Privacy policy

Account information. When you create an account, we collect your email address, first name, last name, and a profile image if provided via the authentication provider.

Project data. We store the renovation project information you enter into the toolkit, including budget line items, compliance checklist progress, handover vault records, and project details. This data is associated with your account and stored securely in our database.

Payment information. Payment processing is handled by a third-party payment processor. We do not store your card number, CVV, or full payment details. We retain a record of the transaction amount, date, and a partial card reference for billing purposes.

Usage data. We use Google Analytics 4 to collect information about how visitors use our website, including pages visited, time spent on pages, scroll depth, and general traffic sources. Google Analytics uses cookies to distinguish visitors and collects IP addresses, which Google may use to determine approximate geographic location. This data is processed by Google in accordance with Google's Privacy Policy. We do not link analytics data to your account or personal identity.

Communications. If you contact us via the support form, we retain your email address, name, and message content to respond to your enquiry.

Marketing preferences. When you create an account, we ask whether you would like to receive marketing communications. We record your choice and, where you have opted in, use your email address to send you news, tips, and offers about the Service. You can withdraw this consent at any time (see "How we use your information" below).

We use the information we collect to:

• Provide, operate, and maintain the Service
• Authenticate your identity and maintain the security of your account
• Process payments and verify access entitlements
• Respond to support enquiries and provide customer service
• Send transactional emails (purchase receipts, account notifications)
• Send marketing communications (news, tips, and offers) where you have opted in — you can opt out at any time using the unsubscribe link in those emails or by contacting us via the Help Centre
• Improve and develop the Service based on anonymised usage patterns
• Comply with legal obligations

We do not sell your personal information to third parties.

Your data is stored on servers located in a secure cloud environment. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

Authentication is handled by our self-hosted Better Auth system using email and password. Passwords are never stored in plain text — they are salted and hashed. Session tokens are stored server-side and expire automatically.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

Data breaches. We comply with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth). If a data breach occurs that is likely to result in serious harm to affected individuals, we will assess the breach and notify those individuals and the Office of the Australian Information Commissioner (OAIC) as required.

Strictly necessary cookies. We use session cookies to maintain your login state. These are required for the Service to function and cannot be disabled if you wish to use authenticated features.

Analytics cookies. We use Google Analytics 4, which sets first-party cookies (including _ga and _ga_*) to distinguish visitors and measure site usage. These cookies persist for up to two years. They are only set if you accept analytics via our cookie banner — analytics storage is denied by default until you consent, and you can decline. Your choice is remembered on this device.

We do not use advertising cookies or cross-site tracking cookies.

We use the following third-party services:

• Email delivery: Transactional and account emails (verification, password reset, receipts) are sent via a third-party email delivery provider, subject to that provider's privacy policy.
• Payment processor: Processes payment transactions. Your payment information is subject to that provider's privacy policy.
• Google Analytics 4 (Google LLC): Provides website analytics. Google may process data collected via analytics cookies on servers in the United States. You can review Google's privacy practices at policies.google.com/privacy.

Overseas disclosure. Some of our service providers, including our payment processor, analytics provider, and our authentication and hosting providers, may store or process your personal information overseas, including in the United States. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles.

Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Request access to the personal information we hold about you
• Request correction of inaccurate or incomplete information

In addition to your statutory rights above, we also offer to:

• Delete your account and associated personal data on request
• Let you withdraw consent where processing is based on consent

To exercise these rights, contact us via the Help Centre. We will respond within 30 days.

Making a complaint. If you believe we have breached the Australian Privacy Principles, you can make a complaint by contacting us via the Help Centre. We will acknowledge and investigate your complaint and respond within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.