Privacy Policy
Last updated 22 July 2026Who we are
This Privacy Policy explains how Requify Pty Ltd (ABN 13 697 719 572, "Requify", "we", "us", "our"), a Melbourne, Australia-based company, collects, uses, discloses, and protects personal information in connection with ReqTwin, our requirements management, inspection, bill-of-materials, and programme scheduling platform (the "Service"), including this website.
By creating an account or otherwise using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you are using the Service on behalf of an organization, you confirm you have authority to accept this policy on that organization's behalf.
Information we collect
We collect information in three broad categories: account information you or your organization provide, content you create or upload while using the Service, and information generated automatically as you use it.
Account and identity information: name, email address, and profile details, collected and managed through our authentication provider, Clerk. We never see or store your password; Clerk handles credential storage and any social/SSO sign-in.
Organization and role data: the organization you belong to, and your role within it (Admin, Editor, or Viewer), which controls what you can see and change.
Billing information: your selected subscription plan (Professional or Team) and subscription status, processed through Clerk Billing. We do not store your card number or full payment details ourselves.
Project content ("Customer Content"): requirements, inspection and test plan (ITP) records, bill-of-materials line items, programme activities and milestones, uploaded source documents, and the trace links between them, that you or your organization create in the Service.
AI feature inputs: the free-text questions you ask AI Insights, and vector embeddings we generate from your requirement and document text, used for semantic search, similar-requirement detection, and Uniclass classification suggestions.
Contact form submissions: your name, email address, message content, and IP address, the latter used only to enforce a rate limit on submissions.
Usage and device data: pages viewed, features used, browser/device type, and approximate location inferred from IP address, collected through our product analytics tool, PostHog.
Project region and cost-sharing preference: a project's country, and, if its Admin opts in, whether its BOM cost data contributes to cross-organization benchmarking (see "Cost benchmarking" below).
Cookies: a session cookie that keeps you signed in (set by Clerk) and analytics cookies (set by PostHog). See "Cookies" below.
How we use your information
We use the information above to:
Operate the Service: authenticate you, enforce your organization's role-based permissions, and store and retrieve your project data.
Power AI features: send relevant project data and your question text to our AI providers to generate AI Insights answers, similar-requirement suggestions, and Uniclass classification suggestions.
Bill your subscription and manage plan entitlements.
Respond to support and contact form requests.
Monitor, secure, and improve the Service, including diagnosing technical issues and understanding feature usage.
Meet our legal, regulatory, and accounting obligations.
Our legal bases for processing
Where the GDPR or UK GDPR applies, we rely on the following legal bases to process personal information:
Performance of a contract: account, organization, role, billing, and Customer Content processing needed to provide the Service you've signed up for.
Legitimate interests: usage analytics, security monitoring, and fraud prevention, balanced against, and never overriding, your own rights and interests.
Consent: non-essential analytics cookies, which you can decline through your browser (see "Cookies" below).
Legal obligation: retaining records where accounting, tax, or other law requires it.
Controller and processor roles
For account, billing, and usage data, Requify acts as the data controller: we decide why and how that information is processed. For Customer Content you or your organization upload or create in the Service, Requify acts as a data processor, processing it only to provide the Service and on your organization's instructions. If your organization is itself subject to the GDPR, it remains the controller of its own Customer Content.
AI features and how your data is processed
AI Insights, similar-requirement detection, and Uniclass classification suggestions are powered by third-party AI models. When you use these features, the relevant project data (for AI Insights, your question plus the requirements, ITP, programme, and BOM data needed to answer it, scoped to that project) is sent to Anthropic (Claude) to generate an answer, or to Voyage AI to generate a vector embedding of your text for search and similarity matching. When a project has opted into cost-data sharing and a matching cross-organization benchmark exists, the aggregate benchmark figures for that project's own BOM items are also included in what is sent to Anthropic, as described in "Cost benchmarking" below.
Anthropic's Commercial Terms of Service state that Customer Content sent to Claude through the API is not used to train Anthropic's models. Voyage AI's standard terms permit it to use submitted text to improve its own models unless that is disabled in an account's settings. AI-generated output is provided for informational and productivity purposes only. See the AI disclaimer in our Terms of Service, which applies to any AI-generated content you receive through the Service.
