Privacy Policy

1. Introduction

1.1 This Privacy Policy explains how Matora [Pty Ltd] (ABN [to be inserted upon incorporation]), trading as Matora ("we", "us", "our"), collects, uses, stores, discloses, and protects personal information in connection with the Matora application and related services (the "Service"). The Service is a report-building application that enables users to organise job-based data (including images, text, and audio recordings) and generate professional reports.

1.2 We are committed to complying with the Australian Privacy Principles ("APPs") set out in Schedule 1 of the Privacy Act 1988 (Cth) ("Privacy Act").

1.3 By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

1.4 This Privacy Policy applies to the Matora iOS and iPad application ("App"), any associated web-based services, and any other platforms through which we may offer the Service.

1.5 It applies both to account holders and to people who have no account with us but whose information reaches us through the Service, including anyone who uses a customer portal, a quote or report link, or a public enquiry form operated by one of our users. Section 3.12 describes what we collect from those people, and Section 11.8 describes how they may exercise their rights.

2. Who We Are

2.1 Matora [Pty Ltd] (ABN [to be inserted upon incorporation]) is an Australian entity based in Victoria.

2.2 Our contact details are set out in Section 20 of this Privacy Policy.

3. Information We Collect

3.1 We collect the following categories of personal information in connection with the Service:

3.2 Account Information

When you create an account, we collect your name, email address, company name, business details, and role.

3.3 Job Data

3.3.1 The Service enables you to create and manage job records, which may include job descriptions, site addresses, client details, notes, and custom fields.

3.3.2 Where you input personal information relating to your clients or other third parties into the Service, you are the data controller (or equivalent under applicable law) for that information, and Matora acts as a data processor on your behalf. You are responsible for ensuring that you have obtained all necessary consents and authorisations before entering third-party personal information into the Service.

3.4 Media

3.4.1 The Service allows you to capture or upload photographs and record audio within the App. Audio recordings may be transcribed using on-device speech recognition provided by your device's operating system (Apple Speech framework). Transcription is performed entirely on your device and audio data is not transmitted to external servers for transcription purposes.

3.4.2 Photographs may contain identifiable information about individuals or locations. Audio recordings may capture the voices of individuals present during recording. You are responsible for obtaining any necessary consents before capturing photographs or recording audio using the Service.

3.5 Reports

The Service enables you to generate PDF reports using templates. Generated reports, report templates, and associated data are stored as part of your account.

3.6 Financial Data

The Service may store quotes, cost estimates, and labour rates that you enter. We do not collect or store payment card information directly; payment processing is managed by Apple (for in-app purchases) or Stripe (for web-based subscriptions).

3.7 Device Information

3.7.1 We collect information about the device you use to access the Service, including device type, operating system version, application version, and device identifiers used for synchronisation purposes.

3.8 Usage Data

3.8.1 We collect data relating to your use of the Service, including feature usage statistics, crash logs, and performance data. On our website, this data is collected using Microsoft Clarity, which provides analytics, heatmaps, and session recordings, and Tawk.to, which provides our live chat function. The Matora App does not currently incorporate third-party analytics or crash-reporting tools; if we introduce them, we will update this Privacy Policy to identify the providers. This information helps us improve the Service and diagnose technical issues.

3.8.2 We also operate our own first-party measurement of pages served from our website. For each page view we record the page path, the time, the referring page, the network address, an approximate location (city, region, country, and approximate coordinates) derived from that address by our hosting provider, the device type and browser user agent, and a randomly generated session identifier held in the browser's session storage until the tab is closed. Where a significant action is completed on a page, we record that it occurred, without recording what was submitted.

3.8.3 This first-party measurement operates on all pages served from our website, including the customer-facing pages described in Section 3.12. It is used by us to understand how the Service is used and is not disclosed to the company whose customer opened the page. It records that a page was used, not what was on it: it never captures the contents of a message, an uploaded file, a form answer, or a report.

3.8.4 Microsoft Clarity and Tawk.to are deliberately not loaded on customer portals, quote pages, report pages, or enquiry forms. Session recording and heatmapping do not run on any page through which a Recipient submits information.

3.9 Subscription Data

We collect information about your subscription tier and billing status. Subscription payments are managed by Apple (for in-app purchases) or Stripe (for web-based subscriptions).

3.10 Location Information

With your permission, the Service accesses your device's location to display the location of a job site on a map and to associate location information with your job records. The App may collect approximate (coarse) location data for this purpose. You can enable or disable location access at any time through your device settings. If you decline location access, location-dependent features will be unavailable, but you may otherwise continue to use the Service.

