Version 3.1 · Last updated 29 September 2026 · Bluegrass Pastoral Pty Ltd
(a) Bluegrass Pastoral Pty Ltd (ACN 699 118 226) trading as AgCert (Bluegrass, we, our and/or us) provides farm record-keeping software to farm businesses (Services) through the AgCert website, web application and mobile applications (together, AgCert). References in this Policy to the Business are to our AgCert software business, and not to any other business carried on by us.
(b) Although we are not bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles which are set out in the Privacy Act (Australian Privacy Principles), we take reasonable steps to protect the privacy of individuals (you, your and/or yourself) while providing Services, in connection with AgCert and otherwise in relation to the operation of our business. If we become bound by the Privacy Act, we will comply with it and update this Policy.
(c) This Policy contains information about:
(i) how we collect, store and use Personal Information;
(ii) how long we keep Personal Information;
(iii) how you may access your Personal Information held by us;
(iv) how to seek the correction of your Personal Information held by us; and
(v) how to make complaints about any privacy-related concerns.
(d) If we change this Policy, we will display the updated Policy in AgCert and we may also advise you in writing. If you object to any changes, you may contact us, and we will attempt to resolve your complaint within a reasonable time.
(e) By using our Services or AgCert or otherwise supplying us your Personal Information, you consent to our collection, use, disclosure, storage, destruction and otherwise handling of Personal Information, in accordance with the terms of this Policy.
(f) If you provide a pseudonym to us or wish to remain anonymous, you can browse and view the public pages of AgCert without restrictions; however, you cannot create an account or use the application without providing the Personal Information described in section 3, and our interactions with you in relation to the Business may be limited.
(g) We may require that you accurately identify yourself so that we can take reasonable steps to provide accurate information as part of providing our Services (for example, we require our customers, suppliers, and associates to provide accurate contact details).
We may collect Personal Information through the following avenues:
(a) where you create an account, including where you do so using a third-party sign in service such as Google or Apple;
(b) where you complete the first time setup for the application, or enter, edit, export or delete a record;
(c) where you complete a form or registration process in relation to our Services, including a contact form or an enquiry registering your interest in our Services;
(d) where you have inquired or otherwise communicated with us in person, over email or phone;
(e) where a business takes out a paid subscription, in which case some Personal Information is collected by our payment provider and passed to us;
(f) where you are interacting with AgCert, through the use of cookies and browser storage (see section 11);
(g) through our use of AI Systems, where you submit a photograph of a product label for automated reading (see section 10); and
(h) where a customer records your details in its farm records, for example as an operator, a visitor, a vendor, a buyer or a transport operator, in which case we collect Personal Information about you from that customer rather than from you (see section 3(d)).
(a) The kinds of Personal Information we may collect from you will depend on who you are (e.g. the account holder for a customer business, a person whose details a customer has recorded in its farm records, a supplier, or a prospective employee or contractor) and the nature of your interaction with us.
(b) We collect, use and store the following types of Personal Information about current, former and prospective customers:
(i) Account and sign in information: name, email address, and password, which we store only as a secure hash and never in a readable form. Where you sign in using Google or Apple, we receive the name and email address held by that account (which, for Apple, may be a private relay address) and a link to it. We do not receive your Google or Apple password.
(ii) Farm and business information: your name, registered business name if you provide one, farm name, State, the names of the operators and employees you add to your account, your properties and their Property Identification Codes, your paddocks, and the livestock types and products you select.
(iii) Farm records: the records you enter and everything contained in them, including dates, properties and paddocks, livestock and numbers of head, products used, batch numbers and expiry dates, rates, quantities and areas, weather conditions, National Vendor Declaration numbers, the operator who carried out the work, the other people described in section 3(d), and notes. Where you edit a record, the record is updated and the earlier version is not retained. The record keeps the date of the change, the reason for it and who made it.
(iv) Location and weather information: the weather station you nominate, which we use to display conditions and forecasts and to populate your records.
(v) Photographs of product labels: where you use the label scanning feature, the photograph you take, which is transmitted for automated reading and is not retained by us after the scan.
(vi) Payment and subscription information: where a business takes a paid subscription, card details are provided directly to our payment provider. We do not see, handle or store your card number or security code. We receive a customer reference and subscription status.
