DRAFT — NOT LEGAL ADVICE. This document must be reviewed by an Australian lawyer before launch. Placeholders are in [square brackets].

Privacy Policy (DRAFT)

Last updated: [date]. This policy explains how [legal entity name] (ABN [ABN]) handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). [Lawyer to confirm whether the small-business exemption applies; we intend to comply with the APPs regardless.]

1. What we collect (APP 3, 5)

Homeowners: name, email, password (stored only as a salted hash), suburb, job descriptions, quote and review activity.
Tradies: business name, contact phone, email, ABN, licence number and authority, service suburbs, availability, work photos, insurance status.
Public-source listings: business name, trade, suburb, business phone/website and licence/ABN details obtained from public registers and the business's own website.
Technical: IP address (for rate limiting and security), session cookie, push-notification subscription if you enable it.

2. Why we use it (APP 6)

To run the directory and quoting service, verify licences, send notifications you've asked for, process subscriptions, prevent fraud and abuse, and comply with law. We do not sell personal information and do not use it for unrelated direct marketing without consent (APP 7).

3. Public display

Licence and ABN numbers are used for verification only and are not displayed publicly — we show badges instead. Tradie profiles use work photos, not face photos.

4. Disclosure

We share information with: the other party to a quote (e.g. your job details to the tradie you request); service providers that host or operate the service (Cloudflare — hosting/database; Stripe — payments; [email provider: Resend/MailChannels] — email). Some providers may store data outside Australia (e.g. United States) (APP 8); we take reasonable steps to ensure they handle it consistently with the APPs.

5. Security and retention (APP 11)

Passwords are hashed (PBKDF2), sessions use secure HTTP-only cookies, and access is rate-limited. We delete or de-identify information when no longer needed, [retention period].

6. Access and correction (APP 12, 13)

You can access or correct your information, or ask us to delete your account or an unclaimed listing, by contacting [privacy email]. We respond within 30 days.

7. Notifiable data breaches

If an eligible data breach occurs we will notify affected people and the OAIC as required by the Notifiable Data Breaches scheme.

8. Complaints

Contact our Privacy Officer at [privacy email]. If unresolved, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au, 1300 363 992).

9. Anonymity (APP 2)

You can browse tradies without an account. Requesting quotes requires an account so tradies can respond.