3.11 Calendar and Reminders Access

With your permission, the Service can access your device's calendar and reminders to sync scheduled site visits and job appointments so that they appear alongside your other events. This information is processed through your operating system's calendar and reminders on your device. You can enable or disable this access at any time through your device settings.

3.12 Customer Portal and Hosted Link Information

3.12.1 Where you use the customer portal, a quote link, a report share link, or a public enquiry form, we collect personal information directly from the person who uses that link or form (a "Recipient"). A Recipient does not hold an account with us. As set out in Section 3.3.2, you are the entity that collects that information and we hold it on your behalf.

3.12.2 The information collected through a customer portal comprises:

• Identity and contact details: the Recipient's name, and the email address or mobile number you supplied in order to send them the link, together with whether they are contacted by email or SMS.
• Content they submit: messages they send, answers to information requests, and files or photographs they upload.
• Activity: when the portal link was first opened, when a report was viewed or downloaded, and which site visit time they selected.
• Acceptance evidence: where a report or quote is delivered for acceptance, the decision made, the name entered, the date and time, the exact wording of the declaration displayed at the moment of the decision, and the network address and browser user agent from which the decision was submitted. This information is recorded so the decision can be substantiated if later disputed, and is retained only for reports that receive a response.
• Deletion requests: where a Recipient asks for information to be deleted, the request, the reason given, and its outcome.

3.12.3 Access to a customer portal, quote link, or share link is by possession of the link. We do not create an account, set a password, or verify the identity of the person opening a link. A link may be revoked by you at any time.

3.12.4 We apply per-network-address rate limiting to the anonymous endpoints serving these pages in order to prevent abuse. Those counters retain the network address for approximately one hour and are then deleted. Enquiry form submissions store only a one-way hashed form of the network address, from which the address cannot be recovered.

3.12.5 We provide each Recipient with a plain-language notice, reachable from the page itself, describing what is collected, why, who else sees it, how long it is kept, and how to seek access, correction, or deletion. That notice covers the specific page in question and is not a privacy policy for your business.

4. How We Collect Information

We collect personal information in the following ways:

• Directly from you when you create an account, enter data into the Service, or contact us.
• Automatically when you use the Service, including device information and usage data.
• Directly from your clients and other third parties when they use a customer portal, quote link, report share link, or public enquiry form that you operate through the Service. We collect that information on your behalf, as described in Sections 3.3.2 and 3.12.
• From Apple when you make in-app purchases or subscribe to the Service.
• When you share reports via your device's native sharing functionality, or when we deliver a report on your behalf via a hosted link.
• From third-party integrations that you choose to enable.

5. How We Use Information

5.1 We use your personal information for the following purposes:

• To provide, maintain, and improve the Service.
• To create and manage your account.
• To process and manage your subscription.
• To enable you to create, store, and manage job data and generate reports.
• To enable you to share reports via your device's native sharing functionality and to send links to clients for quote acceptance.
• To operate customer portals, hosted links, and public enquiry forms on your behalf, including delivering reports to the people you nominate, recording their acceptance decisions, and passing their messages, files, and requests to you.
• To send emails and, where you have selected it, SMS messages to your clients on your behalf and in your business name.
• To synchronise your data across devices using cloud storage.
• To provide customer support and respond to your enquiries.
• To monitor and analyse usage trends and improve the user experience.
• To detect, prevent, and address technical issues and security threats.
• To comply with legal obligations.

5.2 We do not use your personal information for advertising purposes. We do not sell your personal information. We do not share your personal information with advertisers.

6. Legal Basis for Processing

Under Australian privacy law, we collect and process personal information on the basis that it is reasonably necessary for, or directly related to, one or more of our functions or activities. We only collect personal information by lawful and fair means.

For users located in the European Union or United Kingdom, we process personal information on the lawful bases set out in Section 16 of this Privacy Policy.

7. Data Storage and Security

7.1 Your data is stored in the following locations:

• Local device storage: Job data, media, and reports are stored locally on your device. This data remains under your control and is protected by your device's security settings.
• Cloud storage: When you use cloud synchronisation, your data is stored on servers operated by Supabase, our cloud infrastructure provider, located in Sydney, Australia (AWS ap-southeast-2 region). If Supabase changes its server locations, we will update this Privacy Policy accordingly.

