TrueVault Pty Ltd (ACN 675 825 966)
Version TV-PP-V2.0 - Last updated 18 September 2026

1. Our Commitment to Privacy

TrueVault Pty Ltd ACN 675 825 966 (“TrueVault”, “we”, “us”, or “our”) is committed to protecting the privacy of your personal information.

This Privacy Policy explains how we collect, use, store, manage and disclose your Personal and Sensitive Information - information that identifies you or from which your identity can reasonably be ascertained, including any opinion about you. We manage all Personal Information in accordance with this Privacy Policy and the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth).

By providing Personal Information and Sensitive Information to us (including through our website, TrueVault application, social media channels or otherwise), you consent to our collection, use, disclosure and storage of that information as described in this Privacy Policy.

2. Updates to this Privacy Policy

We may review and update this Privacy Policy from time to time to take account of new laws and technology, changes to our functions and activities and to ensure that it remains appropriate. The latest version will always be available at www.truevault.com.au.

Changes that do not materially affect you take effect when posted. Material changes - including changes to the categories of personal information we collect, the purposes for which we use it, our retention practices, or the overseas recipients to whom we disclose it - take effect 30 days after we post them, and we will tell you by email or in-app notification before they do.

3. What Personal Information We Collect

3.1 General information

First, middle and last names
Phone number
Email address
Current and previous addresses
Any other Personal Information you provide to us

We check an identity document - a driver’s licence, passport, change-of-name document or other government-issued ID - with the authority that issued it, and then delete the file. We do not retain document files, scans or images after the verification is complete, and we do not retain document numbers in the clear. What we retain is your name and contact details, your date of birth, the document expiry date where the check returns it, a partially masked document reference (for example AB******9), the outcome of the verification, and the biometric binding that lets you prove your identity again.

3.2 Demographic information

Date of birth
Age
Gender
Marital status

3.3 Sensitive information

We may collect “sensitive information” as defined under the Privacy Act, including:

Biometric information (facial images for verification) and signature samples. An identity document may show other sensitive information - for example health or organ donor details, professional or religious affiliations, or information about your relationships. We do not extract it, use it or retain it, and it is deleted with the document image once the check is complete.

Each time you verify again, we may capture a new image of your face and add it to your profile. That is how we keep recognising you accurately as you age, change your hair or use a different camera. We use those images only to confirm it is you. We do not use them to train any general model, and never for anyone else’s purposes. We capture those additional images during reverification to strengthen your unique profile, and for nothing else. We do not use your biometric information to test or improve our matching or liveness detection, and we do not ask for your consent to do so. If that ever changes we will ask you separately, before we do it, and you will be able to say no without it affecting your identity, your verifications or your access.

Where you ask us to obtain a nationally coordinated criminal history check, a court records check or similar screening, we obtain it through an accredited third-party provider, with your separate consent, and we tell you who will receive the result and how long it is kept. The result is a record of what the source held at the time of the check, not an assessment of your suitability or character.

By providing personal information, you consent to its collection, use and disclosure as permitted by law and as outlined in this Privacy Policy. References to Personal Information in this policy include Sensitive Information except where otherwise indicated.

We collect Sensitive Information only where it is reasonably necessary for one or more of our functions or activities, and only with your express consent. Where the collection involves biometric, health or other sensitive categories, we will seek your specific, informed consent at the point of collection (for example, via a dedicated consent step that is separate from your acceptance of this Privacy Policy) and explain the purpose for which the information is collected and the consequences if it is not provided.

Where we receive unsolicited Personal Information, we will, within a reasonable period, determine whether we could have lawfully collected the information under APP 3. If we could not, and it is lawful and reasonable to do so, we will destroy or de-identify the information as soon as practicable.

3.4 Other information

Transaction and service history with TrueVault
Records of communications and interactions with us
Website analytics data
Technical details such as IP addresses or device identifiers

4. How We Collect Personal Information

We collect Personal Information when you:

Create a TrueVault account or use our application or website
Communicate with us via phone, email, online chat or social media
Participate in surveys or provide feedback
Engage with our digital marketing or social media pages

We may also receive information from:

Third-party service providers (for example document verification and payment processors)
Publicly available sources or social media platforms

4.1 Choosing not to provide Personal Information

Where it is lawful and practicable, you may interact with us anonymously or by use of a pseudonym. Because our identity-verification services depend on verified identity, we will be unable to provide those services if you do not provide the information necessary to verify your identity.

5. When You Visit Our Website

When you visit our website without registering, we may collect limited non-personal information such as:

IP address and server details
Browser type
Pages visited and time spent
Referring website

We do not attempt to identify you unless required by law.

6. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience:

Necessary cookies: essential for basic website functionality.
Analytical cookies: collecting aggregated data with no personally identifiable information.
Third-party cookies: used by integrated services such as social media or analytics tools.

We may also use Facebook Pixel or equivalent tools to measure the effectiveness of our digital advertising campaigns. You can adjust your browser settings to refuse cookies, though this may limit certain functionality.

7. How We Use Your Personal Information

We may use your Personal Information to:

Provide and manage our services
Verify your identity and issue credentials
Respond to queries, feedback or complaints
Improve our systems, products and user experience (using aggregated or de-identified data only)
Conduct internal analysis and reporting on matters directly related to the purposes for which the information was collected
Send service updates or notifications
Carry out marketing or promotional activities in accordance with Section 8
Comply with our legal and regulatory obligations

We use biometric information only in the ways described at Section 3.3.

We share your Personal Information with a business at your direction, for identification and identity verification purposes, with your express consent. Separately, and as set out in Section 9, we disclose Personal Information to service providers who perform functions for us under contract, and to the authority that issued a document you have asked us to verify. We do not share it with anyone else without your consent.

