Privacy Policy

1. Two kinds of information

About you as a user — your account, your memberships and your use of the Service. We are responsible for this information.

In your organisation's records — the personal information your organisation puts into the Service about other people: its clients' and builders' contacts, its staff, its suppliers and anyone named in its quotes, contracts and claims. Your organisation decides what is collected and is responsible for it; we handle it on your organisation's behalf, only to run the Service for it (Terms of Service, clause 11). If you are one of those people and want to access or correct that information, please contact the business that holds it — we will help it respond.

2. What we collect

Account. When you sign in through an identity provider we support, we receive your name, email address and a sign-in identifier from it. We do not receive your password.

Acceptance records. Which version of the Terms of Service and of this Privacy Policy you accepted, and when.

Organisation records. Clients and contacts, rate cards, quotes, jobs, contracts, variations, progress claims, retention and bank guarantee records, the members invited and their roles, and the settings of the organisation.

Audit history. A record of who changed what, and when, in your organisation (Terms, clause 9).

Connected services. For a connected accounting service, the contacts, tracking options, settings, invoices and attachments we read or write on your organisation's behalf (Terms, clause 6), and the details needed to keep the connection (encrypted access tokens and the organisation's name). For connected file storage, the folders and file references we use (not the files' contents, which stay in your storage), and encrypted access tokens.

API keys. A key's name, scopes, when it was made and last used. We keep only a one-way hash of the key itself.

Operational logs. Ordinary server logs (times, network addresses, requests and errors), for security and troubleshooting.

3. How we use it

To provide the Service: sign you in, show your organisation its records, produce documents and exports, keep connected services in step, and support you. To record your acceptance of these documents. To tell you about your organisation and changes to the Service. To keep the Service secure and prevent misuse. We do not sell personal information, and we do not use it for advertising or profiling.

4. Where it is held

The application and its database run on servers in Australia — either infrastructure we operate ourselves or an Australian region of a cloud hosting provider; we may move between the two without changing what is held or where it is held. Documents are written to your organisation's own file storage (Terms, clause 7). Backups are encrypted and held in Australia.

Some providers we rely on may hold limited information outside Australia: identity providers that handle sign-in (such as sign-in records), and the provider that delivers the emails the Service sends (such as the recipient's address and the message). Services your organisation chooses to connect — its accounting software and file storage — hold its data under its own accounts and their own policies, and may store it outside Australia.

5. Who can see it

Members of your organisation, according to the roles and job access its owners set. Our own staff, only as needed to operate and support the Service. The providers in section 4, to the extent they need to perform their part. We disclose personal information to anyone else only with your organisation's direction, or where the law requires or authorises it.

6. Security

Access to the Service requires sign-in through a supported identity provider. Each organisation's records are kept apart from every other organisation's. Tokens for connected services are encrypted, and API keys are stored only as hashes. Data travels encrypted between your browser and the Service. If we become aware of a data breach likely to result in serious harm, we will act under the Notifiable Data Breaches scheme, including notifying affected organisations, individuals and the Office of the Australian Information Commissioner where required.

7. How long we keep it

• Organisation records: for as long as the organisation exists. They are deleted when it closes, or 30 days after its plan lapses without renewal (Terms, clauses 5 and 18).
• Audit history: six months in the application; each completed month is then filed to your organisation's file storage and removed from the application. If no file storage is connected, nothing is filed: it stays in the application for six months and is then deleted.
• Documents: not held by the Service — they are written to your organisation's own cloud storage, or downloaded, as they are made. We keep only your templates and logo.
• Backups: encrypted, rolling off over a period of months.
• Account and acceptance records: for as long as your account exists, and afterwards as needed for our legal, tax and business records (generally seven years).
• Operational logs: a rolling period of a few months.

8. Your choices and rights

You can ask what personal information we hold about you and have it corrected. You can ask us to close your account, subject to our need to keep basic business records. Your organisation can disconnect a connected service at any time, export its records, and ask us to close it. Contact support@subman.com.au; we aim to respond within 30 days. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

9. Cookies

The application uses a session token to keep you signed in and remembers a few display preferences in your browser. This website sets no cookies and runs no analytics.

10. Changes

We may update this policy. You will be asked to accept a new version when you next sign in after it takes effect, and material changes are announced at least 30 days ahead (Terms, clause 20).

11. Contact

EMJ Services Pty Ltd, ABN 16 626 783 551, Sydney NSW — support@subman.com.au