Privacy Policy

1. Who we are

JobNest.au ("we", "us") operates an online marketplace connecting customers with home service providers. This policy explains how we collect, use, disclose, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Our contact details are in Section 12.

2. Information we collect

We collect personal information that is necessary for the operation of the marketplace. The information we collect depends on whether you are a customer or a provider:

• Customers: name, email address, mobile number, suburb and postcode, job details (description, photos, preferred date and time, safety hazards, budget), and payment information (processed by Stripe — we do not store card numbers).
• Providers: business name, trading name, ABN, contact person, business email, business phone, business address, service areas, operating states, service categories and subcategories, availability and working hours, bio and business description, compliance documents (licences, insurance, qualifications), and payout/banking details (via Stripe Connect, where and when enabled).
• Job information: category, subcategory, description, location (suburb, postcode, and address — shared with the provider only after a quote or booking), preferred date and time, photos, budget, safety hazard disclosures, and access instructions.
• Messages: the content of messages sent through the platform's in-job messaging system, which are visible to the participants and JobNest.au administrators and may be forwarded to our support inbox if reported.
• Reviews: review text, ratings, and any photos submitted by customers after job completion.
• Payment information: transaction records (amounts, dates, commission, refunds) processed by Stripe. We store transaction metadata in our Payment Ledger but do not store card numbers or CVVs.
• Provider compliance documents: copies of licences, insurance certificates, and qualifications, stored in private storage and reviewed only by JobNest.au administrators.
• Banking/payout information: where Stripe Connect is enabled, bank account details for provider payouts are collected and stored by Stripe. JobNest.au stores a reference to the payout account, not the bank account number itself.
• Usage and device/technical information: pages visited, interactions with the service, messages sent, browser type, and device information collected through normal platform operation.

3. How we collect information

We collect personal information directly from you when you register, post a job, send a quote, create a deal, update your profile, or contact support. We also collect usage and technical information automatically when you use the platform (e.g. through standard web server logs). Payment information is collected and processed by Stripe; we receive transaction metadata but not card details.

If you do not provide certain information, we may not be able to provide the service (e.g. we cannot facilitate a booking without a suburb and postcode or connect you to a provider without a job description).

4. How we use your information

• To connect customers with providers, facilitate quotes, bookings, and service delivery.
• To process payments through Stripe and issue refunds.
• To send operational notifications (new quotes, booking updates, payment confirmations, inspection requests, extra charge requests, dispute updates, cancellation updates). These are necessary for the service and cannot be opted out of.
• To verify provider compliance and display trust indicators (e.g. "Verified" badge).
• To facilitate inspections, extra charges, rescheduling, cancellations, and disputes.
• To send marketing communications (e.g. Local Deals, promotions) — only with your consent. You can opt out at any time.
• To match Deal Alerts (customer) and Demand Alerts (provider) with relevant listings and jobs.
• To maintain audit logs, transaction records, and dispute records.
• To comply with legal, tax, and regulatory obligations.
• To operate, maintain, secure, and improve the platform.

5. How we disclose your information

Your personal information is only disclosed when necessary for the operation of the marketplace:

• Customer → Provider: your name, contact details, and address are shared with a Provider only after a quote or booking relationship exists. Before that, a Provider can only see your first name and the job details (not your email, mobile, or full address).
• Provider → Customer: the Provider's business name, public profile (bio, categories, service areas, verified status, rating, reviews) is visible to customers.
• Stripe: payment processing and refunds. Stripe processes card data; we do not store card numbers.
• Resend: transactional and marketing email delivery. Resend receives the email address, recipient name, and email content necessary to deliver the message.
• Gmail (Google): we use an authorised Gmail integration for sending certain transactional and marketing emails on our behalf.
• Base44 (infrastructure provider): the JobNest.au platform is hosted on Base44, which provides the application hosting, database, authentication, and file storage infrastructure. Your data is stored on Base44's servers.
• JobNest.au administrators: may access your data for verification, dispute resolution, support, moderation, and platform administration.
• Legal compliance: where required by law, court order, or government authority.

We never sell your personal information to third parties.

6. Overseas disclosure

Your personal information may be disclosed to, or stored by, third-party service providers located outside Australia, including:

• Stripe (United States / Ireland): payment processing and refunds.
• Resend (United States): email delivery.
• Google / Gmail (United States): email sending via our authorised Gmail integration.
• Base44 (cloud infrastructure): application hosting, database, and file storage — the location of Base44's servers should be confirmed.

Where your personal information is disclosed to overseas recipients, we take reasonable steps to ensure it is handled in accordance with the Privacy Act and APP 8 (cross-border disclosure). The specific data residency and cross-border disclosure arrangements for each provider should be confirmed and documented before launch.

7. Provider compliance documents

Provider compliance documents (licences, insurance, qualifications) are stored in private storage with access-controlled signed URLs. They are never displayed on public profiles. Only JobNest.au administrators can review them for verification purposes. A daily document expiry workflow checks for expiring documents and may flag or suspend a provider profile accordingly.

