1. Purpose
This Privacy Policy explains how Dispute Tech Pty Ltd (trading as Chasyr, “we”, “us” or “our”) collects, holds, uses, discloses and protects personal information in connection with the Chasyr website, platform, applications, APIs, integrations, AI-enabled features and associated products and services (Services).
Chasyr is an AI-enabled business-to-business payment intelligence, negotiation, payment plan and dispute resolution platform. Our Services help businesses manage receivables, resolve payment issues and maintain reliable records through transparent workflows—especially for construction, trades, and finance / accounts receivable teams.
We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (Australian Privacy Act), and other privacy laws that apply to our activities.
2. Who we are
Dispute Tech Pty Ltd operates the Services. Privacy Officer: Dispute Tech Pty Ltd · privacy@chasyr.com · www.chasyr.com.
3. Scope
This Policy applies where Chasyr collects or uses personal information for its own business purposes, including information about website visitors and prospective customers; trial users, customers and authorised users; advisers, suppliers, partners and event attendees; and people who contact or communicate with Chasyr.
Where Chasyr processes Customer Data only on a customer’s documented instructions, Chasyr generally acts as a service provider, processor or equivalent role under applicable law and the relevant agreement. The customer remains responsible for its own privacy obligations and for ensuring it is authorised to provide that data to Chasyr.
4. Definitions
Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable. Customer Data means data submitted to or generated through the Services by or for a customer under a customer agreement. Sensitive information has the meaning given by applicable privacy law and may be subject to additional protections.
5. Personal information we collect
5.1 Information you provide
- Account and business contact information (name, job title, organisation, business address, email, telephone, credentials and preferences).
- Billing information (billing contacts, invoice and subscription details, payment transaction references). Authorised payment providers process payment card information; Chasyr does not store card numbers.
- Communications (support requests, feedback, surveys, chat, emails, authorised call recordings and meeting transcripts).
5.2 Information generated through the Services
- Usage and technical information (logs, device and browser data, access timestamps, IP addresses and system activity).
- Platform activity (negotiation history, payment plan activity, communications, workflow progression, user actions and audit trails).
- AI interaction information (prompts, generated responses, interaction metadata and feedback about AI outputs).
- AI voice transcriptions and related call metadata where voice features are enabled.
5.3 Information collected automatically
We may use cookies, pixels, analytics tools and similar technologies to collect website usage, device, session, traffic, security and marketing effectiveness information. This includes Microsoft Clarity for session recordings and heatmaps. When you are signed in, Clarity may receive your user id, name and email so we can attribute sessions. Password and payment card fields are masked in recordings; other on-screen content is not masked by default. Choices will be described in a Cookies Policy when published; until then, contact privacy@chasyr.com.
5.4 Information from third parties
We may receive information from accounting, ERP and CRM platforms, payment providers, public business registers (for example ABR), strategic partners, and customer-enabled integrations. We do not obtain personal information from credit reporting agencies as a credit provider. Identity verification or data enrichment services are used only if we or a customer enable them for a documented purpose.
6. How we collect personal information
We may collect personal information directly from you, automatically when you use the Services, from our customers and authorised users, through integrations you or a customer enable, and from the third parties described above. We aim to collect only information that is reasonably necessary for our functions or activities, or otherwise as permitted or required by law.
Anonymity
Where lawful and practicable, you may interact with us anonymously or using a pseudonym. You can read our public website, Privacy Policy and Terms without an account. Creating an account requires identity (name and email) because Chasyr is organisation-scoped accounts receivable software. It is not practicable to provide the recovery product anonymously where we need to verify identity, process a transaction, keep an evidence record, or comply with law.
7. Customer Data
Customer Data may include invoices, purchase orders, contracts, debtor and creditor records, payment histories, correspondence and supporting evidence. Customer Data remains subject to the customer’s control and the applicable agreement. Chasyr processes it only for authorised purposes, including to provide, secure, support and maintain the Services, and as otherwise instructed or permitted by contract or law.
Customers are responsible for determining the lawful basis for collecting, using, disclosing and providing Customer Data to Chasyr and for issuing any privacy notices required by applicable law.
