Privacy Policy

This Privacy Policy explains how Accord Analytics (“we”, “us”, “our”), operating the SpendForensics service at spendforensics.com (the “Service”), collects, uses and protects information. Accord Analytics is based in Perth, Western Australia, Australia.

1. Our data-minimisation model

SpendForensics is designed so that we do not need — and do not receive — your raw procurement data. When you upload a file to the Service:

• The file is parsed and analysed entirely inside your browser. It is not uploaded to our servers.
• Only the analysis findings (aggregated results, statistical distributions and summary metrics needed to render your report) are transmitted to our servers after you complete payment.
• Individual transaction rows, vendor lists and source files are not stored by us and are discarded when you close the page.

2. Information we collect

• Report findings. The analysis output generated by your browser, stored so we can render your report.
• Email address. Provided by you after payment so we can send your report link and so the report can be gated by email.
• Payment metadata. Handled by Stripe (our payment processor). We receive a Stripe session identifier and payment status, not your card details.
• Basic operational logs. Server logs necessary to run the Service (IP address, user agent, timestamps), retained for a limited period for security and abuse prevention.

3. How we use information

• To render and deliver the report you purchased.
• To gate access to the report by email address.
• To process your payment and issue a tax-compliant receipt.
• To operate, secure and improve the Service.
• To respond to your enquiries.

We do not sell your personal information. We do not use your data to train machine-learning models.

4. Retention

• Source data (your uploaded file) — never persisted on our servers.
• Report findings — retained for up to 1000 days from creation, then automatically deleted.
• Email addresses — deleted with the associated report.
• Payment records — retained by Stripe and by us for the period required by Australian tax law (currently 5 years).

5. Sharing and subprocessors

We share limited information with the following service providers:

• Stripe, Inc. — payment processing (including automatic tax calculation for GST).
• Cloud hosting and email delivery providers engaged by us to run the Service and send report-ready emails.

We do not disclose your information to any other third party.

6. Security

Report findings are stored encrypted at rest. Access to a report requires both the unique report link and the email address originally provided. We apply industry-standard technical and organisational measures to protect information in our custody.

7. International transfers

Our infrastructure and subprocessors may process data outside Australia, including in the United States and the European Union. Where this occurs, we rely on the recipient’s contractual and technical safeguards.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete or object to processing of personal information we hold about you, including under the Australian Privacy Act 1988 and the EU / UK GDPR. To exercise any of these rights, or to make a privacy complaint, email adrian@accordanalytics.com. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Cookies

SpendForensics uses only the strictly necessary cookies and local storage required to operate the Service (session, checkout, and report access). We do not use advertising cookies or third-party analytics profiling.

10. Changes

We may update this Privacy Policy from time to time. The current version and “last updated” date are always shown on this page.

11. Contact

Accord Analytics
Perth, Western Australia, Australia
adrian@accordanalytics.com