Privacy Policy

CJCC Investment Pty Ltd (ABN 21 657 810 181), trading as TradieTally (“TradieTally,” “we,” “us,” or “our”) is committed to protecting your privacy and handling your personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use the TradieTally platform at tradietally.com.au and the TradieTally mobile apps for iOS and Android, including all associated features, integrations, and services.

This policy is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

By creating an account or using TradieTally, you agree to the collection and use of your information as described in this policy.

1. Information we collect

1.1 Account information

When you register for TradieTally, we collect:

• Full name
• Email address
• Phone number (optional)
• Password (stored as a cryptographic hash — we never store or access your plaintext password)

1.2 Business information

To configure your organisation, you may provide:

• Business name
• ABN or ACN
• Business address (street, suburb, state, postcode)
• Business phone and email
• Trade type (e.g., electrician, plumber, builder)
• Business logo
• Bank account details (BSB, account number, account name, PayID) for display on invoices
• GST registration status
• Default payment terms, quote validity, and markup settings

1.3 Business data you create

As you use TradieTally, you create and store business data including:

• Customer and supplier records (names, contact details, addresses)
• Employee records (names, roles, hourly rates, employment type)
• Quotes, jobs, invoices, and associated line items
• Payments and expense records
• Inventory items (SKUs, costs, stock levels)
• Profit margin settings and productivity rates
• Document templates

You retain full ownership of all business data you enter into TradieTally. We do not access, analyse, or use your business data for any purpose other than providing the service to you.

1.4 File uploads

• Profile avatars (max 2 MB, images only)
• Material images (max 5 MB, images only)
• Job attachments (max 20 MB per file — images, PDFs, documents, spreadsheets; executable files are blocked)

In the mobile apps you can attach photos taken with your device camera or chosen from your photo library. Access to the camera and photo library is requested only when you use these features, and photos are uploaded only when you attach them — we never scan or upload your library in the background.

1.5 Payment information

Subscription payments are processed by Stripe. We do not store your credit card number, expiry date, or CVC on our servers.

Stripe may collect and store payment details in accordance with their own privacy policy and PCI DSS compliance standards.

1.6 Technical and usage data

When you use TradieTally, we may automatically collect:

• Browser type and version
• Device type and operating system
• Session activity and page interactions
• Error logs for debugging and stability (on mobile this includes the app version and device model when an error is reported)

We do not currently use third-party analytics or advertising tracking tools (such as Google Analytics or Meta Pixel). If this changes, we will update this policy accordingly.

2. How we use your information

We use your personal information to:

• Provide, operate, and maintain the TradieTally platform
• Process subscription payments and manage your billing
• Send transactional emails (account verification, password resets, subscription confirmations)
• Send quotes, invoices, and other documents to your customers on your behalf when you connect an email account
• Sync your business data with third-party accounting software (Xero) when you connect an integration
• Respond to support requests
• Maintain security, detect fraud, and prevent abuse
• Comply with legal obligations under Australian law

We will never sell your personal information to third parties.

3. Third-party services

TradieTally relies on the following third-party service providers to operate. Each provider only receives the minimum data necessary to perform its function:

Provider	Purpose	Data shared
Supabase	Database, authentication, file storage	All account and business data (encrypted at rest and in transit)
Stripe	Payment processing, subscription management	Email, organisation ID, subscription details (PCI DSS compliant)
Resend	Transactional email delivery	Recipient email address, email content (verification codes, password resets, subscription notices)
Google Gmail API	Send emails on your behalf (user-connected)	OAuth tokens (server-side only), outbound email content
Xero	Accounting data sync (user-connected)	Contacts, invoices, and payments (user-initiated sync only)
Twilio	SMS delivery (booking confirmations, reminders, messages you send to your customers)	Recipient phone number, message content
Google Calendar API	Calendar sync (user-connected)	OAuth tokens (server-side only), event details you choose to sync
Mapbox	Address search and autocomplete	Address text you type into address fields
Vercel	Website hosting and deployment	HTTP requests, access logs
Google Fonts	Typography	Standard HTTP request data (no tracking or cookies)

All third-party providers are required to handle your data in accordance with applicable privacy laws. Some providers are based outside Australia (primarily the United States). Where this occurs, we take reasonable steps to ensure their privacy protections meet the standards required by the APPs.

4. Google API Limited Use Disclosure

TradieTally’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request the gmail.send scope — we cannot and do not read, scan, index, or access the contents of your Gmail inbox or any received emails
• Gmail API access is used solely to send emails (quotes, invoices, and other business documents) on your behalf to your customers
• OAuth tokens are stored securely on our server and are never exposed to the browser or any third party
• We do not use Gmail data for advertising, market research, or any purpose unrelated to sending emails on your behalf
• You can disconnect your Gmail account at any time from Settings, which revokes our access and deletes stored tokens

5. Email integration

TradieTally allows you to connect your own email account (Gmail or a manual SMTP server) to send quotes, invoices, and other documents directly to your customers.