8. How we use personal information
We may use personal information to:
- create and administer accounts, authenticate users, process payments and operate workflows
- provide support, resolve technical issues and communicate with users
- develop, test, maintain and improve the Services, including analytics and research
- protect accounts, detect misuse or fraud, investigate security events and maintain platform integrity
- comply with laws, respond to lawful requests, resolve disputes and enforce agreements
- send service, onboarding and product communications
- send marketing communications where permitted by law (you may opt out at any time—see §17)
- create and maintain audit trails and evidence records for authorised operational, contractual, legal, security and dispute-management purposes
We will not use or disclose personal information for an unrelated purpose unless you consent or the use or disclosure is otherwise authorised or required by law. We do not sell personal information.
9. Legal bases for processing outside Australia
Where a law such as the GDPR requires a legal basis, we may rely on performance of a contract, legitimate interests, consent, compliance with legal obligations, or protection of vital interests, as applicable, including on behalf of the Customer. Where we rely on legitimate interests, we assess those interests against the rights and interests of affected individuals.
10. AI, automation and decision support
Chasyr uses AI and workflow automation to assist users with payment issues, negotiations, payment arrangements, document organisation and dispute resolution workflows. AI outputs are advisory. Users remain responsible for reviewing outputs and for decisions and actions taken using the Services.
Chasyr does not use its AI features to provide legal advice, determine legal outcomes, automatically bind parties, or make solely automated decisions that produce legal or similarly significant effects on individuals without meaningful human involvement.
AI interactions may be processed by Chasyr and authorised third-party service providers to deliver, secure, monitor and improve the relevant feature. Customers and users must not submit personal information to AI features unless they are authorised to do so and the submission is appropriate for the intended purpose.
Chasyr does not use Customer Data to train general-purpose AI models or third-party foundation models unless this is expressly agreed with the customer or separately consented to where required. Where AI-enabled features generate recommendations, classifications, prioritisations, payment-risk indicators or negotiation suggestions, such outputs support human decision-making and are not determinative.
11. How we disclose personal information
We may disclose personal information to:
- the creditor and/or debtor, where required to operate customer-authorised workflows
- service providers that support cloud infrastructure, hosting, storage, security, analytics, customer support, communications and payment processing (see named processors below)
- third-party systems where a customer or user enables an integration
- professional advisers, auditors, insurers and corporate advisers where reasonably necessary
- a prospective or actual purchaser, investor or successor in connection with a merger, acquisition, asset sale, financing or restructuring
- courts, regulators, government bodies, law enforcement or other parties where required or authorised by law
- other parties where necessary to prevent fraud, investigate misconduct, enforce rights, protect users or the public, or with consent
Chasyr performs risk-based due diligence before engaging material service providers that may access personal information and seeks contractual commitments appropriate to the nature of the services provided.
Named processors
Typical processors for this product include:
- Supabase (hosting, database, auth, storage)
- Mailgun (transactional and recovery email)
- Intercom (in-app and web support chat for creditor-facing users)
- Microsoft Clarity (session recordings, heatmaps, and product analytics)
- Twilio (SMS and voice telephony)
- Vapi (voice AI calls, where enabled)
- OpenAI and, where configured, Cohere (drafting, extraction, classification)
- Airwallex (subscription and usage billing)
A public register with roles, typical locations and DPA tracking is at /subprocessors.
Credit and debt-collection role
We do not disclose personal information to credit reporting bodies as a credit provider, and we are not a licensed debt collector. Customers remain responsible for Australian Consumer Law, ACCC debt-collection guidelines, and any consumer-credit rules that apply to their own outreach.
12. Government requests
Where legally permitted, Chasyr may seek to review, limit or challenge requests for personal information from government authorities or law enforcement bodies where Chasyr considers such action appropriate.
13. Overseas disclosures and international transfers
Chasyr is designed primarily for Australian business customers. Personal information processed through the Services may relate to individuals located outside Australia. We may engage service providers, subprocessors and professional advisers located in Australia and other jurisdictions.
Depending on the technologies and service providers used from time to time, personal information may be stored, processed or accessed in Australia and in other countries where our authorised service providers operate. These countries may include the United States, United Kingdom, Singapore, European Union jurisdictions and other locations identified in Chasyr’s supplier and subprocessor records (see /subprocessors).
Before transferring personal information to an overseas recipient, Chasyr will take reasonable steps required by applicable law to help ensure that the information is protected through appropriate security and privacy safeguards (typically provider contracts and security controls).
