Draft for review. Version 2026-11-draft.

TradesM8 privacy policy

This policy explains how TradesM8 handles personal information under the Privacy Act 1988 and the Australian Privacy Principles.

Two kinds of information

• About the businesses that use TradesM8 and their staff: names, work email addresses, phone numbers, sign-in details from Microsoft, and billing details (card payments are handled by Stripe; we never see or store card numbers).
• About those businesses' customers: names, contact details, addresses, quotes, jobs and messages. Each business controls this information. We hold it on their behalf and only use it to run TradesM8 for them.

How we use it

To run the service: sign people in, send quotes, reminders and invoices the business asks us to send, bill for plans, give support when asked, keep the service secure, and meet legal obligations. We don't sell personal information or use customers' details for our own marketing.

Where it's kept

In Microsoft Azure data centres in Australia. Each business's information is kept separate from every other business's. A small number of trusted services help us run TradesM8, such as Microsoft (sign-in, email and hosting), Stripe (payments), Twilio (text messages) and Xero (if a business connects it). They only get what they need for that job.

M8, our AI helper, uses Anthropic's Claude through Amazon Web Services in Sydney. When someone asks M8 a question, the question and the records needed to answer it are sent there for that answer only. They aren't kept or used to train AI models. M8 never sends anything to customers.

Access, correction and deletion

A business can download all its information at any time from Settings. Customers of a business should contact that business first. You can also ask us at hello@tradesm8.au to see or correct information about you.

How long we keep it

While the business uses TradesM8, and for 30 days after it leaves so it can download its information. Then we delete it, except records we must keep by law.

Problems and complaints

If we have a data breach likely to cause serious harm, we'll tell the affected businesses and the Office of the Australian Information Commissioner as the law requires. If you're unhappy with how we've handled your information, email us first; if we can't sort it out, you can complain to the OAIC at oaic.gov.au.