Terms of Service

These Terms of Service govern access to and use of ProvenTrack, operated by Arimsys Pty Ltd (ABN 62 672 927 454) (“ProvenTrack”, “we”, “us” or “our”). They apply to the website, platform, accounts, dashboards, QR services, digital product passports, APIs, documents, analytics, subscriptions and billing services we make available.

By creating an account, accepting these Terms, or using the Services, you agree to be bound by them. If you use ProvenTrack for a company or other organisation, you represent that you have authority to bind that organisation, and “Customer” includes that organisation. If you lack that authority, do not accept these Terms on its behalf.

Business account users must be at least 18 years old, have legal capacity to enter these Terms, and be authorised to act for the relevant organisation. Registration and organisation information must be complete, current and accurate. Public product passports may be viewed without creating an account.

ProvenTrack is a technology platform for managing products, digital product passports and QR codes; recording origin, supply-chain stages and product journeys; displaying product/category-specific information; uploading images, traceability evidence, certificates and sustainability reports; importing product records by CSV; managing organisation users and permissions; viewing analytics; and administering subscriptions and billing.

Unless expressly stated for a particular service, ProvenTrack is not the manufacturer, seller, importer, regulator, certifier, auditor, laboratory or independent verifier of a Customer’s product, document, calculation or claim.

Customers can choose to publish product information through public URLs and QR codes. Published material may include product and brand details, origin, supply-chain stages and locations, manufacturing dates, ingredients, allergens, nutrition, agriculture or manufacturing information, sustainability metrics (including carbon, water, waste, energy and renewable energy), ethical-sourcing claims, certificates, reports and evidence files.

Public information may be viewed, downloaded, cached, copied, indexed by search services, screenshotted or redistributed by others. Removing it from ProvenTrack may not remove copies held elsewhere. Customers must review publication settings and documents before making them public.

A ProvenTrack QR code is a route to information; it does not by itself prove product authenticity, physical chain of custody, ownership, regulatory approval, product safety, document authenticity or certificate validity. QR codes may be copied, photographed, reproduced or attached to a different item. Users should consider the underlying evidence and other appropriate checks.

You must protect passwords and credentials, maintain accurate account information, promptly notify us of suspected unauthorised access, and take responsibility for activity performed through your account except to the extent caused by our breach of law or these Terms. ProvenTrack uses authentication tokens, session technology and cookies to provide secure account access; see our Privacy & Cookies Policy.

Organisation owners and authorised administrators may approve or revoke users, assign ADMIN, MANAGER or VIEWER permissions, manage organisation details, products, public content, evidence, analytics and subscriptions. Available actions depend on the role and plan. Each organisation is responsible for assigning appropriate permissions, reviewing access regularly and ensuring its users act within their authority.

“Customer Content” includes product and supply-chain data, company details, images and gallery media, certificates, traceability PDFs, sustainability and ESG reports, environmental data, CSV imports and any other records or documents supplied through the Services.

The Customer represents that it owns Customer Content or has all permissions needed to use, upload and publish it; has lawful authority for personal information about other people; does not infringe intellectual-property or privacy rights; and will comply with applicable laws.

Customers retain ownership of Customer Content. The Customer grants ProvenTrack a non-exclusive, worldwide licence for the term of the Services to host, store, process, reproduce, format, transmit, back up and secure Customer Content; publish content the Customer selects as public; operate product passports; provide analytics; and support the platform. This licence is limited to operating, protecting and improving the Services and meeting legal obligations.

Uploaded evidence may include certificates and certification records, audit or laboratory reports, invoices, sustainability/ESG or traceability reports, licences, photographs, temperature logs, compliance records and methodology documents. Uploading or displaying a document does not mean ProvenTrack independently audited or inspected it, certified a product, validated its issuer or calculations, verified environmental claims, or confirmed continuing validity. Labels such as “Company-provided” describe the source, not independent verification.

Do not publish private residential addresses, private phone numbers, signatures, identity documents, employee records, banking information, confidential contracts, trade secrets, health information or government identifiers unless there is lawful authority and an appropriate reason. Customers must inspect and redact files before upload and use publication settings carefully. ProvenTrack is not responsible for a Customer’s failure to remove information it was not authorised to publish.

Customers remain responsible for environmental, sustainability, ethical-sourcing and recycling claims, and all emissions, carbon, water, waste, energy and renewable-energy information. Claims must be truthful, accurate, clear, current, supported by reasonable grounds and appropriate evidence, based on a suitable methodology, appropriately qualified, and not misleading by statement or omission. Estimates, models, assumptions, system boundaries and material limitations should be identified.

ProvenTrack may investigate, restrict or remove content it reasonably believes is unsupported, misleading, unsafe or unlawful. This does not make ProvenTrack the verifier of claims that remain published.

Customers dealing with food, beverages, allergens, agriculture, manufacturing, pharmaceuticals, retail or other regulated goods must meet the rules applying to those goods. ProvenTrack is not a substitute for legally required labels, mandatory warnings, recall notices, medical advice, pharmaceutical instructions or official regulatory information. Public passports should supplement—not replace—required product communications.

The Customer is responsible for reviewing incorrect CSV imports, units, locations, manufacturing or supply-chain information, expired certificates, incomplete journeys, calculations, sustainability metrics and unauthorised changes. Customers must correct materially inaccurate or outdated information promptly.

ProvenTrack records administrative and product activity to support auditing, security, accountability and troubleshooting. Logs may record the actor, organisation, action, affected product, changed fields, timestamp and relevant operational metadata. Customers must not use logs to unlawfully monitor individuals.

