Privacy policy
Draft for review — not yet in effect. The final version will be published before Mr Builder is offered to customers. Text in [square brackets] is still to be decided.
The English text is the binding version.
Draft version: 0.1 · Prepared: 11 October 2026 · Not yet in effect
This policy explains how [Company name] (ABN [to be confirmed]) ("we", "us") handles personal information in connection with Mr Builder: our software for Australian builders, our website and our support. We follow the Australian Privacy Principles.
1. Who this policy covers
- Our customers' people: builders who sign up, and the staff they invite (owners, estimators, office staff).
- People who apply for an account, including those we don't approve.
- People who contact us, for example for support, sales or partnerships.
- Our customers' clients and others named in their data, for example homeowners whose names and site addresses appear in quotes or plans. See section 7: we handle this information on behalf of the builder, who decides what to enter.
2. Personal information we collect
| Information | Examples | Why we need it |
|---|---|---|
| Account and business details | Name, email, mobile number, business name, ABN (optional), state or territory | To create and verify your account, and to contact you |
| Sign-in and security | Password (stored only as a one-way hash), two-step sign-in settings, backup codes (stored protected), sign-in times, IP address, browser type | To keep accounts secure and detect misuse |
| Activity records | Which user approved an estimate, issued a quote or changed a price, and when | To keep a reliable record of business actions in your account; these records also protect the integrity of approved quotes |
| Your preferences | Language, time zone, light/dark display | To show the Service the way you chose |
| Support and communications | Messages, call notes, the reference number you quote when we call to verify an account | To help you and verify your identity |
| Billing | Billing contact, invoices, payment status | To charge fees and meet tax obligations; [card details are handled by our payment provider and not stored by us] |
| Customer content | Plans, which may show owners', architects' or designers' names and addresses; client names, site addresses and emails in quote details; notes | To provide the Service to the builder (section 7) |
We don't ask for sensitive information (for example health information) and ask that you don't enter it into the Service.
3. How we collect it
- From you directly, when you sign up, use the Service, or contact us.
- From your business, when an owner invites you or enters your details.
- Automatically, as you use the Service: security logs and activity records.
- From public sources, to verify a business, for example the ABN Lookup.
You can contact us without identifying yourself for general enquiries. We need your identity to provide an account.
4. How we use it
We use personal information to:
- verify new accounts. We may phone the mobile number given before an account opens;
- provide, secure, support and improve the Service;
- tell you about changes, outages, security matters and your account;
- bill you and keep business and tax records;
- meet legal obligations and resolve disputes.
Marketing. We may send you information about Mr Builder if you are a customer or have asked for it. Every marketing email has an unsubscribe link, and we follow the Spam Act 2003 (Cth). We don't sell personal information.
5. Automated decisions and artificial intelligence
- No significant automated decisions. We do not use computer programs to make decisions that significantly affect individuals' rights or interests without a person involved. For example, every new account is approved by a person.
- Calculations. The Service calculates quantities and prices with fixed rules that the builder can inspect and must confirm.
- Optional AI features. These may be offered (for example reading a supplier quote). They only suggest information to the builder; a person decides. They are off unless the builder's owner switches them on. When used, only the content needed for that task is sent to the AI provider listed in section 6, under terms that prevent the provider from training its models on it.
- Your own AI assistant. If the builder's owner allows it, a person in the builder's company can connect their own AI assistant (for example Claude or ChatGPT). The assistant can read only what that person can see and, if the owner allows drafts, prepare drafts that have no effect until that person accepts them in Mr Builder, including personal information the builder entered (for example a client's name in a quote; client contact details are not shared with assistants). What it reads goes to the assistant's provider under the builder's or that person's own agreement with them; we don't choose or control that provider. We keep a record of each request (which tool, when and the size of the answer), not its content.
6. Who we share it with
We disclose personal information only as needed, to:
| Recipient | Purpose | Location |
|---|---|---|
| Cloud hosting — [Amazon Web Services] | Hosting the Service, files and backups | Australia ([Sydney region]) |
| Email delivery — [provider to be chosen] | Sign-in links, invitations, notices | [Australia / location to be confirmed] |
| Payments — [provider] | Processing payments | [location] |
| AI provider — [only if AI features are switched on] | The specific task the builder asked for | [location, e.g. Australia or United States] |
| The builder's own AI assistant — only if the builder connects one | Answering the person's questions about their jobs; chosen and controlled by the builder | Wherever that provider processes data, under the builder's agreement with them |
| Professional advisers | Lawyers, accountants and auditors, under confidentiality | Australia |
| Authorities | Where the law requires or authorises it | Australia |
| A buyer of our business | If we sell or restructure, under this policy | — |
Within a customer's company, people see what their role allows. For example, office staff don't see internal costs. Each company's data is kept separate from every other company's.
Overseas disclosure. We store the Service's data in Australia. Some service providers may process limited information overseas, for example an email or AI provider in [country]. Where that happens, we take reasonable steps to make sure they handle it consistently with the Australian Privacy Principles, and we list the countries in the table above. We will update this policy before adding a provider that stores customer content overseas.
7. Information our customers enter about their clients
Builders use Mr Builder to prepare quotes for their clients. The builder decides what client information to enter, for example a homeowner's name, site address and email. For that information:
- we store and process it on the builder's behalf to provide the Service, and do not use it for our own purposes;
- our team looks at a builder's data only with their permission for a support request, or where needed for security or by law, and that access is recorded;
- requests from clients to access or correct their information should usually go to the builder. If they come to us, we pass them on to the builder and help where we can.
Builders are responsible for telling their clients how they handle their information. A suggested sentence for builders: "We use Mr Builder, Australian-hosted software, to prepare your quote; your details are stored securely for that purpose."
8. Security
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These include:
- encrypted connections (HTTPS);
- database-level separation of each company's data;
- role-based access with a check on every request;
- required two-step sign-in for account owners;
- malware scanning of uploaded files;
- records of approved quotes that can't be changed;
- regular backups with restore tests;
- limited, recorded staff access.
No system is perfectly secure. Please keep your password private and tell us at [security email] if you suspect a problem.
Data breaches. If a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) under the Notifiable Data Breaches scheme. We will also tell the affected builder.
9. How long we keep it
| Information | Kept for |
|---|---|
| Account and customer content | While the account is active. After it closes: available for export for [60] days, then deleted |
| Backups | Overwritten within [35] days |
| Issued quotes, invoices and records of business actions | As long as the law requires (for tax records generally 5 years; we keep [7] years for business records) |
| Security logs | [12] months |
| Records of connected-assistant requests (no content) | [12] months |
| Declined account applications | [12] months, to prevent repeated misuse, then deleted |
When we no longer need information, we delete it or de-identify it.
10. Accessing and correcting your information
- You can see and update most account details in the Service.
- You can ask us for access to, or correction of, the personal information we hold about you by contacting our Privacy Officer.
- We respond within 30 days. We don't charge for a request, though we may charge a reasonable fee for access in unusual cases. If we refuse, we tell you why and how to complain.
11. Cookies
Mr Builder uses only essential cookies:
- a session cookie to keep you signed in;
- cookies remembering your language, theme and chosen company.
We don't use advertising or third-party tracking cookies. [If website analytics are added, this section will be updated before they are switched on.]
12. Questions and complaints
Contact our Privacy Officer: [name/title], [privacy email], [postal address], [phone].
We aim to resolve complaints within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, phone 1300 363 992.
13. Changes to this policy
We may update this policy, for example when we add a service provider or feature. We will publish the new version with its date and, for significant changes, tell account owners by email or in the app.