Privacy Policy
Job Deck · Last updated: 2026-08-16 · Effective: 2026-08-16
1. Who we are
Job Deck ("we", "us", "our") provides an AI-assisted business management application for Australian sole-trader tradespeople. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Job Deck mobile app and web dashboard (collectively, the "Service").
This policy is written to comply with the Australian Privacy Principles ("APPs") set out in the Privacy Act 1988 (Cth).
2. Information we collect
We collect the following categories of personal information. Saved workspace data is linked to your user identity; voice audio is processed transiently on the device and is not linked to your identity for tracking or advertising:
| Data type | Why we collect it | Where stored |
|---|
| Name (your business name + your customers' names) | To populate quotes and invoices, communicate with customers | Encrypted database (Supabase Sydney, Australia) |
| Phone number | Sign-in identifier (email or phone, with a password) and customer contact during job dispatch | Encrypted database |
| Email address | Sending quotes / invoices / receipts, account recovery | Encrypted database |
| Physical address (job site addresses) | Travel time calculation, calendar scheduling, on-site identification | Encrypted database |
| Precise location (GPS) | A single GPS reading is taken at the moment you capture an evidence photo or a customer signs a scope change, and is stored with that record so it can support a payment dispute. There is no background location collection, no continuous tracking, and no location history. | Encrypted database, attached to the photo or signature record |
| Photos and videos | Job-site evidence, before-and-after documentation, dispute resolution | Encrypted object storage (Cloudflare R2) |
| Audio recordings and voice transcript text | Voice-to-quote feature — Apple Speech Recognition converts audio to text on the device; after separate in-app consent, the resulting text is sent to a quote-processing AI provider to extract quote fields | Raw audio is transient; transcript text may remain in the quote draft or saved workspace record |
| Financial information (ABN, BSB, account number, PayID, GST registration status) | Generating tax-compliant invoices; never used for payment processing on our side | Encrypted database with SHA-256 integrity fingerprint |
2.1 Required Reason APIs (iOS)
Our iOS app accesses the following Apple APIs for the documented reasons (per Apple's PrivacyInfo.xcprivacy declaration):
- UserDefaults (reason CA92.1): storing app preferences such as language toggle and welcome flag
- File timestamps (C617.1): managing local cache freshness
- Disk space (E174.1): checking available storage before downloading PDF attachments
- System boot time (35F9.1): measuring app cold-start performance
2.2 What we do NOT collect
- We do not use third-party advertising SDKs or analytics trackers.
- We do not collect device identifiers (IDFA / Advertising ID) for tracking.
- We do not share data with data brokers.
- We do not perform user behaviour profiling for marketing.
3. How we use your information
- To provide the Service: populate quotes, generate invoices, schedule jobs, send delivery messages on your behalf.
- To process voice quotes: after the user accepts the in-app Voice & AI data notice, we send the transcript text to the configured quote-processing AI provider so the service can extract customer, job, travel, labour, and materials fields. The service applies pattern-based redaction to detected phone numbers, email addresses, street addresses, ABNs, bank details, and payment links before the AI request. Customer names and job descriptions may remain because they are needed to build the quote.
- To respect user choice: quote text is not sent to the quote-processing AI until the user accepts the notice. The choice can be withdrawn in Settings → Privacy → Voice & AI data; withdrawing it stops future AI quote requests until consent is given again.
- To meet legal and tax obligations: invoice records are retained for at least 5 years to comply with ATO requirements.
- To communicate with you: service-related notifications (e.g., your invoice was viewed, payment was received). We do not send marketing emails without separate opt-in.
4. Who we share with
We only share your information with the following categories of service providers, each bound by a data-processing agreement and only for the operations needed to run the Service:
- Supabase (database hosting, Sydney region, ap-southeast-2)
- Vercel (application hosting, sydney region)
- Cloudflare (object storage and backups)
- The configured quote-processing AI provider (only the consented, pattern-sanitised transcript text is sent; never raw audio)
- Resend (email delivery)
- Twilio (SMS delivery)
We do not sell your information to third parties.
5. Storage location and data residency
Primary data storage is in Australia (Supabase Sydney, ap-southeast-2). Cloudflare R2 buckets used for backups and file storage may replicate to global edge nodes for performance; the master copy and authoritative source-of-truth remain in Australia. The AI providers listed above may process the sanitised transcript outside Australia to return the quote extraction result.
6. Security
We implement industry-standard security measures including:
- HTTPS / TLS 1.2+ for all data in transit
- Encryption at rest for the database
- Row-level security (RLS) policies enforcing per-business data isolation
- JWT-based authentication; Sign in with Apple identity tokens are verified against Apple's published signing keys before any account is opened or matched
- SHA-256 payment-details integrity fingerprint
- Rate limiting on all API endpoints
- HSTS, X-Frame-Options DENY, and other standard security headers
7. Your rights under the APPs
Under the Australian Privacy Principles, you have the right to:
- Access the personal information we hold about you
- Correct any inaccurate or out-of-date information
- Request deletion of your account and associated data (subject to ATO retention requirements for invoice records) — see Delete your Job Deck account
- Withdraw Voice & AI data consent in the app and stop future quote-processing AI requests
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
To exercise any of these rights, email us at the contact address below.
8. Retention and account deletion
You can delete your account from inside the app (Settings → Delete account) or, if you no longer have the app installed, from our account deletion page. Once you close your account:
- Access is revoked immediately
- Job-site photos, customer-signed scope changes and their location stamps, and your business profile are erased straight away
- Remaining personal identifiers and customer data are deleted within 30 days
- Tax-related records (invoices, payment receipts) are retained for 5 years to comply with the Australian Taxation Office's record-keeping requirements
- Anonymised, aggregate usage metrics may be retained indefinitely for product improvement
9. Children's privacy
Job Deck is a business tool and is not intended for use by individuals under the age of 18. We do not knowingly collect information from minors.
10. Changes to this Policy
We may update this Privacy Policy from time to time. Material changes will be notified via the app and email. The "Last updated" date at the top of this page reflects the most recent revision.
11. Contact
For privacy questions, data access requests, or to lodge a complaint, contact us at:
- Email: jobdeck@waz-ai.com
- Postal: Job Deck Pty Ltd, [Address to be confirmed when company is registered], Queensland, Australia