Cost benchmarking
If your organization's Admin opts in to cost-data sharing for a project (the "Share cost data for benchmarking" setting in that project's Project Settings), we include its BOM items' unit cost, Uniclass Product/System code, country, and currency in a nightly cross-organization aggregate. We never expose another organization's raw figures: a bucket (one Uniclass code, country, and currency combination) only becomes visible once at least 5 organizations have contributed to it, and only as aggregate statistics (minimum, 25th percentile, median, 75th percentile, and maximum unit cost).
Viewing published benchmarks requires the same opt-in on your own project and the Insights plan feature. Turning sharing off stops future contribution but does not retroactively remove aggregates already published while it was on.
Who we share information with
We share information only with the service providers ("subprocessors") who help us run ReqTwin, each processing it under its own terms of service, and only to the extent needed to provide the Service:
Clerk: authentication, organization/role management, and subscription billing.
Supabase: hosts our Postgres database, where your account, organization, and Customer Content are stored, protected by row-level security scoped to your organization.
DigitalOcean: hosts the application itself, on a self-managed server (Droplet).
Anthropic: generates AI Insights answers.
Voyage AI: generates the vector embeddings behind semantic search, similar-requirement detection, and Uniclass classification suggestions.
PostHog: product analytics.
Other disclosures
We may also disclose information if required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of Requify, our users, or others. If Requify is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction, subject to this Privacy Policy. We do not sell your personal information.
International data transfers
Requify is based in Australia, but the service providers listed above host and process data in other countries, including the United States. Where we transfer personal information outside Australia, we take reasonable steps to ensure it receives a comparable standard of protection, including through contractual commitments with our providers.
We do not currently have a registered representative in the European Union, the United Kingdom, or Switzerland. If you are located in one of these regions and this affects how you can exercise your rights, contact us at [email protected] and we will address your request directly.
Data retention and deletion
We retain your account and Customer Content for as long as your organization's account remains active. If your organization is deleted in Clerk, or its last member is removed, all projects and everything under them (documents, requirements, ITP records, BOM items, programme data, and embeddings) are automatically and permanently deleted.
You can request deletion of your account or personal information at any time by emailing [email protected]. We will act on verified deletion requests within 30 days, except where we are required to retain information for legal, accounting, or security purposes.
Security
We rely on role-based access control and database-level row security to keep each organization's data isolated from every other organization's, encrypt data in transit and at rest (our database provider, Supabase, encrypts stored data with AES-256), and limit administrative access to what our infrastructure providers require to operate the Service. Supabase and DigitalOcean, who host our database and application respectively, each maintain their own SOC 2 Type II certification; our other subprocessors maintain their own security programs, described on their respective websites. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
If we become aware of a data breach affecting your personal information, we will notify affected organizations without undue delay and in line with our legal obligations.
If you believe you've found a security vulnerability in the Service, report it to [email protected] rather than exploiting or publicly disclosing it. Give us a reasonable opportunity to investigate and address a good-faith report before disclosing it publicly, and we will not pursue legal action over that research.
Your rights
Depending on where you are located, you may have rights to access, correct, export (data portability), object to or restrict certain processing, or delete your personal information, and, where our processing relies on your consent, to withdraw that consent at any time without affecting processing carried out before the withdrawal. You may also lodge a complaint with a regulator: in Australia, the Office of the Australian Information Commissioner (OAIC); in the EU/UK, your local data protection authority; and California residents have rights under the CCPA/CPRA, including the right to know, correct, and delete their personal information, and to opt out of its sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
We do not use your personal information to make solely automated decisions that produce legal or similarly significant effects about you.
To exercise any of these rights, contact us at [email protected]. We will respond to verified requests within 30 days.
Cookies
We use a small number of cookies: a session cookie set by Clerk to keep you signed in, and analytics cookies set by PostHog to understand product usage. We don't use third-party advertising cookies. You can block cookies in your browser settings, though the Service will not function correctly without the Clerk session cookie.
Children's privacy
ReqTwin is a business tool and is not directed at, or knowingly used to collect information from, children under 16. If you believe a child has provided us with personal information, contact us at [email protected] and we will delete it.
Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the "last updated" date at the top of this page and, where appropriate, notify you directly. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy. This includes changes to the subprocessors listed in "Who we share information with" above; check this page periodically, or contact us, to stay current.
Contact us
Questions about this Privacy Policy or your personal information can be directed to:
Requify Pty Ltd (ABN 13 697 719 572), Melbourne, Victoria, Australia