Privacy Policy

(a) Our customers, the trade and service businesses and their team members who sign up; and (b) the people you deal with through the Service: your customers, your workers, and subcontractors you send work offers or safety documents to. For (b), you decide what is collected and why, and we process it on your behalf as your service provider.

• Account & business info: name, email, phone, business name, ABN, branding, and login credentials (stored securely; passwords are hashed).
• Billing info: processed by Stripe; we don’t store full card numbers.
• Your business data: bookings, jobs, quotes, invoices, customer records, photos, notes, schedules, safety documents and condition reports you create (including photos in them), and (if you use ONARA Books) financial records you enter.
• Workforce & subcontractor records: your team members’ names and contact details; work offers you send subcontractors (their name, mobile, email and, if they enter it, their ABN); and safety records such as SWMS sign-ons and daily confirmations, which are names with timestamps.
• Usage & technical data: log data, device/browser info, IP address, approximate location, device push tokens (a unique identifier for your phone or tablet, used to send you app notifications) and the device platform, and cookies needed to run the Service.
• Free tools and guides: if you use one of our free calculators or the starting-out plan builder, we record the answers you choose (for example the trade and state you select), without your name. If you ask us to email you the results or your plan PDF, we also keep your email address and any name or business name you entered. See section 14.

We collect information directly from you (when you sign up, set up your business, or use the Service), automatically (through your use of the Service), and from third parties such as our payment provider and the Australian Business Register (when we verify an ABN you provide). Some information also comes from the people you deal with: for example, a subcontractor you send a work offer to can accept it and enter their own details (such as their ABN) on a secure page we host for you, and your workers can sign on to safety documents from their own logins. Where reasonable and practicable, you may deal with us anonymously or using a pseudonym, though we generally can’t provide the Service without account details.

To provide, maintain, secure and improve the Service; to process payments and manage subscriptions; to provide support; to send you service messages; to send, on your instruction, messages to your customers; to detect and prevent misuse; and to meet our legal obligations.

We may send you information about features and offers. You can opt out at any time using the unsubscribe link or by contacting us. We do not use your customers’ information for our own marketing.

We don’t sell personal information. We share it with service providers who help us run the Service and are bound to protect it, including: Supabase (database & file storage), Vercel (application hosting and, on our public website, site analytics), Stripe (payments), Resend (email), Twilio (SMS), Google Maps (mapping & addresses), Google Firebase Cloud Messaging (delivering app push notifications), and Google Ads & Analytics and the Meta (Facebook) Pixel for advertising and site analytics (these set cookies and measure our ads).

To measure sign-ups and ad performance, we also share limited conversion events directly from our servers with Meta (via its Conversions API), including a securely hashed (one-way) version of your email address, your IP address and browser type. This works alongside the browser pixel so conversions are still measured when cookies or the pixel are blocked.

Where you choose to connect an integration, we share the relevant data with it on your instruction. For example, if you connect Xero, we send your invoices (line items, quantities, amounts, reference and date) and the related customer’s contact name to your Xero organisation.

When you sign up, we verify the ABN you provide against the Australian Business Register (ABR) ABN Lookup service (abr.business.gov.au), a service of the Australian Government, to confirm it is valid and active. We may also disclose information where required or authorised by law, or to protect rights and safety.

Your core business data is stored in Australia: our database and file storage (Supabase) are hosted in Sydney, and ABN checks use an Australian Government service. Some other providers may process limited personal information overseas: in particular, Vercel (application hosting), Stripe (payments), Google (mapping, advertising, analytics and app push notifications), Meta (advertising) and, where you connect it, Xero (accounting) may process data in the United States and other countries where they or their sub-processors operate. Where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the APPs.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, including access controls, role-based permissions, and encryption in transit. No method of transmission or storage is completely secure, so we can’t guarantee absolute security.

If a data breach occurs that is likely to result in serious harm, we will respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act, including notifying affected individuals and the OAIC where required.

We keep personal information for as long as needed to provide the Service and meet legal, tax and accounting obligations. Safety records (such as SWMS versions, sign-ons and daily confirmations) are kept long-term by design, because work health and safety laws can require them to be available for years, including at least two years after a notifiable incident. If you close your account, we’ll delete or de-identify your information within a reasonable period, unless we’re required to retain it, and you can export your records first.

You can access and correct most information directly in the Service. You may also ask us to access or correct your personal information, or make a privacy complaint, using the contact details below. We’ll respond within a reasonable time (generally 30 days). If you’re not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Where you enter personal information about your customers, workers or subcontractors, or send someone a work offer or safety document through the Service, you are responsible for collecting and using their information lawfully and for your own privacy obligations to them, including letting your workers know that sign-ons and confirmations are recorded and kept. We act on your behalf. If one of them contacts us about their information, we’ll generally refer them to you.

We use cookies and similar technologies. Essential cookies keep you signed in and let the Service work. On our public website we also use analytics and advertising tools, including Google (Google Analytics and Google Ads), Meta (the Facebook Pixel) and Vercel Web Analytics, to understand how the site is used and to measure our advertising. These run on our marketing website rather than inside the logged-in app or your customers’ booking, quote and invoice pages. You can control or block cookies through your browser settings, opt out of Google Analytics using Google’s opt-out browser add-on, and manage ad personalisation in your Google and Meta account settings. Blocking essential cookies may stop parts of the Service from working.

Some parts of our website are free to use without an account, including our calculators and the plan builder for people going out on their own. You can use these anonymously.

What we record. When you finish building a plan we record the answers you selected, such as the trade and state you chose, whether you expect to employ anyone, and whether you already have a website. We use this to understand which trades and places are looking, and to decide what to write and build next.

What we don’t record. While you are simply using the plan builder we do not record the name or business name you type into it, and we do not link those answers to you, your IP address or any account. That stays true for as long as you don’t ask us for anything.

If you download the PDF. Reading your plan on the website is free and needs no details. If you want the PDF version we ask for your email address, and giving it to us means you are agreeing to receive occasional emails from us with tips and offers for people starting out. We tell you this on the form before you enter it. At that point we store your email address together with the first name and business name you typed and the answers you gave, so that what we send you is relevant, and we let ourselves know you asked for a plan. If you would rather stay anonymous, read your plan on the website and don’t enter an email.

Unsubscribing. Every marketing email we send has an unsubscribe link in the footer, and your email app’s own unsubscribe button works too. Using either adds your address to a do-not-email list that we check before every marketing send, so it stops mail from all of our tools and lists at once, not just the one you clicked from. You can also email privacy@onaraops.com.au and we will do it for you. Messages you actually need, like a receipt or something about your own account, are not marketing and still reach you.

The Service isn’t intended for people under 18, and we don’t knowingly collect their personal information.

We may update this policy from time to time. We’ll post the updated version with a new effective date and, for material changes, give reasonable notice.

For privacy questions, access/correction requests, or complaints, contact us at privacy@onaraops.com.au.