Compliance Hub ("we", "our") respects your privacy. This Policy explains how we collect, use, disclose and protect personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
1. Information we collect
- Account data — name, email address, business name, BDC number, mobile number, hashed password.
- Inspection data — pool site address, homeowner name/email/phone (where you enter them), photos, notes, checklist answers, digital signatures.
- Homeowner contact data — where you email a report or share a Customer Portal link, we store the homeowner's email address and portal access token.
- Billing data — Stripe customer ID, transaction records. We never see or store your card number — Stripe holds it.
- Diagnostic data — when you use Ask Poolie support chat, we may attach browser info, current page, and (with your permission) a screenshot to help resolve your issue.
- Usage data — audit logs of edits to inspection records for compliance and court-evidence purposes.
2. How we use it
- To operate the Service — creating inspections, generating AI reports, sending PDF reports to homeowners you nominate.
- To bill you and prevent fraud (via Stripe).
- To provide customer support and respond to Ask Poolie chats.
- To improve the product — we look at aggregated, de-identified usage patterns only.
- To comply with legal obligations, including production of audit logs on lawful court order.
3. AI processing
To generate a compliance report we send the inspection's checklist answers, your inspector notes, and your knowledge-base entries to Anthropic's Claude Sonnet 4.5 model via a secure API. We do not send homeowner names, addresses, phone numbers, or photos to the AI. Anthropic's data-processing terms do not use inputs for training their models. You can view Anthropic's policy at anthropic.com/legal/privacy.
4. Who we share information with
- Homeowners you nominate — via the report PDF you send or Customer Portal link you share.
- Team members you invite — your team members can see the pool inspections you assign to them, but not each other's private inspections.
- Service providers — Stripe (payments), Anthropic (AI), Resend (email delivery), Twilio (SMS notifications), and cloud infrastructure providers. All are bound by contract to protect your data.
- Government and legal — on lawful court order, subpoena, or in support of a Land and Environment Court proceeding.
We do not sell your personal information to anyone.
5. Where your data is stored
Your data is stored on managed cloud infrastructure. Where possible we use Australian data-centre regions. Some processing (notably AI report generation) occurs in the United States under Anthropic's SOC 2-certified infrastructure. By using the Service you consent to this cross-border processing.
6. Retention
- Inspection records: retained for at least 10 years to satisfy statutory record-keeping requirements, regardless of account status.
- Audit logs: retained for at least 7 years to satisfy NSW record-keeping and court-evidence obligations.
- Billing records: retained for at least 7 years to satisfy ATO requirements.
- Support tickets: retained for 2 years.
7. Security
We use industry-standard measures — HTTPS, bcrypt password hashing, JWT authentication, per-user data scoping, encrypted database backups, and audit logging. No system is ever perfectly secure. If we experience a data breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
8. Your rights
Under the Australian Privacy Principles, you have the right to:
- Ask us what personal information we hold about you.
- Correct information that is wrong or out of date.
- Ask us to delete your personal information, subject to legal retention obligations (e.g. audit logs).
- Export your inspection data in machine-readable form.
- Withdraw consent for AI processing (this will disable AI report generation on your account).
To exercise any of these rights, email pascertification@gmail.com. We respond within 30 days.
9. Cookies and tracking
We use functional cookies (session tokens) required to keep you logged in. We do not use third-party advertising cookies. We do not run behavioural tracking or analytics that identify individuals.
10. Children
The Service is not directed at anyone under 18. We do not knowingly collect data about minors.
11. Changes
We may update this Policy from time to time. Material changes will be emailed to your account address at least 14 days before they take effect.
12. Contact and complaints
Questions or complaints? Email pascertification@gmail.com. If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner.