Legal
Privacy policy
This policy explains how Erstan Pty Ltd (ABN 98 697 458 914), which operates Changeport ("Changeport", "we", "us"), handles personal information when you visit changeport.ai, use the Changeport application, or connect to it through its API or MCP server. We are based in Victoria, Australia, and handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.
What we collect
Account information
When you sign up or are invited, we collect your name, email address, the name of your account and workspaces, your role, and the sign-in method you use. Sign-in is provided by Clerk, which processes your email address, name, sign-in methods and session details for us.
Content you connect
Changeport exists to work with your NetSuite environments. When you connect an environment, we capture and store its configuration and code: enabled features, custom record types, fields, lists, forms, workflows, roles, saved searches and other definitions, SuiteScript files and their deployments, and files in the File Cabinet folders you select. If you turn on transaction versions, we store the transaction history you choose to track. We also store what your team creates in Changeport: changes, comments, reviews, approvals and audit records. If you connect a GitHub repository, we read and write repository content as you configure. This content can contain personal information, such as names or email addresses in scripts, records or comments. You decide what to connect; we process it on your behalf.
Connection credentials
To reach NetSuite we create and keep certificates and tokens for each environment. Private keys and credentials are stored encrypted and are never shown to users or sent to AI clients.
Billing information
Payments are handled by Stripe. We receive your billing contact, subscription status and a Stripe customer reference. We do not receive or store full card numbers.
Usage and technical information
Our servers record technical details needed to run and secure the service, such as IP addresses, browser type, request times and error details. Changeport also keeps an audit log of actions taken in your account, such as sign-ins, proposals, approvals and deployments.
Messages
If you email us, we keep the message and our reply so we can help you.
Cookies
We use only the cookies the service needs: a session cookie that keeps you signed in, a small cookie that tells our website you are signed in, and the cookies Clerk uses for authentication. We do not use advertising cookies or third-party analytics.
How we use information
- To provide Changeport: capturing and comparing environments, previewing and deploying the changes you approve, and keeping the records the product shows you.
- To secure the service, prevent misuse and investigate problems.
- To send service email, such as invitations, review requests and notifications you can choose in your settings.
- To bill your account and provide support.
- To understand and improve the service using aggregated information.
- To meet legal obligations.
We do not sell personal information, and we do not use your content to train AI models.
AI agents you connect
You can connect AI agents, such as Claude Code, Codex or Erstan, through Changeport's MCP server. An agent acts with the permissions you grant it on the consent screen and can read the environments you select. Content it reads is handled by that agent's provider under your agreement with them. Optional external code review only runs when an environment's owner has turned it on.
Who we share information with
We share information only with service providers that help us run Changeport, under contracts that require them to protect it, and only as needed:
- Microsoft Azure: hosting, database, file storage, keys, logs and service email. Data is stored in Australia (Australia Southeast); the website is delivered from Azure's East Asia region.
- Clerk: sign-in and sign-up (United States).
- Stripe: subscriptions and payments.
- GitHub: only when you connect a repository.
- Google Workspace: our own email, when you write to us.
- Oracle NetSuite: your environments, which Changeport connects to at your request.
We may also disclose information if the law requires it, to protect people or the service, or as part of a sale or reorganisation of our business, in which case this policy continues to apply.
Information sent overseas
Some providers process information outside Australia, mainly in the United States (Clerk, Stripe, GitHub) and East Asia (website delivery). We choose providers that protect information to a standard comparable to the Australian Privacy Principles.
Security
Captured source and connection credentials are encrypted at rest with AES-256-GCM, and every connection uses HTTPS. Access within an account is limited by roles, workspace and environment permissions, and is recorded in the audit log. The collector we install in NetSuite is read-only and denies anything not explicitly allowed. No system is perfectly secure, so please tell us at once if you suspect a problem. More detail is on our Security page.
How long we keep information
We keep account information while your account is open. Captured content and records are kept according to the retention settings in your account. When you ask us to close your account, we delete your content from our live systems within 30 days, unless we must keep something to meet a legal obligation. Backup copies are kept for a limited period for disaster recovery and are then deleted.
Your choices and rights
You can view and update most account information in Changeport, change notification email preferences, and export your environment snapshots. You can ask us for access to the personal information we hold about you, or ask us to correct or delete it, by emailing hello@changeport.ai. If you are in the European Union or the United Kingdom, you also have the rights given by data protection law there, including objecting to processing and data portability. Where Changeport processes content on behalf of your organisation, we may refer your request to that organisation.
If you have a complaint, please contact us first and we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Children
Changeport is a business service and is not intended for anyone under 18.
Changes to this policy
We may update this policy. If a change is significant, we will tell account owners by email or in the product before it takes effect. The effective date above shows when it last changed.
Contact
Erstan Pty Ltd (ABN 98 697 458 914), Victoria, Australia. Email hello@changeport.ai.