When you connect an email account:

• OAuth authentication tokens are stored securely on our server — they never pass through or are stored in your browser
• We only use the connection to send emails you explicitly initiate from within TradieTally
• We do not read, access, or store any emails from your inbox
• For SMTP connections, your credentials are stored server-side and transmitted over encrypted channels only

You can disconnect your email account at any time from Settings > Email Account. Disconnecting immediately revokes access and deletes stored credentials.

6. Data storage and security

We protect your data through multiple layers of security:

• Encryption in transit — all connections use TLS/HTTPS. HSTS is enforced with a two-year duration.
• Encryption at rest — database and file storage are encrypted by our infrastructure provider (Supabase/AWS).
• Row-level security — database policies ensure each organisation can only access its own data. There is no cross-tenant data access.
• Token isolation — OAuth tokens, API keys, and SMTP credentials are stored server-side only and are never accessible from the browser.
• Security headers — strict Content Security Policy, clickjacking protection (X-Frame-Options: DENY), and MIME type sniffing prevention.
• File upload validation — file size limits, MIME type checks, and executable file blocking on all uploads.
• Access controls — only authorised personnel with a legitimate need can access production systems.

While we take all reasonable precautions, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to promptly addressing any security incidents.

7. Browser storage

TradieTally does not use HTTP cookies or third-party tracking cookies.

We use your browser’s localStorage or sessionStorage to maintain your authentication session:

• If you select “Remember me” during sign-in, your session is stored in localStorage and persists across browser closes
• If you do not select “Remember me,” your session is stored in sessionStorage and is cleared when you close the browser

You can clear this data at any time by signing out or clearing your browser storage.

8. Data retention

We retain your personal information and business data for as long as your account is active and as needed to provide the service.

If you cancel your subscription, your data remains accessible until the end of your current billing period. After that, your data is retained in a read-only state for 30 days to allow for reactivation.

You may request deletion of your account and data at any time (see Section 10). Certain records may be retained longer where required by Australian tax law or other legal obligations (e.g., financial transaction records must be kept for a minimum of five years).

9. Your rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Correct any information that is inaccurate, incomplete, or out of date
• Request deletion of your personal information (subject to legal retention requirements)
• Withdraw consent for optional data processing (e.g., disconnecting email or accounting integrations)
• Lodge a complaint if you believe your privacy has been breached

Most of your data can be viewed and corrected directly within your TradieTally account settings. For access, deletion, or portability requests, contact us at info@tradietally.com.au.

We will respond to all requests within 30 days.

10. Account deletion

You can delete your account and all associated data directly in the TradieTally mobile app (Settings > Profile > Delete account), or by emailing info@tradietally.com.au.

Upon receiving a deletion request, we will:

• Cancel any active subscription
• Delete your account credentials and profile data
• Delete all business data (customers, quotes, invoices, jobs, inventory, expenses, employees, attachments)
• Revoke and delete any connected integration tokens (Gmail, Xero, Google Calendar)
• Remove uploaded files from storage

Financial transaction records (subscription payments, invoices issued) may be retained in anonymised form where required by Australian tax law.

11. Children’s privacy

TradieTally is a business management platform intended for use by adults aged 18 and over. We do not knowingly collect personal information from children. If we become aware that a user is under 18, we will take steps to delete their account and data.

12. International data transfers

Some of our third-party service providers are based outside Australia, primarily in the United States (Supabase, Stripe, Vercel, Resend).

Where personal information is transferred overseas, we take reasonable steps to ensure that the receiving party handles your data in a manner consistent with the APPs and applicable Australian privacy laws.

13. Marketing communications

We may occasionally send you emails about product updates, new features, or educational content related to TradieTally. You can opt out at any time by clicking the unsubscribe link in any marketing email. Transactional emails (account verification, password resets, billing notices) are not affected by unsubscribe preferences.

14. Third-party links

Our platform may contain links to external websites or services. We are not responsible for the privacy practices of these third parties and recommend reviewing their privacy policies separately.

15. Changes to this policy

We may update this Privacy Policy from time to time. The updated version will be posted on this page with a revised effective date.

For material changes that affect how we handle your data, we will notify you via email. Continued use of TradieTally after changes take effect constitutes acceptance of the updated policy.

16. Contact us

If you have questions about this Privacy Policy, wish to exercise your rights, or need to make a privacy complaint, contact us:

CJCC Investment Pty Ltd, trading as TradieTally

Email: info@tradietally.com.au

Website: www.tradietally.com.au

Complaints will be investigated and responded to within 30 days. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).