Cruisy (the "Service") is operated by Claudia Bryant, trading as Cruisy ("we", "us"). This policy explains what personal information we collect, how we use it, and your rights. It is written to comply with the Australian Privacy Principles (Privacy Act 1988) and, for banking data, the Consumer Data Right (CDR) rules.
We use your information solely to run the Service for your farm: keeping your records, extracting and filing your documents, categorising transactions, preparing summaries (such as BAS worksheets), sending you the reminders and daily messages you have enabled, and answering your questions. We do not sell personal information. We do not use your data to train AI models.
The Service uses AI providers to do its work. The assistant runs on Claude models hosted by Amazon Web Services (Amazon Bedrock) inside our own AWS account in Australia, so conversations that can involve your banking data are processed entirely within Australia. Google reads documents and transcribes voice notes. Your content is sent to these providers only to process your requests, under agreements that do not permit them to train on it.
The scheduled transaction categorisation pass sends a normalised, non-identifying payee token to the AI provider, not the raw merchant name from your bank. Raw merchant text reaches the assistant only when you ask a question in chat, which is farmer-initiated and happens with your knowledge at the time.
Your data is stored with Supabase in Australia (Sydney region). Uploaded files are stored privately and are only accessible to your farm's authorised users.
Access is per-farm. People you invite see only your farm. Worker-role accounts are restricted from financial information. Our staff access data only to operate and support the Service.
We share data only with the providers needed to run the Service: Supabase (database and storage), Vercel (hosting), Amazon Web Services and Google (AI processing), Fiskil (banking, CDR), Nylas (email/calendar), and Telegram (messaging, if you connect it). Each receives only what its function requires.
If your CDR consent expires or you revoke it, we de-identify the banking data: bank and account identifiers are removed, while your own work product (categories, notes, and the amounts and dates they attach to) is kept so your farm records stay whole. You may instead ask us to delete the banking data entirely.
You can delete individual records in the app. You can also delete your account and your data yourself in the app under Settings, in Your data. When you do, we disconnect your bank and delete your CDR data, and permanently remove your account after a 30-day grace period during which you can change your mind. If you need help, contact us at claudia@grounded-ai.com.au. We retain only what law requires after deletion.
Data is encrypted in transit, access is authenticated and role-restricted, and bank credentials are never seen or stored by us (bank connection happens on your bank's or Fiskil's own pages).
You may request access to or correction of your personal information at claudia@grounded-ai.com.au. If you have a privacy complaint, contact us first; if unresolved, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). For CDR data, complaints can also be made to Fiskil as the accredited provider. For how we handle Consumer Data Right banking data specifically, see our CDR Policy.
We will post any changes to this policy on this page and note the date above.
Email us at claudia@grounded-ai.com.au.