We will not use your Personal Information for any unrelated purpose without your consent.

8. Direct Marketing

We may use your Personal Information, including your contact details, to contact you with information about our services or those of related entities that we believe may interest you. Identity information obtained through an official records holder will not be used for direct marketing purposes. You may opt out at any time using the “unsubscribe” link in our emails or by contacting us using the details in Section 13. We will not use or disclose personal information about you to third parties for their direct marketing purposes unless you have consented.

9. Disclosure of Personal Information

We may disclose your Personal Information to trusted third parties who assist us in delivering our services, including:

Official government document issuers
Third-party identity service providers
Official record holders
Payment processors
Hosting and cloud storage providers (in Australia, except as described at Section 9.1)
IT and cybersecurity providers
Professional advisers
Regulatory authorities or law enforcement agencies where required by law

We take reasonable steps to ensure these third parties comply with the APPs or equivalent standards. We do not sell, rent or trade Personal Information.

9.1 International transfers and overseas recipients

We store your Personal Information in Australia. We do not disclose biometric information to any recipient outside Australia - ever, and under no circumstance, including a business continuity event.

There is one circumstance in which identity information leaves Australia in the ordinary course. Where you ask us to verify a credential issued overseas - currently only an Indian identity credential, verified through DigiLocker - we send the minimum information that check requires to the authority that issued it, in that country, and only with your consent at the point of verification. Foreign passports are verified through the Australian VEVO service and do not leave Australia.

We maintain a current list of the verification sources and service providers that handle Personal Information for us, and the countries in which they are located, available on request.

In a business continuity situation we may temporarily engage overseas processors to ensure service availability. Currently this may include processors in Singapore and the United States. Your biometric information is never disclosed to them. We use them only for as long as the situation requires, and we keep the information disclosed to the minimum necessary to keep the service running.

Where we disclose Personal Information to an overseas recipient, we will, before doing so, take reasonable steps to ensure the recipient does not breach the APPs in relation to that information. We will not seek to rely on the consent exception in APP 8.2(b) unless you have separately and expressly consented to the disclosure after being clearly informed that, by giving consent, APP 8.1 will not apply to that disclosure.

9.2 Government-related identifiers

We do not adopt a government-related identifier (such as a Medicare number, drivers licence number, passport number or tax file number) as our own identifier of you. We will only use or disclose a government-related identifier where permitted by APP 9, including where it is reasonably necessary to verify your identity, where required or authorised by law, or where reasonably necessary for one or more enforcement-related activities. Where we participate in the Document Verification Service or the Australian Government Digital ID System, we do so in accordance with all mandatorily applicable rules in relation to that participation.

10. How we hold Personal Information and Data Security

We take reasonable steps to protect your Personal Information from misuse, interference, loss, and unauthorised access or disclosure, including by:

Encrypting sensitive data in transit and at rest
Maintaining secure access controls and multi-factor authentication
Restricting staff access to authorised personnel only
Regularly reviewing and testing security systems
Storing data within secure Australian-based servers
Secure infrastructure and network isolation
Software security and compliance practices
Data retention and privacy safeguards

In addition, TrueVault employs per-person encryption keys, segregated AWS environments, continuous infrastructure monitoring, immutable audit logging, and has implemented controls aligned with the requirements of the Australian Digital ID Act, ISO 27001, and ASD Essential Eight.

While we take these precautions, no system is entirely secure. We cannot guarantee against all unauthorised access or misuse, but we act promptly to investigate and contain any breach.

10.1 Data retention and destruction

We retain Personal Information only as long as necessary for the purposes described in this Privacy Policy or as required by law. When no longer needed, we securely destroy or permanently de-identify the information.

10.2 De-identified information

We may de-identify your Personal Information or aggregate it in such a way that it cannot be used to identify you. We may disclose de-identified information for analytical, research, service-improvement and reporting purposes. Consistent with Section 9 (Disclosure of Personal Information), we do not sell, rent or trade Personal Information, whether identified or de-identified, for the primary purpose of monetisation.

11. Accessing and Correcting Your Information

You may access or correct your Personal Information by logging into your TrueVault account or contacting us in writing (see Section 13). We may need to verify your identity before processing such requests, and we aim to respond within 30 days. In certain circumstances we may lawfully refuse access, and if we do we will provide written reasons and information about how to complain. Where we have corrected your Personal Information after disclosing it to a third party, you may ask us to notify that third party.

11.1 Quality of Personal Information

We take reasonable steps to ensure that the Personal Information we collect is accurate, up to date and complete, and that the Personal Information we use or disclose is, having regard to the purpose of the use or disclosure, accurate, up to date, complete and relevant.

12. Data Breach Notification

If we have reasonable grounds to suspect that an eligible data breach has occurred (within the meaning of Part IIIC of the Privacy Act), we begin assessing it immediately and complete the assessment within 30 days at the latest. If the assessment confirms that an eligible data breach has occurred, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable. Where a breach affects the people of a business we verify for, we notify that business within 72 hours of becoming aware of, or reasonably suspecting, the breach. We maintain a documented data breach response plan to support timely identification, containment, assessment and notification.

13. Complaints and Contact Us

Privacy Officer
TrueVault Pty Ltd (ACN 675 825 966)
Email: support@truevault.com.au

We aim to investigate and respond within 20 days, and to resolve complaints within 40 days where possible. In any event, we will provide a substantive written response to your complaint within 30 days, in accordance with the Privacy Act. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner via www.oaic.gov.au.

One identity. The whole
trust chain.

Privacy policy.