Privacy Policy

Last updated: 17 September 2026

This policy explains what personal information FillRun ("we," "us," "our") collects, why, and how it's handled. It applies to everyone who uses FillRun — account owners, invited staff/operators, and visitors to our website.

1. What we collect

• Account information: name, email address, password (stored as a salted hash, never in plain text), company name, and role.
• Business data you enter: products, stock levels, purchases, suppliers, fill runs, sales figures, and machine details — this is your operational data, not something we collect about you.
• Billing information: handled directly by Stripe, our payment processor. We receive and store a Stripe customer/subscription reference, but never your full card number — Stripe stores and processes that under its own PCI-compliant systems.
• Usage data: basic technical logs (IP address, browser type, pages visited) for security and troubleshooting.
• Content you upload: receipt images and CSV exports you upload are processed to extract data (e.g. line items, quantities) and stored against your account.

2. How we use it

• To provide the core service — tracking your stock, purchases, and fill runs, and showing you the reports and alerts you'd expect.
• To process payments and manage your subscription via Stripe.
• To read receipt images/documents you upload and extract structured data from them (via a third-party AI service — see below).
• To respond to support requests and send account-related notifications (e.g. invite links, trial status).
• To detect and prevent abuse, fraud, or security issues.

We do not sell your personal information, and we do not use your business data to train AI models.

3. Who we share it with

We use a small number of service providers to run FillRun. Each only receives what it needs to do its job:

• Stripe — payment processing and subscription billing.
• Neon — our database host, where your account and business data is stored.
• Vercel — hosts and serves the FillRun application.
• Anthropic (Claude API) — processes receipt images and documents you choose to upload, to extract line items automatically.

We don't share your data with anyone else except where required by law, or with your explicit consent.

4. Data location and security

Your data is stored on infrastructure hosted in AWS's Asia Pacific (Sydney) region. Passwords are hashed, connections use HTTPS, and access to your account is tenant-isolated — other FillRun customers cannot see your data. Platform administrators (FillRun's own team) can access account data only for support or legal reasons, and that access is logged.

5. Your rights

You can access, correct, or export most of your data directly from the app. You can request full account deletion at any time by contacting us — we'll delete your personal information and business data within a reasonable period, except where we're required to retain records (e.g. for tax or legal purposes). If you're in the EU/UK, you have rights under GDPR including access, correction, deletion, and portability; contact us to exercise them.

6. Cookies

We use essential cookies to keep you logged in and remember your session. We don't use third-party advertising or tracking cookies.

7. Data retention

If you cancel your subscription, we retain your data for a reasonable period in case you return, then delete it. You can request earlier deletion at any time.

8. Changes to this policy

We may update this policy as FillRun evolves. Material changes will be communicated by email or an in-app notice before they take effect.

9. Contact

Questions about this policy or your data? Reach us at hello@fillrun.com.au.