Data & Security Terms

1. Purpose

These Data & Security Terms form part of the Terms of Service. They explain how Tradie Checkpoint handles Customer Data when providing the Service and how subscribers must protect the people represented in their records.

2. Subscriber instructions and responsibility

• The subscriber controls which Customer Data is entered, imported, shared and deleted.
• The subscriber must have a lawful purpose and any required notice, authority or consent for Customer Data.
• Access must be limited to workers who genuinely need it and removed promptly when no longer required.
• The subscriber must review recipients before emailing documents or sharing secure links.
• The subscriber must not use Tradie Checkpoint as the only copy of a record that must legally be retained.

3. Tradie Checkpoint commitments

• Handle Customer Data only to provide, secure, support and maintain the Service, comply with law and follow lawful subscriber instructions.
• Require people with administrative access to protect confidentiality.
• Use reasonable technical and organisational safeguards proportionate to the risk.
• Use service providers only where reasonably required and maintain a current Subprocessor List.
• Investigate suspected security incidents and notify affected subscribers where reasonably necessary or legally required.
• Assist with reasonable access, correction, export and deletion requests where technically and legally possible.

4. Security controls

• Password authentication and authenticator verification.
• Subscription and workspace access checks enforced by the backend.
• Tenant separation and row-level database access controls.
• Encrypted HTTPS connections for data in transit.
• Restricted service credentials and private administrative functions.
• Private storage controls for business logos, quote photos, receipts and other supported files.
• Webhook signature verification for Stripe subscription events.
• Operational logging, dependency maintenance and incident investigation.

5. Sensitive and prohibited data

Tradie Checkpoint is not designed to collect individual TFNs, full payment-card numbers, health records, biometric templates, government identity documents or information classified above the subscriber’s ordinary business needs. Do not enter those records into free-text fields, notes, photos, receipts or imports.

The payroll workspace deliberately uses tax-scale selections and does not request or store TFNs. Full card details are entered into Stripe, not Tradie Checkpoint.

6. Security incidents

A subscriber must promptly report suspected compromise to hello@tradiecheckpoint.com.au, preserve relevant evidence and cooperate with reasonable containment steps. Tradie Checkpoint will assess the incident, take reasonable containment and remediation action, and support legally required notifications.

7. Export, retention and deletion

Subscribers should export records required after cancellation. Customer Data may be retained for a limited period for recovery, security, disputes, compliance and backup rotation, then deleted or de-identified when no longer reasonably required. A legal retention requirement or active dispute may require longer retention.