Privacy policy

Who handles your information

M8Rates is operated by CORE CONVERGE TECHNOLOGY SERVICES PTY LTD, ABN 60 669 440 331. Contact our privacy contact at support@m8rates.com.au, using “Privacy” in the subject, for information requests, corrections, withdrawal, deletion or complaints.

This policy covers the onboarding release: public information pages, secure accounts, grocer applications, catalogue preparation, customer basket comparisons and restricted workspaces. Grocery ordering, payments and live AI processing are not enabled. We will update this notice before enabling payment collection or live AI processing.

What we collect

• Account information, such as your email, user identifier, authentication factors and security events, processed through Clerk. Passwords and verification codes belong in the sign-in interface, never in application or support messages.
• Grocer application details you provide: business name, ABN, business contact name, email and phone, postcode, food registration authority and reference, and delivery capability.
• Application status, approval checks, assigned workspace permissions, product specifications, inventory, delivery schedules and administrative activity needed to operate grocer workspaces.
• When you choose to save an address or request a basket comparison: your name, delivery address, selected products and time-limited quotes. We use the address to check delivery eligibility. Grocers do not receive your address just because you browse or request a quote.
• When ordering opens, your orders, delivery progress, packing shortages and service issues will be available in your private account. Only the grocer fulfilling that part of an accepted basket receives the delivery details needed for its work; another grocer does not receive the rest of your basket.
• Information you send voluntarily to support. Please avoid personal identity documents, bank details, card information or sensitive information about yourself or other people.
• Technical information processed by hosting and authentication providers, including IP addresses, request time, browser/device information, essential session cookies and security signals.

We generally collect information directly from you and from the service providers performing authentication, hosting and security functions. We may verify business or food registration details against public registers or the relevant authority. Browsing public pages does not require an application. If you withhold required application fields, we may be unable to assess your shop; you can contact support to discuss an alternative.

How we use and disclose it

We use the information to operate accounts, assess applications, contact the nominated business representative, manage authorised workspaces, investigate misuse and complaints, and meet legal obligations. Your application is visible to you and authorised M8Rates administrators, not to other applicants or households.

We use Clerk for authentication, Supabase for database services and Vercel for hosting. They and their contracted subprocessors process information for those functions. We may share necessary information with professional advisers, registration authorities or regulators when appropriate and legally permitted or required. We do not sell application contact details or use an application as permission for unrelated marketing.

Australia and overseas processing

Our Supabase application database is configured in Sydney, Australia. Account, hosting, support and security processing can also involve recipients outside Australia, including the United States. Australian database hosting is not a promise that every part of the service stays in Australia.

Provider infrastructure and subprocessor arrangements may change and involve additional locations. Their current published information is available from Clerk, Supabase and Vercel. Contact us for information about the arrangements relevant to your request. We assess provider access and safeguards and remain responsible for obligations that apply to us; these links do not replace those obligations.

Cookies, marketing and AI

Essential sign-in cookies and browser storage maintain your session and help prevent fraud. Blocking them may prevent private account features from working. See our Cookie notice. The M8Rates application does not enable advertising pixels or optional audience analytics in this release.

Applying does not opt you into marketing. If we introduce optional marketing, we will provide a separate choice and an easy way to unsubscribe. Application and account messages should contain only information needed for that service unless you separately agree to marketing.

Lil Mate does not send information to a live AI model in this release. Before enabling AI features we will explain the provider, information sent and your choices. We do not use grocer applications to train an AI model.

Security, retention and closure

We use encrypted transport, separate account identities, database access restrictions and additional verification for administrative actions. Access is limited by role and operational need. No system can guarantee absolute security. Tell us promptly if you suspect misuse without sending passwords or one-time codes.

We keep application and account records while reasonably necessary to assess the application, support the relationship, resolve disputes, investigate security events and meet legal obligations. We review records for deletion or de-identification when they are no longer needed. You can request withdrawal or deletion through support. Some records may need to be retained for a lawful reason; we will explain that where appropriate. Provider backups may retain records until their normal expiry and are not intended for ordinary account access.

Removing a sign-in account does not automatically erase every related application or audit record. Contact us if you also want those records reviewed. We will take proportionate steps to confirm identity before disclosing or deleting another person’s information.

Your requests and complaints

Contact support to request access, correction, withdrawal or deletion, or to complain about information handling. Explain what you need without including unnecessary sensitive details. We aim to respond within 30 days or explain the delay and next step. We will explain any lawful basis for declining a request, and any permitted fee before proceeding. There is no fee to make a privacy complaint.

If you remain dissatisfied, you may contact the Office of the Australian Information Commissioner where it has jurisdiction or another appropriate regulator. Privacy Act coverage depends on the business’s circumstances; this policy does not remove rights that apply by law. We will update the policy when our practices change and notify you of material changes where required.