Privacy Policy
Effective 15 November 2026
Who we are
TradieDash (ABN 93 678 752 746) ("we", "us") provides the TradieDash application and website. This policy explains how we handle personal information in the TradieDash application and website. We aim to handle personal information consistently with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Businesses and the people they add
TradieDash is used by trade businesses ("customers") to manage their own work. A business decides what information to enter about its staff, subcontractors and its own clients, and who in its team can see it. For that information we act on the business's behalf. If you are a business's client or worker and have a question about information the business holds, please contact that business first. We will help them respond.
Information we handle
- Account details: name, email address, phone number (if provided), role, the company you belong to, and the projects and sites you have access to.
- Sign-in information: your password is handled by our authentication provider and stored only in a one-way (hashed) form. We cannot see it.
- Business records entered by users: customers and their contact details and addresses, sites, jobs, tasks, schedules, notes, follow-up activities, quotes, invoices and timesheet entries (clock-on and clock-off times).
- Uploaded files: photos and documents attached to tasks and projects, such as completion photos, safe work method statements and licences or cards a business asks workers to provide.
- Activity records: who created or changed a record and when, invitation and access history, and acknowledgements of work instructions. These are kept so businesses can see what happened on a project.
- Technical information: our hosting and service providers process standard request information (such as IP address and browser type) to deliver and secure the service. When a business signs up we briefly keep a one-way (hashed) form of the network address to limit abuse.
- Billing information: subscriptions are paid by card through Stripe. We store your subscription status and Stripe customer reference, never your card number.
- Sign-up source: when a business signs up, we record how it found us (for example the campaign name or Google click identifier in the link it followed, and the first page it visited) to understand which pages and advertising work. This contains no names or contact details.
Website analytics. Our public website can use Google Analytics and Google Ads measurement only if you choose "Accept" in the cookie notice. Until then, no analytics or advertising cookies are set. The TradieDash app itself does not use advertising cookies, and TradieDash does not collect your device's location. The app stores your signed-in session in your browser so you stay signed in.
How we use it
- To provide TradieDash: show each person the information their role and assignments allow, and let businesses run their jobs.
- To send essential account and service emails: email verification, password resets, invitations, subscription and payment notices, trial reminders and essential service announcements. These are sent because the service needs them and do not contain advertising.
- To send new business owners at most two short setup tips in their first two weeks. You can turn these off with the link in each tip or in More → Email preferences.
- To send product updates, new features, tips and occasional offers only if you ticked the optional box when signing up or turned it on in More → Email preferences. Ticking it is never required to use TradieDash. We record when and how you agreed, and the wording you agreed to. Every such email has an unsubscribe link, and unsubscribing takes effect immediately. We never re-subscribe you automatically.
- To keep the service secure, prevent misuse, and recover data after an incident.
- To provide support when you or your business asks for it.
We do not sell personal information and do not use it for marketing on behalf of others.
Who can see it
Access is controlled by role and is enforced on our servers. Within a business, owners and office or site managers can see that business's records, and workers see the tasks assigned to them. When a builder invites a subcontracting company to a project, that company sees only that project's information it has been given access to, and the builder can see the subcontractor's people, progress and uploads for that project. Revoking access takes effect immediately for future requests.
Service providers and where data is stored
- Google Cloud / Firebase (Google LLC and affiliates): application database and server functions in Sydney, Australia (australia-southeast1); sign-in (authentication); website hosting through a global network.
- Uploaded photos and documents are stored with Google Cloud Storage in the United States (us-east1).
- Email delivery: account emails are sent by Google's Firebase Authentication service and, once branded email is enabled, by Resend (Resend, Inc., United States).
- Payments: Stripe Payments Australia Pty Ltd and its affiliates process subscription payments.
- Website analytics (only with your consent): Google Analytics and Google Ads (Google LLC).
Because some providers store or process information outside Australia, your information may be held overseas, including in the United States. We use providers with established security practices and limit what each receives to what it needs.
Security
Information is encrypted in transit (HTTPS) and at rest by our providers. Access rules are enforced server-side for every request. We keep daily backups and short-term recovery copies so data can be restored after an accident. No system is perfectly secure. If we become aware of a data breach likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by law.
How long we keep it
Business records are kept while the business uses TradieDash. When a person is deactivated or loses access to a project, their past records stay with the business, because they form part of the business's job history. Deleted database records can remain in backups for up to 14 days, and deleted files for up to 7 days, before they are permanently removed. When a business closes its account, we delete or return its data on request, subject to any legal requirement to keep it.
Access, correction and deletion
You can update your own name and phone number in the app. To ask for access to, correction of, or deletion of your personal information, contact the business that added you, or contact us using the details below. We will respond within a reasonable time, usually 30 days. We may need to verify your identity, and some records may need to be kept for the business's legal or record-keeping obligations.
Contact and complaints
TradieDash (ABN 93 678 752 746)
Email: support@tradiedash.com.au
Location: Queensland, Australia
If you are not satisfied with our response to a privacy complaint, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
We may update this policy as TradieDash changes. We will post the new version here with its effective date, and tell business owners about significant changes.