Privacy Policy

JACK App Pty Ltd (ABN 30 658 730 824), Australia and New Zealand

Effective date: 1 August 2026

JACK App Pty Ltd (“JACK App”, “we”, “us” or “our”) respects your privacy. This Privacy Policy explains how we collect, hold, use and disclose your information when you use the JACK App construction management platform (the “Service”) or otherwise deal with us in Australia and New Zealand. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) in Australia, and the Privacy Act 2020 and the Information Privacy Principles (IPPs) in New Zealand. JACK App Pty Ltd is the contracting entity for both Australian and New Zealand subscribers.

1. Key terms

~Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, such as a name, address, email, phone number or date of birth.

~Business information means information about an identified or reasonably identifiable business, such as a business name, ABN or NZBN, business address and number of employees.

~Customer Data means the data you and your users upload to or create in the Service, including contacts, estimates, budgets, invoices, schedules, photos, plans and project records.

~Sensitive information is a special category of personal information (for example health or union membership). We do not seek sensitive information and ask that you do not upload it to the Service.

2. What we collect

The information we collect depends on how you deal with us. It may include:

~Personal information: name, mailing or street address, email address, phone number and date of birth.

~Business information: business name, ABN or NZBN, business address and phone number, type of business and number of employees.

~Order and delivery details for physical products, such as the name and delivery address for safety sign orders.

~Customer Data that you and your authorised users enter into the Service.

~Onboarding and migration data (see section 4), which may include data exported from your existing software and, where you choose, login credentials for that software.

~Technical and usage data: IP address, device and browser type, and how you use the Service, collected automatically through cookies and analytics tools.

~Records of your communications with our support, training and implementation teams.

3. How we collect it

We collect information directly from you when you enquire, subscribe, use the Service, attend an event, complete a survey or apply for a role. We also collect it automatically when you use our website and platform, and sometimes from third parties or public sources (for example industry bodies) to improve and tailor our products.

4. Onboarding, data import and access to your existing software

When you onboard, you may give us data to set up your account, and you may ask us to import or migrate data from your current software into the Service. To do this, you may choose to give us login access to that other platform.

Where you provide such access or data, you confirm that:

~you are authorised to share the data and to grant the access; and

~you have any consents needed from the individuals whose data is involved.

We use this access and data only to import and set up your account. We do not use it to mine, profile or on-sell data, and we do not retain your third-party login credentials for longer than needed to complete the work. You remain responsible for the accuracy and legality of the data you provide. Please review imported data promptly and tell us of any errors.

5. Support login access

The Service includes a Support Access feature that lets our implementation, training and support staff sign in to your account to help you. This feature is enabled by default and you can disable or re-enable it at any time in your account settings.

We use Support Access only for onboarding and setup, training, and support and troubleshooting. When our staff use it:

~we do not export your data;

~we do not access your account for any purpose you have not asked us to help with; and

~we do not use it for marketing, advertising, data mining or profiling.

Support Access may be provided by our staff located overseas, including support and implementation staff in the Philippines engaged through an agency, who are bound by confidentiality and data protection obligations.

6. How we use your information

We use information to:

~provide, maintain, secure and improve the Service;

~set up your account and deliver onboarding, training and support;

~process payments and manage your subscription;

~communicate with you about your account and the Service;

~carry out internal administration, research and analytics; and

~send marketing where permitted (see section 8), and meet our legal obligations.

We use artificial intelligence tools to help provide, secure and improve the Service. We do not use AI to make automated decisions that produce legal or similarly significant effects about individuals without human involvement.

If you connect an external AI tool or agent to your account, including through a connection that uses the Model Context Protocol, that tool can access personal information in your account to read and write data as you direct. You choose and control which tools you connect, and you can disable the connection at any time. Those tools are third-party services governed by their own privacy terms, and personal information may be sent to the AI provider you choose.

7. Who we share it with and overseas disclosure

We may disclose information to our service providers (for example hosting, IT, payment and analytics providers), our professional advisers, and where required or authorised by law. We do not sell your personal information.

We use Stripe to process card payments. Stripe handles your card details, and we do not store your full card numbers. When you order physical safety signs, we share your name and delivery address with our third-party printing and shipping provider so they can fulfil and deliver your order.

Some providers are located, or hold data, outside Australia and New Zealand (for example in the United States, Canada and the Philippines). Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs and the New Zealand IPPs, or we rely on your consent or another exception permitted by law. Under APP 8 and New Zealand IPP 12, we remain accountable for how overseas recipients handle personal information disclosed to them. Customer Data is hosted primarily in Australia and the United States.

8. Marketing

We may send you marketing about our products and events where you have requested it or would reasonably expect it, by mail, email or SMS, consistent with the Spam Act 2003 (Cth) and the New Zealand Unsolicited Electronic Messages Act 2007 . You can opt out at any time using the unsubscribe link in the message or by contacting us. If you receive SMS messages from us, our separate SMS Terms and Conditions also apply.

9. How we keep it secure

We take reasonable technical and organisational steps to protect information from misuse, loss and unauthorised access, including access controls, encryption in transit, firewalls and staff training. No system is completely secure, so we cannot guarantee absolute security.

10. Data breaches

Australia: If we suspect an eligible data breach, we assess it and take all reasonable steps to finish that assessment within 30 days. If the breach is likely to cause serious harm, we notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, as required by the Notifiable Data Breaches scheme.

New Zealand: If a privacy breach is likely to cause serious harm, we notify the Office of the Privacy Commissioner and affected individuals as soon as practicable. The Privacy Commissioner expects notification within about 72 hours of us becoming aware that a breach is notifiable.

11. How long we keep it

We keep information only for as long as we need it for the purposes above, usually for the life of your relationship with us and a reasonable period afterwards, unless a longer period is required by law (for example tax and record-keeping rules). We then delete or de-identify it.

12. Accessing and correcting your information

You can ask to access or correct the personal information we hold about you by contacting us (see section 15). In Australia we respond consistently with APP 12 and APP 13. In New Zealand we respond to correction requests as soon as reasonably practicable and within 20 working days. We may need to verify your identity first, and in limited cases the law allows us to decline a request, in which case we will explain why.

13. Cookies and analytics

Our website uses cookies (small files stored on your device) to recognise return visits and improve your experience. We use analytics tools such as Google Analytics to understand website traffic. You can block or remove cookies in your browser, though some features may not work as well.

We also use a session recording tool (Hotjar) that captures how users interact with the Service, such as clicks, navigation and page activity, so we can find bugs and usability problems. We configure this tool to mask or exclude sensitive data, and we use the recordings only to diagnose and improve the Service, not to identify you or for marketing.

14. Complaints

If you have a privacy complaint, please contact us first (see section 15) and allow up to 14 days for a response. If you are not satisfied, you can contact the OAIC in Australia at oaic.gov.au or the Office of the Privacy Commissioner in New Zealand at privacy.org.nz

15. How to contact us

Email: help@jackapp.io

Phone (Australia): 1300 051 033

Phone (New Zealand): 1300 051 033

Registered office: Building 3, 32-56 Sir Donald Bradman Drive, Mile End SA 5031, Australia

16. Australia and New Zealand: key differences

This policy covers two countries whose privacy laws differ in some respects. The main differences are summarised below.

17. Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and we will show the effective date at the top.