Privacy Policy

‍

1. Who we are

Trak Services Pty Ltd (ABN 43 662 168 943) of 468 High St, Preston VIC 3072, Australia ("Trak", "we", "us") provides job management software for trade and service businesses ("the Service").

This Privacy Policy applies globally and explains how we collect, hold, use and disclose personal information in connection with:

• our websites, including www.trak.co;

• the Trak web platform at app.trak.co;

• the Trak In-Field mobile apps for iOS and Android; and

• our related sales, support and marketing activities.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Wherever you are in the world, we apply the standards in this policy. Additional rights for users in New Zealand and in the EEA/UK are set out in sections 12 and 13.

Privacy contact: contact@trak.co, or by post to the address above.

‍

2. Personal information we collect

Information you give us

• Identity and contact details: name, business name, ABN/NZBN or equivalent, email address, phone number, postal address.

• Account details: username, password (stored hashed), account preferences, role and team details.

• Billing details: billing contact and payment method details. Card payments are processed by Stripe; we do not store full card numbers.

• Communications: support requests, demo bookings, contact-form submissions, emails, SMS and phone records.

Information collected through your use of the Service

• Job and business data you upload: client and contact details, quotes, invoices, orders, job notes, tasks, schedules, timesheets, photos, attachments, expenses and Safe Work Method Statements (SWMS).

• Documents you submit for automated processing, for example supplier invoices or emails processed by our AI-assisted data-extraction features (see section 7).

• Location data: where you or your workers enable device location permissions, we collect geolocation data to provide features such as job maps, address lookup and scheduling. Location access can be disabled in device settings.

• Device and usage data: IP address, device and browser type, operating system, pages viewed, features used, timestamps, crash logs and cookie identifiers.

Information from third parties

• Accounting integrations: if you connect Xero, MYOB or QuickBooks, we exchange contact, invoice and payment data with that provider at your direction.

• Supplier integrations you enable (such as Swan and Burdens, for catalogues, ordering and statements) and data you ask us to import from other systems.

• Payment providers: confirmation of payment outcomes from Stripe and BPAY.

• Automation platforms you connect, such as Zapier.

‍

3. Personal information about your customers and workers

When you use Trak, you may upload personal information about other people, for example your clients, employees and subcontractors. For that information, you are responsible for ensuring you have the right to provide it to us (for example, by making those people aware of this policy). We collect, hold, use and disclose that information only to provide the Service to you and as otherwise described in this policy.

‍

4. Why we collect, use and disclose personal information

• To provide, operate and support the Service, including accounts, scheduling, quoting, invoicing and payments.

• To process transactions and administer billing.

• To communicate with you, including service notifications by email and SMS, support responses and, with your consent or as otherwise permitted, marketing communications.

• To improve and develop the Service, including analytics, troubleshooting and product research.

• To keep the Service secure and prevent fraud, misuse and unlawful activity, including bot-detection tools.

• To comply with our legal obligations and enforce our terms.

We do not sell personal information

‍

5. Direct marketing and advertising

We may send you marketing about Trak by email, SMS or phone in accordance with the Spam Act 2003 (Cth) and equivalent laws in your country, including the Unsolicited Electronic Messages Act 2007 (NZ). You can opt out at any time using the unsubscribe link in any message or by contacting us, and we will action opt-outs promptly and free of charge.

Our website uses Google Ads conversion tracking, which may set cookies to measure the performance of our advertising. You can opt out of personalised advertising through Google’s ad settings (adssettings.google.com), and control cookies as described in section 8.

‍

6. Who we disclose personal information to

We use the following categories of service providers:

• Hosting and infrastructure: Amazon Web Services (including file storage and address/geolocation services), Vultr (application and website hosting), and Cloudflare (traffic optimisation and security).

• Payments: Stripe (and invoicing arrangements for custom engagements).

• Email and SMS delivery: Mailgun, Postmark and MessageBird.

• Marketing: MailerLite (newsletters).

• Customer support: Help Scout (including the in-app Beacon chat widget).

• Analytics and measurement: Plausible Analytics (privacy-focused, cookieless), Ahrefs, and Google Ads conversion tracking (website only).

• Maps and address lookup: Google Maps Platform and Amazon Location Service.

