Privacy Policy

We respect your privacy and are committed to protecting the personal information we collect from you. This policy describes the kinds of personal information we hold, how it is collected, the purposes for which it is used, and how you can access, correct or complain about the handling of that information.

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

VexOp+ is operated by Vexop Holdings Pty Ltd, an Australian proprietary limited company. We provide a software-as-a-service platform for Australian trade businesses, with tools for job management, quoting, invoicing, customer relationship management, staff and compliance management, and integrations with accounting providers.

Where this policy refers to “you”, we mean both the business that subscribes to the Services and the individual users (owners, employees and contractors) who access the platform.

The categories of personal information we may collect include:

Account & profile information

• Name, email address, phone number and role within your business.
• Profile photo or avatar (if you upload one).
• Authentication credentials (passwords are never stored in plaintext; we use Firebase Authentication).

Business information

• Business name, ABN, trading address, logo and branding assets.
• Subscription tier and billing history.
• Operational data you enter into the platform: jobs, quotes, invoices, customer contacts, staff records, timesheets, compliance documents.

Customer (end-client) information you upload

• Names, contact details, addresses and notes about your end customers.
• Job site locations, completion signatures, and uploaded photos and documents.

Where you upload personal information about your customers, you are the primary data controller for that information. We act as a processor on your behalf and only handle that information in accordance with this policy and your instructions.

Technical & usage information

• Device type, browser type and version, operating system.
• IP address and approximate geolocation derived from it.
• When a team member taps On my way, VexOp reads their phone or browser location once to work out the travel distance, and never tracks location in the background.
• Pages visited, features used, timestamps, and referring URLs.
• Crash reports and diagnostic logs.

Payment information

Subscription payments are processed by Square. We do not store full credit card numbers on our servers. We retain only a tokenised reference and the last four digits of the card for billing reconciliation.

Sensitive information

We do not knowingly collect sensitive information (such as health information, racial origin, political opinions or religious beliefs) unless you choose to upload it as part of your HR or compliance records. Where you do, you are responsible for obtaining the consent of the individuals concerned.

We collect personal information:

• Directly from you when you sign up, complete forms, upload data, contact us, or use the platform.
• Automatically through cookies, pixels and server logs as you use the Services.
• From third parties such as Xero, MYOB, QuickBooks and other integrations you choose to connect.
• From the AI apps you connect through AI connections (Claude, ChatGPT or Perplexity): each lookup the app asks us to make, and which app and person made it.
• From publicly available sources (for example, the ABN Lookup register when you use our business-establishment tools).

Where it is reasonable and practical to do so, we will collect personal information directly from you.

We use personal information for the following purposes:

• To provide, operate, maintain and improve the Services.
• To create and manage your account and authenticate logins.
• To process subscription payments and manage billing.
• To send transactional emails (e.g. invoices, payment receipts, license-expiry alerts, portal notifications).
• To send service announcements, security alerts and (where you have not unsubscribed) product updates.
• To respond to support requests and customer enquiries.
• To monitor usage, prevent fraud, detect abuse and enforce our Terms of Service.
• To comply with our legal obligations under Australian law.
• To produce aggregate, de-identified analytics that help us improve the platform.

We will not use your personal information for a purpose that is unrelated to the above primary purposes unless you have consented, or the use is otherwise permitted under the Privacy Act.

We rely on the following lawful bases under the APPs to handle your personal information:

• Contract: processing necessary to provide the Services you have subscribed to.
• Legitimate interests: operating, securing and improving the platform.
• Consent: where you have given express or implied consent (for example, opting in to marketing communications).
• Legal obligation: where we are required to retain or disclose information by law.

