Privacy Policy

Tradie Deck is a product brand of Guestii Pty Ltd (ABN 60 685 887 094), an Australian proprietary limited company. References to "we", "us", and "our" throughout this Privacy Policy mean Guestii Pty Ltd as the operator of the Tradie Deck service. We provide software that helps sole-trader tradespeople ("Tradies") manage jobs, customers, time, materials, invoices, and bookings.

This policy explains how we handle personal information about both Tradies who subscribe to Tradie Deck and the customers of those Tradies whose details enter our systems (collectively, "Personal Information").

We're subject to the Australian Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). If we ever update this policy we'll change the "Last updated" date above and announce material changes in-app.

From Tradies who sign up:

• Name, email address, password (hashed, never stored in plaintext).
• Business name, ABN, phone number, hourly rate, working hours and address (if provided).
• Connection tokens for third-party services you authorise (e.g. Xero — refresh token stored encrypted at rest using AES-256-GCM).

From customers entered into Tradie Deck:

• Name, contact details (phone and/or email) and job address as supplied by the Tradie or by the customer through a booking link.
• Job-related metadata: scheduled time, notes added by the Tradie, materials listed, photos uploaded by the Tradie, invoice totals.

Automatically:

• Standard server logs (IP address, browser type, timestamps) retained for up to 30 days for security and debugging.
• Approximate geolocation derived from your IP address (country/region) for analytics aggregation only.

• To deliver Tradie Deck's features — for example, sending you a booking-request notification when a customer submits a request.
• To send transactional emails (account confirmation, password reset, booking receipts).
• To process payments and invoicing through Xero (only when you connect your Xero account).
• To monitor and improve the service, including diagnosing problems and aggregate usage analytics.
• To comply with legal obligations — for example, responding to lawful requests from Australian government bodies.

We don't sell Personal Information to third parties, and we don't use it for advertising-based targeting.

To deliver Tradie Deck we use the following sub-processors:

• Supabase (USA / EU regions) — database hosting, authentication, file storage.
• Vercel (USA / Australia regions) — web app hosting.
• Resend (USA) — transactional email delivery.
• Xero (Australia / New Zealand) — when you explicitly authorise the integration. Only invoice and contact data you choose to send is shared.
• Google Maps Platform — address autocomplete suggestions. Address strings you type are sent to Google. Google may log these requests under its own privacy policy.

Each sub-processor is bound by contractual data-protection commitments. Some may store data outside Australia; by using Tradie Deck you consent to that cross-border storage. We'll publish an updated sub-processor list whenever it changes.

• All traffic to and from Tradie Deck is encrypted in transit (HTTPS / TLS 1.2+).
• Database connections use TLS. Backups are encrypted at rest.
• Xero refresh tokens are encrypted at rest with AES-256-GCM keyed by a secret held only on our servers.
• Customer photos are stored in a private storage bucket and served via signed URLs that expire after one hour.
• Access to production data is limited to the operator and is gated by multi-factor authentication.

No system is perfectly secure. If a breach affecting your Personal Information ever occurs we'll notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Under the Privacy Act you have the right to:

• Ask for a copy of the personal information we hold about you.
• Ask us to correct information that is inaccurate or out of date.
• Ask us to delete your information (subject to legal retention requirements).
• Withdraw consent for optional uses (e.g. marketing communications, if any are sent in future).
• Complain to the OAIC if you believe we've mishandled your information (oaic.gov.au).

To exercise any of these rights, email hello@tradiedeck.comwith the subject line "Privacy request". We'll respond within 30 days.

• Account data is kept while your subscription is active and for 12 months after cancellation, then deleted unless legally required to retain.
• Invoices and payment records are kept for 7 years to meet Australian tax recordkeeping obligations.
• Server logs are retained for up to 30 days.
• Booking-link requests and intake form submissions are kept for 24 months.

Tradie Deck uses cookies only for authentication (session cookies set by Supabase) and to remember your OAuth flow state when connecting Xero. We don't use third-party tracking, advertising, or analytics cookies.

Questions, requests, or complaints: hello@tradiedeck.com