Privacy Policy
What we collect, why, who else sees it, how long we keep it, and how to get it deleted.
In effect from 24 September 2026
Kawaljeet Singh trading as Become TradeReady · ABN 79 660 267 171
Who holds your information
TradeReady is run by Kawaljeet Singh, a sole trader trading as Become TradeReady. Your information is held by that one person, not by a company.
Questions, corrections, or a request to delete your data: support@becometradeready.com.au.
What we collect, and why
We only collect what the site needs to work. There is no advertising, no tracking pixels, no analytics product, and we do not sell or share your information with anyone for marketing.
Your account — your name, your email address, and your password. Your password is stored as a bcrypt hash: we cannot read it, and if you lose it we can only reset it, never tell you what it was.
What you have bought — your invoices, what was on them, what you paid, when we marked them paid, and which of our admins changed an invoice's status. Also which courses your account can open and the date that access runs out.
How you use the course — your quiz attempts, the answers you picked, your scores, and which lessons you have worked through. This is what the dashboard and your quiz history are built from.
Workshops — your booking, and the seat it holds.
Bank details, but only when we owe you money. We never hold your bank details for taking payment — you pay us by transfer, so we see only what your bank shows on the transaction. If we have to refund a workshop, we ask you for your account details at that point, use them for that one transfer, and delete them afterwards.
The waitlist — if you ask to be told when a trade opens, we keep your email address, the trade you asked about, and whether we have emailed you yet.
Email records — for every email we send you, we record the address, which template it was, whether the provider accepted it, and any error. We do not store the contents of emails we send you.
Security records — password reset tokens, and rate-limiting records. A rate-limiting record contains the email address or IP address used in the attempt, so we can stop someone hammering the password-reset form.
Receipts and payment emails — read this one
We invoice by email and you pay by bank transfer. Two things follow from that, and you should know both:
- Our invoice emails contain our bank details — account name, BSB, account number and your reference. That email sits in your inbox. Anyone who can read your email can read it. It contains our account details, not yours.
- We ask you to email us your payment receipt. If you send us a receipt or a screenshot from your banking app, it may show your own account details or your transaction history. We only need enough to match your payment to your invoice. Black out anything else, or just tell us the amount, the date and the reference — that is enough.
We keep the receipts you send us with the rest of our business records.
Cookies
One cookie, to keep you signed in. That is all. No advertising cookies, no analytics cookies, no third-party trackers.
Who else touches your information
These providers process data for us, under our instructions, to run the service:
| Provider | What they do | Where |
|---|---|---|
| Supabase | Our database and file storage — everything described above lives here | Sydney, Australia |
| Vercel | Runs and serves the website | Sydney region (syd1) |
| Resend | Sends our emails | Overseas |
| Cloudflare | Routes mail sent to our support address to the inbox we read | Overseas |
| Google (Gmail) | The inbox where we read support email and the payment receipts you send us | Overseas |
| Bunny Stream | Hosts lesson video, where a lesson has one | Overseas |
| Anthropic | The AI assistant we build and maintain this site with — see below | Overseas |
Only Supabase and Vercel are in Australia. Everything else means some of your information is handled overseas — your email address, the contents of any support email you send us, your IP address if you watch a video, and in the case below, records from our database. We do not choose where their servers sit.
The AI assistant, and why it is on this list
We are one person. This site is built and maintained with an AI assistant (Anthropic's Claude), and that assistant has access to the live database in order to do the work — loading course content, fixing faults, answering questions like "why did this invoice not unlock".
That means your information can be read by the assistant, and when it is, it passes through Anthropic's systems. In practice this is your name, your email address, your invoice and payment records, and your quiz history — whatever the task in front of it needs. We have turned off the setting that allows our AI assistant's sessions to be used to train models, and your information is not used for anything but running TradeReady.
We would rather write this down than leave it out. Most businesses your size use contractors and do not list them; this is the same thing, and you are entitled to know about it.
Beyond these providers, we disclose your information only if the law requires it.
How long we keep things
| What | How long |
|---|---|
| Account, invoices, payments, unlocks | While your account exists, and then as long as we need to keep business and tax records — generally 5 years |
| Quiz attempts and lesson progress | While your account exists, so your history stays useful to you |
| Workshop bookings | With the invoice records above |
| Bank details you give us for a refund | Used for that transfer, then deleted from our email |
| Waitlist entries | Until you ask us to remove you, or the trade has launched and we have emailed you |
| Email send records — address, template, delivered or not; never the contents | Kept with our business records. We have not set a deletion date for these |
| Password reset tokens | Deleted 7 days after they are used or expire, by a daily job |
| Rate-limiting records | 24 hours, cleared by a daily job |
Getting a copy, a correction, or a deletion
Email support@becometradeready.com.au from the address on your account.
- A copy of what we hold about you — we will send it within 30 days.
- A correction — tell us what is wrong and we will fix it.
- Deletion — we will delete your account and the data tied to it. We have to keep invoice and payment records for tax purposes, so those stay, but they will not be linked to a live account.
We do not charge for any of this.
Keeping it safe
Passwords are hashed, not stored. The site is served over HTTPS. Admin actions that matter — changing an invoice's status, changing someone's role — are recorded with the admin who did them.
The database can be read by the deployed website, by the founder, and by the AI assistant described above when it is working on the site. That is the honest list. It is a small number of parties, but it is more than one, and "only the founder" would not have been true.
We are one person and a small system, and we will not pretend to have a security department. If you find a problem, email us and we will take it seriously.
A note on our size
A small business with turnover under $3 million is generally not covered by the Privacy Act 1988. We have written this policy as a statement of what we actually do, not because a regulator requires it. If TradeReady grows past that point, or the law changes, this policy will be reviewed.
Complaints
Email us first — support@becometradeready.com.au — and tell us what went wrong. If you are not satisfied with how we handle it, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Changes
The date at the top is when this version took effect. If we change something that matters — a new provider, a new kind of data, a longer retention period — we will email people with active accounts before it takes effect.