We do not sell your personal information. We may disclose personal information to the following categories of recipients in connection with the purposes set out above:

• Service providers who help us operate the platform (hosting, email, payments, analytics, customer support).
• Integration partners (Xero, MYOB, QuickBooks, Google) where you have authorised the integration.
• AI providers you choose to connect through AI connections (Anthropic for Claude, OpenAI for ChatGPT, or Perplexity): the records a connected AI app looks up are sent to that provider, under the person’s own account with it (see section 9).
• Professional advisors (lawyers, accountants, auditors) where required.
• Law enforcement, regulatory bodies and courts where compelled by law or to protect our rights and safety.
• A successor entity in the event of a merger, acquisition, restructure or sale of assets, in which case we will require the recipient to honour this policy.

We rely on the following sub-processors to deliver the Services. Each is engaged under terms that require it to handle your data in accordance with applicable privacy laws and only on our instructions. We may add or change sub-processors as the platform evolves; we will keep this list current.

• Google Cloud / Firebase: hosting, authentication, database (Firestore), file storage and serverless compute (Cloud Functions). Your tenant data is stored in the australia-southeast1 (Sydney) region.
• Vercel: hosting and delivery of our marketing website and tenants’ published white-label websites.
• Anthropic: provider of the Claude AI models that power our AI features (see section 9). Anthropic does not use the content you submit to train its models.
• Square: subscription billing and payment processing (card details are captured and stored by Square, not by VexOp).
• SendGrid (Twilio): transactional and notification email delivery.
• Twilio: SMS / text-message delivery for notifications and customer communications.
• Xero, MYOB, QuickBooks: accounting integrations you choose to connect (data flows only after you authorise the connection).
• Google Maps Platform: address autocomplete and mapping.
• Google Analytics: aggregate, de-identified usage analytics on our marketing website (see section 10).
• Australian Business Register (ABN Lookup): business-verification lookups.

The AI apps a business connects through AI connections (section 9) are not our sub-processors: the business chooses them, and each person uses them under their own account and the provider’s own terms and privacy policy. The Anthropic entry above covers only the AI features we run for you.

Some of these providers operate globally; where a sub-processor handles data outside Australia, the “International Data Transfers” section below applies.

Some features of the Services use artificial intelligence (AI) to help you draft content faster. These are assistive features that generate suggestions for a person to review, not automated decisions that affect your legal rights. The AI-assisted features are:

• Email and SMS drafting: generating and improving draft email and text-message content.
• Report and automation specifications: turning a plain-English description into a draft report or automation configuration.
• The in-app assistant: answering your questions about how to use the platform.

How the AI processing works

To power these features we use Anthropic (the provider of the Claude AI models) as a sub-processor. When you use an AI feature, only the content needed for that feature (for example, the email you ask us to improve, or the text you ask the assistant about) is sent to Anthropic so it can generate the requested output. We do not send Anthropic your whole account, and we do not send personal information that is not relevant to the request.

Anthropic does not use the content you submit through these features to train its AI models. It processes your input on our behalf solely to return the requested output to us, which we then display to you within the Services.

Human review: outputs are owner-reviewed

AI output is always presented as a draft for a person to review. It can be inaccurate, incomplete or out-of-date. You (or the business owner) should review and verify any AI-generated content before you rely on it, send it to a customer, or use it in a quote, invoice or other business document. No quote, message or document is sent to your customers automatically by AI without that human step. You remain responsible for the content you choose to use.

Legal basis under the Australian Privacy Principles

Our handling of personal information for these AI features is a use directly related to the primary purpose for which the information was collected, namely providing the job management, quoting and communication tools you have subscribed to (APP 6). Where personal information about your end customers is involved, you are the entity that controls that information and we act as your processor; you are responsible for ensuring your own privacy notices and consents cover the use of AI-assisted drafting. We apply server-side guardrails (usage and cost limits, input-length caps and feature-tier checks) to these AI features.

Connecting your own AI app (AI connections)

AI connections is an optional add-on that an owner of your business switches on. It lets each person in your business connect their own AI app (Claude by Anthropic, ChatGPT by OpenAI, or Perplexity, which is in beta) so they can ask it about the business’s records.

Your business chooses to send its records to the AI provider it picks. The provider receives them under each person’s own account and handles them under its own terms and privacy policy, not ours. We do not run an AI model for this and we do not see or keep the conversations: the app sends us only its lookups, and we answer each one with the records that person can see.