Analytics may include QR scans, product and catalogue activity, journey coverage, timestamps, source information, user-agent data and pseudonymised or hashed technical identifiers. Results can be affected by duplicate scans, shared networks, caching, automated traffic, privacy tools and technical limitations. A scan does not necessarily represent a sale, a unique person or verified engagement.

You must not use ProvenTrack for illegal activity, fraud, counterfeit or deceptive passports, greenwashing or misleading claims; upload malware or infringing, confidential or unlawfully obtained information; impersonate others; attempt unauthorised access; circumvent RBAC or plan limits; or scrape personal information unlawfully. You must not interfere with platform security, integrity or availability.

We may investigate and restrict access to or remove Customer Content where reasonably necessary to address law, fraud, safety, security, intellectual-property complaints, misleading claims or a breach of these Terms. Where appropriate, we will consider the circumstances and give the Customer an opportunity to respond, but urgent protective action may occur without advance notice.

ProvenTrack may offer free and paid plans with different product, QR, analytics, user, storage, import or other limits. Current inclusions are shown in the plan or checkout information. We may update plans and quotas on reasonable notice, and may restrict features when a limit is reached or a plan no longer includes them.

Stripe processes subscription payments. ProvenTrack may retain Stripe customer and subscription identifiers, subscription status, billing email, billing period and related metadata. Complete card information entered directly into Stripe is generally handled by Stripe under its terms and privacy policy. Paid subscriptions may renew until cancelled as described at checkout. Stripe’s checkout acceptance is additional to, and does not replace, account-level acceptance of these Terms.

Authorised organisation users may upgrade, downgrade or cancel through available billing controls. A downgrade or cancellation may remove or restrict features after the applicable billing period and may require the Customer to reduce usage. Fees are non-refundable except where stated at purchase or required by law.

Fees are exclusive of taxes unless stated otherwise. The Customer is responsible for applicable GST, duties or taxes, except taxes imposed on ProvenTrack’s net income. Tax invoices and checkout information will be provided where required.

The Services depend on third parties that may include Stripe for payments; AWS for object storage; MongoDB for database infrastructure; Resend for email; Upstash for rate limiting; Cloudflare for security services such as Turnstile; OpenStreetMap/Nominatim and CARTO for maps/geocoding; Google-hosted fonts or resources; and hosting/CDN providers. Their services may be subject to separate terms, availability and privacy practices. We are not responsible for third-party systems beyond our legal obligations.

ProvenTrack and its licensors own the software, interface design, branding, documentation and other platform materials, excluding Customer Content. Customers retain their Customer Content. Third-party maps, fonts, libraries, brands and documents remain owned by their respective rights holders. No rights are granted except those expressly stated.

If you voluntarily provide ideas or feedback about ProvenTrack, you permit us to use it without restriction or payment to improve and develop the Services. This permission does not transfer ownership of Customer Content or confidential information.

We aim to provide a reliable service but do not promise uninterrupted or error-free availability. Maintenance, deployments, outages, internet conditions and third-party failures may affect access. We may add, change or discontinue features, taking reasonable steps to minimise material disruption where practicable.

We may suspend or terminate access for material breach, fraud, non-payment, security threats, unlawful content or misleading public information, or where required by law. Customers may stop using the Services and cancel subscriptions through available controls. Provisions intended to survive—such as ownership, accrued payment obligations, disclaimers and liability terms—continue after termination.

Our Privacy & Cookies Policy explains how ProvenTrack handles personal information, QR analytics, cookies, browser storage, uploaded material and privacy requests. Customers must also meet their own privacy obligations when supplying or publishing information.

We use reasonable technical and organisational measures appropriate to the Services, including protected credentials, authenticated sessions, access controls, upload restrictions, rate limiting and activity records. No internet or storage system is completely secure. Customers must use the security controls available to them and report suspected incidents promptly.

To the extent permitted by law, the Services and Customer-submitted information are provided on an “as available” basis. ProvenTrack does not warrant the accuracy of Customer Content, third-party certificates, QR-linked authenticity, sustainability calculations, maps/geolocation, analytics or regulatory compliance. The Services are not legal, regulatory, engineering, medical, environmental-accounting or other professional advice.

Nothing in these Terms excludes, restricts or modifies any guarantee, right or remedy under the Australian Consumer Law or other law that cannot lawfully be excluded. Where a non-excludable guarantee applies and limitation is permitted, our liability is limited, at our option, to resupplying the relevant services or paying the reasonable cost of having them supplied again.

To the maximum extent permitted by law, neither party is liable to the other for indirect, incidental, special or consequential loss, or loss of profits, revenue, goodwill or anticipated savings. Subject to non-excludable rights, ProvenTrack’s aggregate liability arising from the Services in a 12-month period is limited to the fees paid or payable by the Customer for the affected Services during that period. These limits do not apply where liability cannot legally be limited.

The Customer indemnifies ProvenTrack against third-party claims, losses and reasonable costs arising from Customer Content, intellectual-property infringement, unauthorised disclosure of confidential or personal information, misleading product or sustainability claims, or unlawful misuse of the Services, except to the extent caused by ProvenTrack’s negligence, breach or unlawful conduct.

We may update these Terms to reflect service, legal or operational changes. The current version and date appear above. We will provide reasonable notice of material changes through the platform, email or another appropriate channel and may require renewed acceptance before continued dashboard use. Changes do not create fabricated historical acceptance records.

These Terms are governed by the laws of Victoria, Australia and applicable Commonwealth laws. The parties submit to the courts of Victoria and courts entitled to hear appeals from them, subject to any mandatory rights to bring a claim elsewhere.