(vii) Contact and support information: your name, email address, telephone number if you provide one, a description of your operation if you provide one, and the content of your message.
(viii) Technical information: standard server logs, including your IP address, browser type and the pages you access, together with sign in times, account status, and a log of label scans (time, outcome and processing usage).
(ix) Introductory access marker: a one-way, irreversible marker derived from your email address, together with the date it was first used, which we use to stop the same address being used to claim introductory access more than once. The marker cannot be used to identify or contact you and is not linked to any of your data.
(c) We also collect, use and store:
(i) for current, former, and prospective suppliers: contact details, details about representatives, business information such as banking details, pricing and payment details, and other Personal Information that you may voluntarily provide to assist us to engage in a business relationship with you;
(ii) for prospective employees or contractors: contact details, dates of birth, titles and qualifications, photographs, voice and video recordings, background and reference information, and other Personal Information relevant to employment considerations;
(iii) information about our staff and representatives as required in the normal course of human resource management and business operations; and
(iv) other Personal Information that you may voluntarily provide to us to assist us to conduct our Business and provide our Services.
(d) Personal Information about other individuals. Some records ask for the details of a person other than the account holder. Examples are the operators and employees a business adds to its account, the operator who applied a treatment or a chemical, a visitor to the property and their company and vehicle registration, and the vendor, buyer and transport operator on a stock movement or dispatch. Where those details are recorded:
(i) we store them as part of the customer's records, so that its records are complete. The operator on each record is stored as entered at the time of the work, and renaming or deactivating an operator does not change records already saved;
(ii) we do not contact those individuals, we do not send them marketing, and we do not use their details for any purpose other than storing and displaying the customer's records to the customer and providing support to the customer;
(iii) the customer is responsible for making those individuals aware that their details are recorded in AgCert, and for being able to show them what is recorded if they ask; and
(iv) if an individual contacts us about details a customer has recorded, we will tell them that the record belongs to that customer and refer them to it, unless the law requires otherwise.
(e) Where:
(i) you wish to receive our Services, some of the Personal Information we collect from you may be sensitive information as defined in the Privacy Act. We will only collect sensitive information with your consent and through secure methods. Our current assessment is that AgCert does not collect sensitive information, because treatment records relate to animals rather than to individuals; and
(ii) you wish to supply goods or services to us or otherwise enter a commercial relationship with us, you must provide accurate Personal Information as it is impracticable for us to engage with you in this manner, without it.
(a) We will not sell or trade your Personal Information to any third party, organisation or individual without your consent, except as part of a transfer of our business described in section 13.
(b) Subject to the terms of this Privacy Policy, we may use and disclose your Personal Information for the following purposes:
(i) to create and operate your account and allow you to sign in;
(ii) to store, display and allow you to edit, export and delete your farm records;
(iii) to calculate withholding periods, export slaughter intervals and clearance dates from the product data and the dates you enter, and to display the resulting alerts;
(iv) to display weather conditions and forecasts and populate them into your records;
(v) to read the product labels you photograph, so that you do not have to enter the batch number and date manually;
(vi) to generate the reports and exports that you download;
(vii) to administer subscriptions, and to issue receipts and renewal reminders;
(viii) to send account emails, including sign up confirmation codes, password resets, a welcome email and reminders before introductory access ends;
(ix) to contact you in connection with the Services, to respond to feedback and complaints, and to provide support, which may include accessing your account and records as described in section 5(b)(vii);
(x) to keep the Services and AgCert operating, secure and free from misuse;
(xi) for direct marketing purposes with your consent (see section 9 below);
(xii) to notify you of important changes to AgCert or this Policy;
(xiii) to understand customer trends and patterns, using totals and patterns that do not identify any individual, so we can improve the Services; and
(xiv) for any other purpose for which you give your consent.
(c) Subject to the terms of this Privacy Policy, we may also disclose your Personal Information:
(i) to third parties used by us to assist us to provide you with our Services, including our contractors, bookkeepers and professional advisors;
(ii) to technology and hosting providers and technology service providers, providers of AI Systems, payment providers, weather data providers, email delivery providers, form handling providers and, where applicable, marketing platforms, who may store or process data on our behalf. The providers we currently use are named in section 7;
(iii) to lessen or prevent serious threats to the health and safety of an individual or the general public;
(iv) to assist in locating missing individuals;
(v) to any duly authorised law enforcement officer, or any other person, authorised by any law to receive your Personal Information from us; and
(vi) where otherwise permitted or required by law.
(d) We will not disclose sensitive information to any third party unless we have your consent or are otherwise permitted or required by law to do so.
(e) For clarity, we do not send your farm records to Meat & Livestock Australia, the Livestock Production Assurance program, an auditor, a processor, a buyer or any other person. Reports and exports are generated for you to download and share yourself, or by us for you when we provide support. We are not affiliated with Meat & Livestock Australia.
(a) Where we hold your Personal Information, we will hold it by storing it electronically, by exporting it onto a computer or in hard copy.
(b) We take reasonable steps to protect your Personal Information from misuse, interference and loss, as well as unauthorised access, modification or disclosure, through the use of secure systems, restricted access, encryption and other safeguards appropriate to the nature of the information. Those steps include:
(i) encryption of all data transmitted between your device and the Services using TLS;
(ii) row level security on the database, so that your records can be read only by your account;
(iii) hashing of passwords, which are never stored in a readable form;
(iv) authenticated sessions with short lived tokens for access to the interface behind the application;
(v) restriction of administrative database access to server side functions;
(vi) encryption of data at rest using AES-256 encryption provided by our infrastructure providers; and
(vii) restriction of internal access to customer accounts and records to authorised people within our business. They access an account only to provide support (including viewing the account as the customer sees it, and generating reports and exports of its records for the customer), to review or adjust the account's status, to investigate a problem, to maintain the database, or where required by law, and only as far as that purpose needs. We keep a record of when an account is viewed in this way and of each change we make to its account status or settings. We do not create, edit or delete a customer's records.
(a) We keep your account details and your farm records for as long as your account remains open.
(b) You may delete your account at any time, from the Account screen in the app (Delete Account) or by emailing us from the address at which your account is registered. You do not need an active subscription in order to delete your account, and any subscription is cancelled at the same time. Deletion is permanent and removes your farm records, operators, properties and paddocks, product and livestock lists, label scan log, profile and login. Your farm records may be needed for an audit, a residue enquiry, a buyer or processor, or a quality assurance program such as LPA, so you should export them before you delete your account.
(c) Deletion inside the app takes effect immediately. A deletion request sent by email is actioned within seven days of the request being verified.
(d) After deletion, Personal Information may remain in routine encrypted backups for up to 30 days until those backups roll over.
(e) Our payment provider keeps its customer and payment records, and we retain payment and taxation records, for the period required by law, generally seven years.
(f) We retain support emails and contact form messages for up to two years after our last contact with you, unless a longer period is required for a legal reason.
(g) We retain server logs for three days.
(h) The record described in section 5(b)(vii) of when we viewed or changed an account is retained after account deletion. It identifies the account by an internal reference and, for a change to a subscription, by our payment provider's subscription reference. It does not contain your farm records, and we keep it for as long as we need it to show what support actions were taken.
(i) The introductory access marker described in section 3(b)(ix) is retained after account deletion. It is not linked to any of your data and cannot be used to identify or contact you.
(j) We may retain totals and patterns that do not identify you or your operation, such as the number of records logged across all customers. Where we no longer require Personal Information and we are not required to retain it, we destroy it or de-identify it.
(a) From time to time, we use third-party service providers for digital cloud storage, web hosting, AI processing, payment processing, email delivery, form handling, weather data or other technology-related services in connection with providing our Services. We may disclose your Personal Information to these third-party service providers who may operate outside Australia or operate in Australia with servers located outside Australia (International Operators). We currently use Supabase (database and authentication), Vercel (application and website hosting), Stripe (payment processing), Google and Apple (sign in), Anthropic (automated reading of product label photographs), Resend and VentraIP (email delivery), Formspree (website contact forms), Google Fonts (website typography), WillyWeather and Open-Meteo (weather data).