The connection is read only. A connected app can look up jobs, clients, quotes, invoices and what is owed, the schedule and VexOp+ help. It can never send, change or delete anything, and it sees only what its person can see in VexOp+. Owners choose whether team members may connect. Text in records, such as job notes, reaches the app as data, and we tell every connected app not to follow instructions written in records.

Every connection and lookup is logged for your business’s owners. A person can disconnect their app at any time on My profile, and an owner can disconnect any connection in Settings, Integrations & Add-ons. We end a connection ourselves after a sign out everywhere, a password or role change, when the person leaves the business or their account is switched off, and after 30 days unused. VexOp staff can never connect an AI app to a business.

Where the records include personal information about your customers, your business controls that information and decides to disclose it to the AI provider it chooses, and is responsible for making sure its own privacy notices cover that disclosure.

We collect analytics about how the Services are used so we can understand what is working, fix problems and improve the product. There are two kinds:

Marketing-website analytics

On our marketing website at vexop.com.au we use Google Analytics 4 (GA4), a web analytics service provided by Google, to collect aggregate, de-identified information, such as which pages are visited, which marketing content performs well, approximate location derived from IP address, and device/browser type. GA4 sets cookies and may process this information on Google’s servers. We do not use it to identify you individually.

In-app product usage

Within the platform we record product-usage signals (which features are opened, how often, and diagnostic/error logs) to operate, secure and improve the Services. We use this in aggregate and de-identified form for product analytics wherever practicable.

Your choices & opt-out

• You can block analytics cookies through your browser settings or use a privacy extension.
• You can install Google’s Analytics Opt-out Browser Add-on to opt out of GA4 across sites.
• Essential in-app logging needed to run and secure the platform cannot be disabled while you use the Services, but is not used to track you for advertising.

We use cookies, local storage and similar technologies to:

• Keep you signed in and remember your preferences (theme, sidebar state).
• Secure the platform against fraudulent activity.
• Measure usage and improve the product (aggregated and de-identified; see section 10).

You can control cookies through your browser settings, but disabling them may affect the functionality of the Services.

Your data is stored in Google Cloud’s Sydney (australia-southeast1) region. We protect personal information using:

• TLS encryption in transit (HTTPS for every request).
• Encryption at rest using Google-managed keys, with sensitive integration tokens encrypted using customer-isolated KMS keys.
• Strict per-tenant Firestore security rules that prevent any company from reading another company’s data.
• Two-factor authentication for account sign-in, using an authenticator app (time-based one-time codes), a code sent by SMS, or single-use backup recovery codes.
• Role-based access controls, so each person only sees the data their role in the business allows.
• Verification of a new sign-in method before it is linked to an account, and protection of sign-in and sensitive actions against automated abuse.
• Logging, monitoring and alerting on suspicious activity.
• Regular security reviews, automated tests and dependency updates.

No method of transmission or storage is 100% secure. While we strive to use commercially reasonable means to protect your information, we cannot guarantee its absolute security.

We are covered by the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act 1988 (Cth). We maintain processes to detect, contain, assess and respond to data breaches, and we take remedial action to limit any harm.

If we suffer an eligible data breach (unauthorised access to, or unauthorised disclosure or loss of, personal information that is likely to result in serious harm to one or more affected individuals, and we are not able to prevent that harm through remedial action), we will, as soon as practicable:

• Notify the Office of the Australian Information Commissioner (OAIC) by preparing a statement that describes the breach, the kinds of information involved, and the steps individuals can take in response.
• Notify the affected individuals (or, where individual notification is not practicable, publish the statement and take reasonable steps to publicise it), so they can take protective action such as changing passwords or watching for fraudulent activity.

Where the breach involves personal information about your end customers that you have uploaded (data for which you are the controller and we are your processor), we will notify you promptly so that you can meet your own obligations under the NDB scheme, and we will provide reasonable assistance with your assessment and any required notifications.