Data residency preferences offered by Chasyr, where available, do not necessarily prevent limited international access required for support, security monitoring, maintenance, resilience, legal compliance or similar operational purposes.
14. Data retention and disposal
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, customer instructions, contractual requirements, security, dispute resolution, evidence and audit needs, legal obligations, litigation holds and enforcement of agreements. Chasyr maintains a documented records retention schedule (docs/compliance/RETENTION_SCHEDULE.md).
Product defaults (longer if tax, dispute or legal hold requires)
- Account, invoices, cases and communications: life of the account/case plus up to seven years
- Call recordings: life of the case plus about two years, then review for deletion
- Waitlist / marketing contacts: until you opt out or two years without converting
- Operational logs: about 90 days unless an incident requires longer
15. Security
Chasyr uses administrative, technical and physical safeguards appropriate to the nature of the information and relevant risks, including encryption in transit (HTTPS/TLS), organisation-scoped access via row level security (RLS), private storage for invoice files and call recordings, logging and monitoring, backup and recovery processes, and periodic security review. We also provide Supabase Auth multi-factor authentication (authenticator app and passkeys) with session time limits. Auth and API activity is reviewed in Supabase Logs until a dedicated SIEM is connected. No method of transmission or storage is completely secure. Users must protect their credentials and notify Chasyr promptly of suspected unauthorised access.
16. Data breaches
Chasyr maintains processes to identify, contain, assess, investigate and respond to suspected or confirmed data breaches. If we experience an eligible data breach under the Notifiable Data Breaches (NDB) scheme in the Privacy Act, we will assess the incident and, where required, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals. Report suspected incidents to privacy@chasyr.com. Operational steps are in our internal NDB playbook. This statement is not a certification that an independent NDB audit has been completed.
17. Marketing and transactional messages
We send product and billing messages needed to operate your account. Recovery outreach (email, SMS, voice) is sent on your organisation’s instructions to contacts you supply. Marketing such as waitlist, scorecard, and founding-member communications is separate from debtor outreach. You can ask us to stop marketing emails via privacy@chasyr.com (subject “unsubscribe”). Unsubscribing from marketing does not stop transactional or recovery messages your organisation has authorised.
18. Access, correction and other privacy rights
Privacy rights available to an individual may vary depending on location, applicable law and Chasyr’s role in relation to the relevant information. Depending on applicable law, you may have rights to request access to or correction of personal information, deletion, restriction, objection, withdrawal of consent, portability, or information about certain automated processing. Some rights are subject to legal exceptions.
To make a request, contact privacy@chasyr.com. We may need to verify your identity. We aim to respond within 30 days. If we cannot meet a request, we will provide reasons where required by law and explain available complaint options. Signed-in users can also download account-scoped JSON from Settings.
19. Privacy complaints
You may make a privacy complaint by contacting the Privacy Officer at privacy@chasyr.com. Please include enough information for us to understand and investigate the issue. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or another regulator with jurisdiction over your complaint.
20. Sector focus and US HIPAA
Chasyr is designed with Australian Privacy Act principles in mind for customers in construction, trades, and finance / accounts receivable services. We are building toward formal assurance programmes (such as SOC 2 / ISO 27001). Marketing claims about certifications are made only when an independent attestation exists for the stated scope and period. US HIPAA does not apply to this product: Chasyr is not a HIPAA Covered Entity or Business Associate and is not offered as a medical-records or US health-plan system. Do not upload US protected health information (PHI).
21. Children
The Services are designed for business users and are not directed to individuals under 18 years of age. Individuals under 18 must not create or operate an account. If we learn that personal information has been collected from a child contrary to this Policy, we will take appropriate steps in accordance with applicable law.
22. Changes to this Policy
We may update this Policy to reflect changes to our Services, practices or legal obligations. The current version will be published on our website. Where appropriate, we will notify users of material changes through the website, the Services or email. The date at the beginning of the Policy identifies when the current version was last updated.
23. Contact us
Privacy Officer · Dispute Tech Pty Ltd · privacy@chasyr.com · www.chasyr.com.
Related documents
- Subprocessors register
- Terms of Service
- Internal: retention schedule, NDB playbook, DSAR runbook, DPA register (privacy@)
- Cookies Policy, AI Acceptable Use Policy and AI Governance Policy — to be published when approved