• AI providers: Anthropic and OpenAI, for the AI-assisted features described in section 7.

• Security and bot protection: Cloudflare Turnstile.

• Internal business tools: Google Workspace (email and documents), Slack (internal communications) and Anthropic Claude (internal productivity), where limited personal information may be processed incidentally by our staff.

We also disclose personal information to: accounting platforms (Xero, MYOB, QuickBooks), automation platforms (Zapier) and supplier integrations (Swan, Burdens), only where you connect or enable them; our professional advisers; government agencies, regulators, courts and law enforcement where required or authorised by law; and a purchaser or prospective purchaser of our business or assets, subject to confidentiality obligations.

‍

7. AI-assisted features

Some features of the Service use large language model providers (Anthropic and OpenAI) to process content you submit: for example extracting line items from supplier invoices and emails. Content is sent to these providers only to deliver the feature you are using. Under the commercial API terms of both providers, your content is not used to train their models, and is retained by them only for a short period for trust and safety monitoring before being deleted. Do not include sensitive personal information in documents submitted for AI processing unless necessary.

‍

8. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how it is used. Our primary website analytics tool, Plausible, does not use cookies or collect personal information. Google Ads conversion tracking (section 5) does use cookies. You can control cookies through your browser settings, andwhere required by the law of your region we will ask for your consent before setting non-essential cookies. Our websites do not currently respond to "Do Not Track" signals.

‍

9. International transfers

We are based in Australia, and your account and job data is hosted in Australian regions of AWS and Vultr. Some of our service providers (such as payment, email, SMS, support and AI providers) process data in other countries, including the United States and the European Union. Where we transfer personal information across borders, we take reasonable steps as required by APP 8, and where the GDPR applies we use appropriate safeguards such as standard contractual clauses, to ensure it is handled consistently with this policy.

‍

10. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These steps include encryption of data in transit, multi-factor authentication, staff access policies and controls, and regular backups. No system is completely secure, so please keep your account credentials confidential and notify us immediately of any suspected unauthorised access.

‍

11. Data breaches

If a data breach occurs that is likely to result in serious harm to individuals, we will assess and respond in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), including notifying affected individuals and the Office of the Australian Information Commissioner (OAIC) where required. We will also comply with breach notification obligations in other jurisdictions where they apply, including notifying the Office of the Privacy Commissioner (NZ) and relevant EEA/UK supervisory authorities.

‍

12. Retention, deletion and your rights

We keep personal information for as long as needed for the purposes described in this policy, and then delete or de-identify it. As a guide: account and job data is deleted when you delete your account (export your data first, as it will not be available afterwards); where an account is closed for non-payment, data is retained for 30 days to allow reactivation; where we terminate an account for breach of our terms, data is available for export for 7 days and then deleted; and billing records are kept for at least 7 years as required by tax law. Deleted data may persist in routine backups for a limited period before those backups cycle out.

You can delete your account at any time from within the Service, and you can export your data while your account is active. You may also request access to, or correction or deletion of, the personal information we hold about you by contacting us. We will respond within a reasonable period (and in any case within 30 days) and will not charge for making a request. If we refuse a request, we will tell you why.

If you have a privacy complaint, contact us first and we will investigate and respond within 30 days. If you are not satisfied with our response, you may complain to the OAIC (www.oaic.gov.au, 1300 363 992), the Office of the Privacy Commissioner (NZ) (www.privacy.org.nz), or your local data protection authority.

‍

13. Additional rights for EEA and UK users

If the GDPR or UK GDPR applies to you, Trak Services Pty Ltd is the data controller for personal information described in this policy, except for Customer Data you upload about your own clients and workers, for which you are the controller and we act as your processor. Our legal bases for processing are: performance of a contract, our legitimate interests (operating, securing and improving the Service), compliance with legal obligations, and consent (for marketing and non-essential cookies). You have rights of access, rectification, erasure, restriction, objection and data portability, the right to withdraw consent at any time, and the right to lodge a complaint with your local supervisory authority.
‍

14. Changes to this policy

We may update this policy from time to time. We will publish the updated policy on our website with a new "last updated" date and, for material changes, notify account holders by email or in-app notice. Last updated: 7 August 2026.