Your data is primarily held in Australia. Some sub-processors (Square, SendGrid, Google’s global support functions) may process data in other jurisdictions including the United States and the European Union. Where this occurs, we ensure that the recipient is bound by contractual obligations equivalent to the APPs, or that one of the exceptions in APP 8.2 applies.

If your business connects an AI app through AI connections, the records that app looks up are sent to its provider (Anthropic, OpenAI or Perplexity), which may process them in the United States or elsewhere. That disclosure is made at your business’s direction, under each person’s own account with the provider.

We retain personal information for as long as your account is active and for a reasonable period afterwards to:

• Comply with our legal and tax obligations (typically 7 years for financial records).
• Resolve disputes and enforce our agreements.
• Maintain backups for disaster-recovery purposes.

Records of AI connections (who connected which AI app and when, and each lookup with the records it returned) are kept for 12 months, then deleted automatically. Ended connections stay listed for owners for 30 days.

On request and where lawful, we will delete or de-identify personal information that is no longer required for the purposes for which it was collected.

Under Australian privacy law you have the right to:

• Access the personal information we hold about you.
• Correct information that is inaccurate, incomplete or out-of-date.
• Withdraw consent to optional uses such as marketing communications.
• Make a complaint about how we have handled your information.
• Request deletion of your account and associated personal data, subject to legal retention requirements.

To exercise these rights, contact us using the details in the “Contact Us” section. We will respond within a reasonable time and, in any event, within the timeframes prescribed by the Privacy Act.

This section explains, in practical terms, how you exercise the access, correction and deletion rights summarised above. These rights give effect to Australian Privacy Principles 12 (access) and 13 (correction), together with our retention and deletion obligations.

How to make a request

You can make an access, correction or deletion request at any time by emailing our Privacy Officer at hello@vexop.com.au, or by using the in-product data tools described below. So that we do not disclose your information to the wrong person, we may need to verify your identity before we act on a request.

Access (APP 12)

You may ask us for access to the personal information we hold about you. We will respond within a reasonable time, ordinarily within 30 days, and give you access in the way you request where it is reasonable and practical to do so. Access is generally free; if a cost applies (for example, for retrieving a large volume of records) we will tell you before any charge is incurred. If we refuse access, we will give you reasons and explain how to complain.

Correction (APP 13)

If the personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you may ask us to correct it. Account holders can update much of their own profile and business information directly within the platform; for anything you cannot change yourself, contact our Privacy Officer and we will correct it. If we disagree that a correction is required, you may ask us to attach a statement noting that you consider the information to be inaccurate.

Export & deletion (erasure)

We are introducing self-service data tools that let an account owner export a machine-readable copy of their business’s data and request erasure of personal information held in the account from within the platform. Until those tools are available to you, you can request an export or deletion by contacting our Privacy Officer and we will action it manually.

When you ask us to delete your account or personal data, we will delete or de-identify the information that is no longer required, except where we are permitted or required to retain it. Examples include financial records we must keep for tax and audit purposes (typically 7 years), information needed to resolve a dispute or enforce our agreements, and copies held in routine backups, which are overwritten on our normal backup cycle. See the “Data Retention” section above.

If you are an end customer of a VexOp+ business

Where your personal information was uploaded by a business that uses VexOp+ (for example, a trade business you are a customer of), that business is the entity that controls your information and we act as its processor. Please direct your access, correction or deletion request to that business in the first instance; we will assist them to respond and will act on their instructions in line with this policy.

The Services are intended for use by businesses and their employees who are at least 18 years of age. We do not knowingly collect personal information from children under 18. If you become aware that a child has provided us with personal information, please contact us so we can delete it.

We may update this policy from time to time. When we make material changes we will notify you by email and/or by displaying a prominent notice within the Services. The “Last updated” date at the top of this policy reflects when it was most recently changed.

If you believe we have handled your personal information in a way that breaches the APPs, please contact us first using the details below. We will acknowledge your complaint within 10 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

For privacy-related questions, requests or complaints, contact our Privacy Officer: