Privacy policy

This privacy policy is issued by [registered entity name and ABN to be confirmed] ("we", "us" or "our") and applies to the hibiz website and application (the "Service"), to each business that holds an account for the Service (a "Business"), to each person whom a Business authorises to use that account (a "User"), to each person who submits a request, booking or review through the Service, and to each person who holds an account for the Service that is identified by an email address and a password (a "Customer Account"). We collect and hold the personal information that Businesses and Users provide in the course of using the Service, including business and contact details, Australian Business Numbers, GST registration, licence numbers, bank account and PayID details, and the names, email addresses, telephone numbers, roles and salted password hashes of Users; the details of customers, sites, jobs, quotes, invoices, payments, notes, photographs and price lists that a Business enters, which the Business may have collected from third parties; the content that a Business elects to publish on a page of the Service (a "Business Page"), including its name, telephone number, Australian Business Number, whether its licence number has been checked by us, its address where the Business so elects, its opening hours, prices, areas served and photographs, and the names and descriptions of the persons who may be booked through it; records of activity within an account and of the use of artificial intelligence features; where a customer of a Business uses a quote link, any questions, requests for changes, reasons for declining, preferred appointment times and photographs (including any markings applied to them) that the customer submits and, where the customer accepts the quote, the name entered, the time of acceptance and the internet protocol address from which it was given; where a person submits a request, booking or enquiry through a Business Page, that person's name, mobile telephone number, email address and suburb, whether that email address and that mobile telephone number had been confirmed to us at the time of submission, together with the description of the work or service sought, any photographs submitted and, as applicable, the time, service, staff member, number of guests, catering particulars and rush service requested; where a person accepts an invitation from a Business to review it, the rating, comments, first name and suburb that the person submits and a description of the job or booking reviewed; in respect of a Customer Account, the email address by which it is identified, a salted hash of its password, a mobile telephone number, any name provided, the times at which that email address and, where applicable, that mobile telephone number were confirmed, a hashed record of each single-use code sent to that email address by email or to that number by SMS to confirm it or to reset the password, together with the number of attempts made to enter it, the time of the most recent sign-in, and the requests, jobs, projects, tasks, addresses, suburbs and photographs that the holder saves to it; the name, email address and message of any person who submits our contact form; and the internet protocol addresses from which the Service is accessed, which are held temporarily for the purpose of preventing misuse and are not otherwise recorded except as stated in this policy. In respect of persons whom we identify as prospective users of the Service, we collect and hold their name, business name, trade, telephone number, email address, suburb and state, which we may obtain from the individual, by referral or from publicly available sources, together with the source of those details, our notes, the content of each communication we send to them and their responses, and, where we provide a demonstration of the Service, a record of the interactions of any person with that demonstration and its accompanying quote link, including the pages viewed, the selections made, any messages and photographs submitted, the browser and device type, and a reproduction of the screen in which text entered into form fields is obscured; where such a person subsequently registers for the Service, we match the email address and telephone number provided on registration against those records. We use and disclose personal information to provide, secure, support and improve the Service, to communicate with Businesses, Users and their customers in connection with the Service, to offer the Service to prospective users and to assess the response to those offers, and as required or authorised by law, and we do not sell personal information or disclose it to any third party for that party's own marketing or advertising. We publish to the public the content of each Business Page that its Business has published and, on that Business Page, the rating, comments, first name and suburb of each review submitted in response to an invitation from that Business, and we may in our discretion withhold from publication any Business Page or review that we consider to breach the terms on which the Service is provided. We disclose each request, booking or enquiry submitted through a Business Page, including any photographs, the email address of the Customer Account from which it was sent and whether that email address and the mobile telephone number had been confirmed to us, to the Business concerned, and, where the holder of a Customer Account directs that a request be sent to more than one Business, we disclose to each Business so selected by the holder the holder's name, email address and mobile telephone number, the description and suburb of the work and such photographs as the holder has saved to the relevant project or submitted with an earlier request for that work, and each such Business thereafter holds that information as part of its own account. We may send a prospective user information about the Service by email or SMS, which constitutes direct