(b) Our database, which holds your account and your farm records, is hosted by Supabase in the Oceania (Sydney) region, ap-southeast-2, in Australia. Our application and website are hosted by Vercel, which may process requests in the United States. If we change the region in which the database is hosted, we will update this Policy.
(c) As some of our third-party service providers operate globally, we cannot say with certainty where their servers are located or the countries out of which they operate at any given time. Further, these locations may be subject to change without notice to us.
(d) Australian Privacy Principle 8.1 requires an entity that is bound by the Privacy Act to take reasonable steps, before disclosing Personal Information to an overseas recipient, to ensure that the recipient does not breach the Australian Privacy Principles. That requirement does not apply to us. We nonetheless take reasonable steps of that kind when selecting our providers. It is not always possible for us to ensure that multinational companies will not handle Personal Information in a manner that would be inconsistent with the Australian Privacy Principles.
(e) This Policy is governed by Australian law. That does not displace any right you have under a data protection law of your own country that cannot be excluded, restricted or modified by agreement. If you are not comfortable with your Personal Information being collected and held as described above, please do not use the Services.
(a) This Policy applies solely to Personal Information collected with regard to providing our Services, the operation of AgCert and otherwise in connection with the operation of our business.
(b) We are not responsible for the collection of information or privacy practices of third-party websites that may be linked to from AgCert from time to time, or social-media platforms that may be accessed via links in AgCert or in our emails.
(c) We refer you to the privacy policies and terms of use of the operators of any linked third-party websites.
(a) We send you communications that form part of the Services, including sign up confirmation codes, password resets, a welcome email, reminders before introductory access ends, receipts, renewal reminders, and notices of changes to AgCert or to this Policy. You cannot opt out of those communications while you hold an account, because they form part of the Services.
(b) Your Personal Information may also be used to offer you new goods and services, notify you of new developments to our existing goods and services, or any other promotional communication related to our goods and services or other matters relating to our business.
(c) Where we send you a marketing communication, we will only do so where you have requested it or consented to it, each message will identify us and how we can be contacted, and each message will contain a functional unsubscribe facility. If you unsubscribe we will cease sending within five working days.
(d) If you do not wish to receive direct marketing communications from us, you may opt out at any time by clicking the unsubscribe link on email communications sent to you (if available) or by contacting us (see section 15). You may also ask us at any time to tell you the source from which we obtained your details.
(e) We do not serve advertising in AgCert, and we do not provide your Personal Information to advertising networks or targeted marketing facilitators.
(a) We use AI Systems to assist in the operation of our business and our Services, including the label scanning feature in AgCert. Where you use that feature, a photograph of a product label is transmitted to a third-party AI System for automated reading of the batch number and the expiry or manufacture date. From time to time it may also be necessary to input Personal Information into AI Systems for document preparation, communication, analysis and administrative functions.
(b) We take reasonable steps to ensure that the inputting of any Personal Information into AI Systems is consistent with the Australian Privacy Principles and with the terms of this Policy.
(c) In connection with our reasonable business purposes, you agree that we may input Personal Information supplied by you into the following AI Systems:
(i) Anthropic's application programming interface, which we use for the label scanning feature;
(ii) any enterprise-level AI Systems that operate under commercially reasonable confidentiality and data protection standards (for example, systems where data is not used to train public models);
(iii) AI Systems developed solely for our business which are hosted on a private, secure server; and
(iv) other AI Systems agreed by you in writing from time to time or permitted by law.
(d) We will not use Personal Information for Data Training of public or third-party AI Systems.
(e) We take steps to ensure that:
(i) AI Systems used by us are subject to encryption and confidentiality protections;
(ii) results produced by the label scanning feature are presented to you for checking against the physical product label before they are saved, and you should always check them, because the scan is a convenience and not a source of truth;
(iii) where AI Systems are used to assist with processing, communication, content generation or data analysis, we apply Human Review to verify accuracy and appropriateness; and
(iv) subject to our rights to input Personal Information into AI Systems under this Policy or otherwise, Personal Information is anonymised or de-identified where practicable before inputting into AI Systems.
(f) AgCert does not make an automated decision about you that could significantly affect your rights or interests. Withholding periods, export slaughter intervals, clearance dates and Delta T values and ratings are calculated from product data, dates and weather data. They are reference outputs for you to act on, and they are not decisions about you.
(g) You may contact us at any time to inquire about our use of AI Systems and how your Personal Information may be processed by them.
(a) We collect device information, including information about your web browser, IP address, the individual pages or screens that you view, and information about how you interact with AgCert, using server logs.
(b) AgCert uses strictly necessary first-party cookies to keep you signed in, and your browser's local storage to retain your preferences, such as your theme. We do not use tracking cookies, we do not use third-party analytics, and no advertising network has access to your activity within AgCert.
(c) You can modify your browser to prevent the use of cookies or browser storage, but if you do this, our Services and AgCert may not work properly.
(a) You should be aware that there are inherent risks associated with the transmission of information via the Internet. Data-security measures can never be guaranteed. This means that while we take steps to protect your Personal Information, we cannot guarantee its security.
(b) If you suspect any misuse, loss, unauthorised access, modification, or disclosure of your Personal Information, please contact us immediately.
(c) If Personal Information we hold is lost, or is accessed or disclosed without authorisation, and that is likely to result in serious harm to you, we will notify you as soon as we reasonably can, tell you what has occurred and what information was involved, and tell you what steps you can take in response.
If we are involved in a sale, merger, consolidation, change in control, transfer of substantial assets, reorganisation, or liquidation, we may, in our sole discretion, transfer, sell or assign your Personal Information collected by us to one or more relevant third parties. This section is the exception referred to in section 4(a).
Our Services are intended for individuals aged 18 years and over. We do not knowingly collect Personal Information about any individual under the age of 18. If you believe that an individual under the age of 18 has provided us with Personal Information, please contact us and we will delete it.
(a) If you:
(i) have any questions about this Policy;
(ii) wish to request access to any Personal Information that we hold;
(iii) wish to be de-identified or have your Personal Information deleted;
(iv) wish to correct or update your Personal Information; or
(v) wish to make a complaint or discuss any other privacy concerns you may have,
please contact us at:
Email: Attention: The Privacy Officer, help@agcert.com.au
Post: Attention: The Privacy Officer, PO Box 772, Cowes VIC 3922
(b) Much of your Personal Information is available to you within AgCert and you can change it yourself in Settings. You can also export your farm records at any time from Reports in the app, as PDF or Excel.
(c) We will respond to a request for access or correction within 30 days. If we are unable to provide what you have asked for, we will tell you why in writing. If Personal Information we hold about you is inaccurate, out of date or incomplete, we will correct it, and if we do not agree that it is inaccurate we will record your view alongside the record.
(d) We reserve the right to charge for reasonable expenses that we may incur in preparing and sending you a copy of your Personal Information.
(e) If you believe we have breached our obligations under this Policy or the Australian Privacy Principles, please give us the opportunity to resolve matters by contacting us first, in writing by email or by post. Once we have received a complaint, we will acknowledge it within 5 business days and will try to work with you to resolve the matter within 30 days. If we require longer we will tell you why and when you can expect an answer. The steps we may take to resolve the matter include:
(i) we may request further information from you. This will enable us to investigate the complaint and determine an appropriate solution;
(ii) we will discuss options for resolution with you. If you have suggestions about this matter, please raise these with our Privacy Officer; and
(iii) where necessary, we will conduct an investigation and endeavour to do so within a reasonable time. We may need to consult others to progress the investigation.
Artificial Intelligence (AI) means a machine-based system that, for explicit or implicit objectives, infers from the input it receives how to generate outputs (such as text, images, content, recommendations or decisions) that can influence physical or virtual environments.
AI Systems means software, platforms or tools using artificial intelligence - including generative AI, image generators, transcription tools or data-analysis assistants.
AI Generated Outputs means material, content or information created wholly or partly by us using an AI System.
Data Training means the process of using data (including text, images or other content) to train, refine or improve an AI System's performance.
Human Review means review, editing and approval by a qualified person of AI Generated Outputs before they are used, published or provided to any person.
Personal Information has the meaning as defined in the Privacy Act.
Bluegrass Pastoral Pty Ltd
Support and notices: help@agcert.com.au
Postal address: PO Box 772, Cowes VIC 3922