Australian Privacy Principles you may request access to, or correction of, personal information we hold. End clients of our business customers should contact that business first. To make a request or complaint, contact info@elevateai.au. If you are not satisfied with our response you may contact the Office of the Australian Information Commissioner (oaic.gov.au).

We maintain a process to detect, assess and respond to data breaches, and will notify affected parties and the OAIC where required under the Notifiable Data Breaches scheme.

We may update this policy from time to time. Material changes will be notified through the Platform or by email. The effective date above shows when this version took effect.