marketing, and any person may at any time request through the contact form that we cease to do so, whereupon we will send no further such communication to that person. Where personal information that we request is not provided, we may be unable to provide the Service or the relevant part of it, or to respond to an enquiry. The Service sets only those cookies that are necessary to maintain a signed-in session and to secure and administer the Service, stores in the browser during a demonstration an identifier for the reproduction of the screen described above, and uses no third-party analytics or advertising technologies. We send email, including User invitations, password resets, notices of changes to sign-in details, the single-use codes by which the holder of a Customer Account confirms an email address or resets a password, correspondence concerning quotes and communications to prospective users, through an email delivery service engaged by us; we send SMS messages, being, where we have enabled that step, the single-use codes by which the holder of a Customer Account confirms a mobile telephone number, and confirmations, changes and cancellations of bookings, notices that a quote has been sent and invitations to review a Business, through Twilio, Inc., to which we transmit the recipient's mobile telephone number and the content of the message; and the Service otherwise prepares messages for a Business to send from its own device or account. Where an Anthropic API key has been configured and a User invokes an artificial intelligence feature, the information relevant to that feature, being as applicable the site notes, price list, job particulars, notes and photograph captions, quote and invoice particulars, the customer's first or display name and site suburb, and any enquiry text that the User elects to submit, is transmitted to Anthropic, PBC for processing under our commercial terms with Anthropic, PBC, which preclude its use to train Anthropic's models, or, where the Business has supplied its own key, under the terms agreed between that Business and Anthropic, PBC, and, other than as contained in text that a User elects to submit, customer telephone numbers, customer email addresses, bank details, Australian Business Numbers and API keys are not transmitted. Where a Business has enabled card payments, a customer who elects to pay an invoice by card is directed to a payment page operated by Stripe on the Business's own Stripe account, to which we transmit the customer's email address, the invoice number, the name of the Business and the amount payable; card details are collected and processed by Stripe under its own privacy policy and are not received or held by us, and we receive and record the amount, date and transaction identifier of each such payment. Personal information is stored on [hosting region to be confirmed], and we are likely to disclose personal information to overseas recipients, namely Anthropic, PBC in the United States of America, our email delivery provider, which may process email in the United States of America and other countries, Twilio, Inc. in the United States of America and other countries, and, where a Business has enabled card payments, Stripe, Inc. and its affiliates in the United States of America and other countries; where personal information is held or disclosed outside Australia, we take such steps as are reasonable in the circumstances to ensure that it is handled in a manner consistent with the Australian Privacy Principles. We hold personal information in electronic form and take such steps as are reasonable in the circumstances to protect it from misuse, interference and loss and from unauthorised access, modification or disclosure, including the encryption of data in transit, the hashing of passwords and the encryption of stored credentials. Where an account has remained in read-only mode for 90 days following the expiry of a trial or the cancellation of a subscription, we will within a reasonable period thereafter delete that account and the personal information held in it; the records of a demonstration and of our dealings with a prospective user are retained until that person requests their deletion or we determine that they are no longer required for the purpose of offering the Service; a Customer Account, together with the projects, tasks and photographs saved to it and its sign-in records, is retained until its holder deletes it through the Service, whereupon we delete that information, save that a request already sent to a Business remains held by that Business as part of its account; a published review remains on the relevant Business Page until it is withheld by us or that Business's account is deleted; all other personal information is retained only for as long as is reasonably necessary for the purposes for which it was collected, after which it is destroyed or de-identified; and deleted information may persist in backup copies for a limited period until those copies are overwritten in the ordinary course. An individual may request access to or correction of the personal information we hold about them, or complain about our handling of it, through the contact form, and we will acknowledge and investigate any such request or complaint and notify the individual in writing of our response within a reasonable period and in any event within 30 days; the holder of a Customer Account may also view, correct and delete the personal information in that account through the Service; and a customer of a Business should direct a request concerning information held in that Business's account, including a request, booking or enquiry already sent to it, to that Business, which controls the relevant account. A complaint that is not resolved to the complainant's satisfaction may be referred to the Office of the Australian Information Commissioner. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we will notify each Business by email of any material change to this policy.