TAMGROW PTY LIMITED (ACN 689 003 601) (“Tamgrow”, “we”, “us” or “our”) operates an online marketplace platform (“Platform”) that connects Customers and Providers. We are committed to protecting the privacy of all individuals who interact with our Platform.

This Privacy Policy is issued in accordance with the Privacy Act 1988 (Cth) (“Privacy Act”), the Australian Privacy Principles (“APPs”), and, where applicable, the EU/UK General Data Protection Regulation (“GDPR”). By using our Platform, you acknowledge that you have read and understood this Privacy Policy.

1. Information We Collect

1.1 Account and Identity Information

• Full name and preferred name
• Date of birth (for age verification where required)
• Email address and password
• Profile photograph (optional)
• Government-issued identification documents (where required for Provider verification or compliance purposes)
• Australian Business Number (ABN) or Australian Company Number (ACN) for business accounts

1.2 Contact and Location Information

• Postal and billing address
• Phone number(s)
• General location inferred from IP address or provided by you

1.3 Marketplace Transaction Information

• Listings and Requests created by Providers and Customers, including descriptions and pricing
• Purchase and order history
• Communications between Customers and Providers through our messaging system
• Reviews, ratings, and feedback submitted through the Platform
• Dispute and complaint records

1.4 Payment and Financial Information

• Payment card details (processed and stored by our PCI-DSS compliant payment processors; we do not store full card details)
• Bank account information for Provider payouts
• Transaction records and invoices
• Tax identification information where required by law

1.5 Technical and Usage Data

• IP address and approximate geolocation
• Browser type, version, and operating system
• Device identifiers and device type
• Pages visited, features used, and time spent on the Platform
• Error reports and crash logs

1.6 Communications Data

• Enquiries and support requests submitted to us
• Email and chat correspondence with our team
• Survey and feedback responses
• Records of consent and marketing preferences

1.7 Sensitive Information

We will only collect sensitive information where it is reasonably necessary for our functions and with your express consent, or where otherwise required or authorised by law.

2. How We Collect Your Information

2.1 Directly From You

We collect information directly from you when you register for an account, list services on the Platform, make a purchase or enquiry, contact our customer support team, subscribe to our newsletter, complete surveys, participate in promotions, or verify your identity for platform compliance purposes.

2.2 Automatically

When you use our Platform, we automatically collect certain technical and usage data through cookies and similar tracking technologies (see Section 9), server logs and analytics tools, and pixel tags and web beacons in our emails.

2.3 From Third Parties

We may also receive personal information from identity verification and fraud prevention service providers, payment processors and financial institutions, and publicly available sources such as ASIC, ABR, and social media profiles.

3. Why We Collect, Hold and Use Your Information

3.1 Providing the Marketplace Platform

• Creating and managing your account
• Facilitating transactions between Customers and Providers
• Processing payments and disbursing funds to Providers
• Enabling in-platform messaging and communications
• Managing Listings, Requests, and Agreements
• Providing customer support and resolving disputes

3.2 Identity Verification and Safety

• Verifying the identity and eligibility of Providers and Customers
• Detecting, investigating, and preventing fraudulent, harmful, or illegal activity
• Complying with anti-money laundering (AML) and counter-terrorism financing (CTF) obligations

3.3 Legal and Regulatory Compliance

• Meeting our obligations under the Privacy Act, consumer protection laws, and other applicable legislation
• Responding to lawful requests from regulatory authorities or law enforcement
• Maintaining required records and audit trails
• Managing legal claims and disputes

3.4 Platform Improvement and Analytics

• Analysing usage patterns to improve Platform features and user experience
• Generating aggregated and de-identified analytics reports

3.5 Marketing and Communications

• Sending you transactional communications (e.g. order confirmations, receipts)
• With your consent, sending you promotional offers, newsletters, and personalised recommendations

4. Our Disclosures of Personal Information

We do not sell your personal information. We may disclose personal information to the following categories of recipients:

4.1 Other Platform Users

Limited personal information is shared between Customers and Providers as necessary to facilitate transactions.

4.2 Service Providers

We engage third-party service providers including payment processors, identity verification providers, cloud infrastructure providers, email delivery platforms, analytics providers, fraud detection providers, and legal and accounting advisers.

4.3 Business Transfers

If Tamgrow undergoes a merger, acquisition, restructure, or asset sale, your personal information may be transferred to the relevant third party as part of that transaction.

4.4 Legal and Regulatory Disclosure

We may disclose your personal information to government agencies, regulators, law enforcement bodies, or courts where required or authorised by law.

4.5 Consent-Based Disclosure

We may disclose your personal information to other third parties with your prior consent.

5. Overseas Disclosure

Some of our service providers and technology infrastructure are located outside Australia. Your personal information may be transferred to, stored in, or processed in the United States of America, United Kingdom, European Union member states, and other countries where our service providers may be located. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles your information consistently with the APPs.

5.1 Anthropic (AI Processing)

Certain AI-assisted features on the Platform (including document extraction, the Tamgrow Assistant chatbot, and proposal analysis tools) are powered by Anthropic, PBC (“Anthropic”), a company incorporated in the United States of America. When you use these features, content you submit may be transmitted to and processed by Anthropic’s systems in the United States.

• Anthropic processes content submitted through Tamgrow’s API solely to provide the requested service and does not use API inputs or outputs to train its AI models.
• The transfer of your content to Anthropic is made in accordance with Australian Privacy Principle 8 (APP 8) under the Privacy Act 1988 (Cth).
• By using AI-assisted features on the Platform, you acknowledge and consent to this cross-border transfer for processing by Anthropic in the United States.
• You may opt out of AI-assisted features at any time through your Account Settings.

6. Your Privacy Rights and Choices

6.1 Access

You have the right to request access to the personal information we hold about you. We will provide access within a reasonable time, subject to any exceptions under the Privacy Act.

6.2 Correction

If you believe personal information we hold about you is inaccurate, outdated, incomplete, irrelevant, or misleading, you may request that we correct it. We will respond to correction requests within 30 days.

6.3 Opting Out of Marketing

You may opt out of receiving marketing communications from us at any time by clicking the “unsubscribe” link in any marketing email, adjusting your communication preferences in your account settings, or contacting us at hello@tamgrow.com.au.

6.4 Complaints

If you believe we have breached the APPs or mishandled your personal information, you may lodge a complaint with our Privacy Officer at hello@tamgrow.com.au. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or by calling 1300 363 992.

6.5 Additional Rights for EEA/UK Residents

If you are located in the EEA or United Kingdom, you have additional rights under the GDPR. Please refer to Section 12 for details.

7. Protecting Your Information

We implement appropriate technical and organisational security measures including encryption of data in transit (TLS/SSL) and at rest, access controls and role-based permissions, multi-factor authentication for administrative systems, regular security assessments and penetration testing, staff training on privacy and data security, and incident response procedures for suspected data breaches.

In the event of a data breach likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act.

8. How Long We Keep Your Information

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable legal, regulatory, accounting, or reporting requirements. When personal information is no longer required, we will take reasonable steps to destroy or permanently de-identify it in a secure manner, in accordance with APP 11.2.

9. Cookies and Analytics

9.1 Types of Cookies We Use

• Strictly necessary cookies: Essential for the Platform to function, including session management (via Supabase) and security. These cannot be disabled.
• Functional cookies: Remember your preferences and settings.
• Analytics cookies: Collect information about how you use our Platform to help us improve it.
• Payment cookies: Set by Stripe for secure payment processing and fraud prevention.

We also use browser local storage as part of our authentication system (provided by Supabase) to maintain your login session. This is functionally equivalent to an essential session cookie and cannot be disabled while you are logged in.

9.2 Managing Cookies

You can control cookies through your browser settings. Note that disabling strictly necessary cookies may affect how the Platform functions. See our Cookie Policy for full details.

10. AI Technologies

Tamgrow uses artificial intelligence (“AI”) and machine learning technologies as part of its Platform operations, including for content moderation, personalised recommendations, fraud detection, search and discovery, and customer support.

10.1 Tamgrow Assistant

The Tamgrow Assistant is an AI-powered chatbot embedded in the Platform. You are interacting with an automated AI system, not a human, when you use this feature. Conversations with the Tamgrow Assistant may be reviewed by Tamgrow staff for safety and quality assurance purposes, subject to this Privacy Policy.

10.2 Third-Party AI Services

Our primary AI service provider for the Tamgrow Assistant and document extraction features is Anthropic, PBC, incorporated in the United States. Content you submit through these features is processed by Anthropic. For details of the cross-border transfer and Anthropic’s data handling commitments, see Section 5.1 of this Privacy Policy.

10.3 Automated Decision-Making

Some of our AI systems may make automated decisions that affect your experience on the Platform. Where a significant automated decision is made about you, you may have the right to request human review.

10.4 Data Used to Train AI Models

We will not use your identifiable personal information to train AI models operated by third parties without your consent. Tamgrow does not permit Anthropic or any other third-party AI provider to use content you submit through the Platform’s AI features for the purpose of training, fine-tuning, or improving any AI model.

11. Amendments

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and notify registered users via email or an in-platform notification.

12. GDPR: Additional Information for EEA and UK Residents

This section applies to individuals located in the European Economic Area or United Kingdom. For the purposes of the GDPR, TAMGROW PTY LIMITED is the data controller of your personal information.

12.1 Legal Basis for Processing

• Performance of a contract: Processing necessary to provide marketplace services and process transactions.
• Legitimate interests: Fraud prevention, platform security, improving services, and business administration.
• Consent: Marketing communications and use of non-essential cookies.
• Legal obligation: Compliance with applicable laws, tax obligations, and AML requirements.

12.2 Your GDPR Rights

• Right to erasure: You may request that we delete your personal information in certain circumstances.
• Right to restriction of processing.
• Right to data portability.
• Right to object to processing for direct marketing purposes.
• Right to withdraw consent at any time.
• Right to lodge a complaint with your local supervisory authority (EU: your national DPA; UK: the ICO at www.ico.org.uk).

12.3 Overseas Transfers

For EEA/UK residents, we rely on Standard Contractual Clauses (SCCs), adequacy decisions, or your explicit consent when transferring your personal information outside the EEA or UK.

13. Contact Us