8. Data security

We use row-level security (RLS) to ensure that customers can only access their own data and providers can only access data relevant to their authorised jobs. Payment details are handled by Stripe — we do not store card numbers or CVVs. Sensitive compliance documents are stored in private storage with access-controlled signed URLs. Backend functions enforce server-side authorisation for all sensitive operations (e.g. payment, refunds, profile updates, dispute creation). Administrative actions are recorded in an audit log.

No method of transmission or storage is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee absolute security.

9. Marketing and operational communications

We send two types of communications:

• Operational notifications (new quotes, booking updates, payment confirmations, inspection requests, extra charges, disputes, cancellations, rescheduling): these are necessary for the service and are always sent. They cannot be opted out of.
• Marketing communications (Local Deals, promotions, demand alerts, deal alerts): these are sent only with your consent. You can opt out at any time via your email preferences or the unsubscribe link in any marketing email.

10. Data retention and account deletion

We retain personal information only for as long as necessary for the purposes set out in this policy, and as required by law.

Account deletion: You can request account deletion through your settings. Account deletion is permanent. When you delete your account:

• Your user account, login, deal alerts, demand alerts, email preferences, and in-app notifications are deleted.
• Your provider profile (if applicable) is suspended, not deleted — personal contact details are cleared, but the record remains so that bookings, payments, and disputes that reference it stay intact and auditable.
• Your active Local Deals are deactivated (not deleted) so that redemption and booking history is preserved.
• Transaction records (jobs, bookings, quotes, payments, refunds, disputes, inspections, cancellations, extra charges, reviews, and messages) are retained for legal, tax, audit, and dispute resolution purposes. These records reference other parties and cannot be deleted unilaterally.

Financial and transaction records are retained for as long as necessary to comply with legal, tax (including ATO record-keeping requirements), and dispute resolution obligations. The specific retention periods should be confirmed with a legal or compliance professional.

11. Your rights — access and correction

You have the right to access and correct your personal information. You can view and update most of your information through your account settings. For provider profiles, updates to protected fields (verification status, rating, workload) are processed through JobNest.au's backend to ensure integrity.

To request access to, correction of, or deletion of your personal information, or to make a privacy complaint, contact support@jobnest.au. We will respond to your request within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC).

12. Contact and privacy complaints

For privacy questions, access/correction requests, or complaints, contact us at support@jobnest.au. If you have a privacy complaint, we will acknowledge it and attempt to resolve it. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.

13. Future features — lead/referral model

JobNest.au may, in the future, introduce a paid lead or referral model where customer enquiries could be referred to businesses outside the JobNest.au marketplace. This is not currently part of the platform. If introduced, it would require:

• Updated disclosure in this Privacy Policy before implementation.
• Customer consent (opt-in or opt-out, as determined by legal advice) before any referral occurs.
• Privacy impact assessment and review against APP 6 (use and disclosure) and APP 8 (cross-border disclosure).
• Determination of whether sharing customer information for referrals constitutes "selling" personal information and whether additional consent or disclosure is required.

Until such a model is formally introduced, reviewed, and disclosed, JobNest.au does not sell customer information or refer customer enquiries to external businesses.

ITEMS FOR AUSTRALIAN LEGAL REVIEW

The following provisions require confirmation by a qualified Australian lawyer before launch:

• Privacy Act / APP compliance: Confirm this policy meets all 13 APPs, particularly APP 1 (open and transparent management), APP 3 (collection), APP 5 (notification), APP 6 (use and disclosure), APP 8 (cross-border disclosure), APP 11 (security), and APP 12 (access and correction).
• Overseas disclosure: Confirm the cross-border disclosure arrangements for Stripe, Resend, Google, and Base44 comply with APP 8, and that appropriate contractual safeguards or consent mechanisms are in place.
• Data residency: Confirm where data is actually stored (Base44 server location) and whether any notification or consent is required.
• Data retention: Confirm the retention periods for financial records, messages, compliance documents, and dispute records comply with ATO requirements and APP 11.
• Account deletion: Confirm the "suspend not delete" approach for provider profiles and the retention of transaction records after account deletion is compliant with the Privacy Act and adequately disclosed.
• Provider compliance documents: Confirm the storage and access controls for sensitive compliance documents (licences, insurance) meet APP 11 security requirements, and whether additional consent is needed for storing these documents.
• Messages: Confirm the collection, storage, and potential disclosure (to support inbox) of message content is adequately disclosed and compliant.
• Marketing consent: Confirm the marketing opt-in/opt-out mechanism complies with the Spam Act 2003 and APP 6.
• Deal Alerts / Demand Alerts: Confirm the alert matching and notification practices are adequately disclosed (particularly that operational alerts cannot be opted out of).
• Lead/referral model: If introduced, obtain separate privacy legal advice before implementation — this is not covered by the current policy.
• Children's data: Confirm whether the platform could collect personal information about children and whether additional safeguards are required.
• Privacy complaints process: Confirm the complaints process aligns with APP 1 and the OAIC's expectations.