The short version: we collect what the marketplace needs to run, we show counterparties what they need to trade, and we sell nothing to anyone.
Account details (name, work email, company, ABN), the content you publish (listings, wanted posts, documents such as CoAs and SDSs), messages you exchange with counterparties, and standard technical logs required to run the service securely.
To verify membership, operate the marketplace, show counterparties who they are dealing with, and keep the trading record both parties rely on. We do not sell personal information and we do not run third-party advertising.
Your company name, verification status, state and listings are visible on the marketplace. Enquiries, offers and attached documents are visible only to the two parties involved. Account credentials are visible to no one, including us.
On public pages only, we measure aggregate visits and page performance through our hosting provider's analytics and speed tools. We record a grouped page label — a listing page is recorded only as /materials/[id], never the listing's identifier — and never search terms, filters, query strings or link fragments. Signed-in areas send nothing: no account, dashboard, inbox, offer, document or admin page is measured. There are no analytics cookies, no cross-site tracking, no advertising pixels and no session replay. This aggregate measurement is processed by our hosting provider and may be handled outside Australia.
Your account, listings, messages and documents are hosted in Australia (Sydney region) with our infrastructure provider. Documents attached to listings are stored privately and shared with counterparties through expiring links. The exceptions are the aggregate public-page measurement described above and the document reading described below.
AI document assessment and OCR are standard platform services accepted during company registration or when accepting updated terms. External processing starts only after the organisation's Owner and the submitting member have accepted the current version. Submitted documents and label images are then automatically read, without a separate consent prompt for each file. Original unredacted pages are sent, before anything is hidden, to Anthropic outside Australia; scanned or photographed pages may also be sent to PaddleOCR, operated by Baidu in China, which keeps a copy of the page image and extracted text in Beijing. We do not control how long PaddleOCR retains those copies. We record the submitting user, processing-notice version, document hash and the organisation Owner's terms-acceptance record. The organisation and submitting user must have authority and permissions for these disclosures. Automated suggestions must be checked; assessment does not publish documents or expose originals to buyers. Buyer-copy review and redaction controls remain required, and human review can resolve failed or unsuitable automated results.
For as long as your membership is active, and afterwards only as long as the law and legitimate record-keeping require. You can ask us to close your account and delete personal information that we are not required to retain.
You may request access to, correction of, or deletion of your personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Write to info@surply.com.au and we will respond within 30 days.
Privacy questions or requests: info@surply.com.au.