7.2 We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, and regular security assessments.

7.3 No method of transmission over the internet or method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

7.4 You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account.

8. Data Retention

8.1 We retain your personal information for as long as your account is active or as needed to provide you with the Service.

8.2 If you delete your account, we will delete or de-identify your personal information within thirty (30) days, except where we are required or permitted to retain it by law. Records required for tax, legal reporting, or auditing purposes may be retained for up to seven (7) years in accordance with the Income Tax Assessment Act 1997 (Cth) and other applicable legislation.

8.3 Data stored locally on your device is under your control and can be deleted by uninstalling the App or deleting data within the App.

8.4 We may retain de-identified or aggregated data that cannot reasonably be used to identify you for analytical and statistical purposes.

8.5 Information collected through a customer portal, hosted link, or public enquiry form is part of the job record it belongs to and is retained for as long as you retain that job record, because it is your data and the decision is yours. Specific exceptions apply:

• An enquiry that is declined or marked as spam is deleted automatically after thirty (30) days.
• Files attached to a form or request that was never submitted are deleted after one (1) day.
• Rate limiting counters holding a network address are deleted after approximately one (1) hour.
• Revoking a link or closing a portal ends the Recipient's access immediately but does not delete the job record, which remains yours.

8.6 Where you delete your account, information collected through your customer portals and enquiry forms is deleted with the rest of your data in accordance with Section 8.2.

9. Sharing and Disclosure

We may disclose your personal information in the following circumstances:

• Service providers: We share information with third-party service providers who assist us in operating the Service, including cloud hosting (Supabase), payment processing, and analytics. These providers are bound by contractual obligations to protect your information.
• Report sharing: When you share reports via your device's native sharing functionality, report content (which may include personal information) is shared with the recipients you select.
• Hosted links and customer portals: When you deliver a report, quote, message, or request by hosted link, we host that content and serve it to the person holding the link, and we send the notification emails and SMS messages that carry it, in your business name. Report content shown this way may include personal information about your clients and about people appearing in photographs.
• Back to you: Information a Recipient submits through a portal or enquiry form is disclosed to you and to the staff of your company who have permission to see it. It is never disclosed to another company using the Service.
• Legal requirements: We may disclose your information where required by law, regulation, legal process, or governmental request.
• Business transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you of any such change.
• With your consent: We may share your information for any other purpose with your consent.

10. Third-Party Services

10.1 The Service integrates with or relies on the following third-party services:

10.2 Apple

The App is distributed through the Apple App Store. Apple processes in-app purchases and subscriptions in accordance with Apple's privacy policy. We receive limited transaction information from Apple but do not receive your payment card details.

10.3 Supabase

We use Supabase as our cloud infrastructure provider for data storage and synchronisation. Supabase processes your data in accordance with its privacy policy and data processing agreement with us. Data is stored in the AWS ap-southeast-2 (Sydney, Australia) region.

10.4 Web Payment Processor

For web-based subscriptions, payments are processed by Stripe, our third-party payment processor. We do not receive or store your full payment card details. Stripe handles your financial information in accordance with its own privacy policy and PCI DSS requirements. Stripe may process and store your information overseas, including in the United States.

10.5 Analytics and Crash Reporting

We use Microsoft Clarity on our website to understand how visitors use our site through analytics, heatmaps, and session recordings, and Tawk.to to provide live chat support. These tools may collect device information, IP address, usage data, and interaction data, and may set cookies as described in Section 13. The Matora App does not currently use third-party analytics or crash-reporting services. If we introduce such services in the App, we will update this Privacy Policy to identify the providers.

10.6 Calendar and Accounting Integrations

On Professional and Business subscription tiers, the Service may integrate with calendar services and accounting platforms such as Xero and QuickBooks Online. If you enable these integrations, job data and client information may be shared with these third-party services in accordance with their respective privacy policies. You control whether to enable these integrations and what data is shared.

10.7 Email Delivery

We use Resend to deliver the emails sent through the Service, including customer portal invitations and notifications, quote and report emails, enquiry acknowledgements, and account emails. Resend receives the recipient's email address, the message content, and delivery and engagement events such as whether a message was delivered, bounced, or marked as spam, which we use to maintain a suppression list and stop sending to addresses that reject our mail. Resend may process this information in the United States.

10.8 Website and Customer Page Hosting

Our website, and the customer-facing pages served from it (customer portals, quote pages, hosted report pages, and public enquiry forms), are hosted by Vercel. Vercel processes the network address of every visitor in order to serve the page, and supplies us with the approximate location described in Section 3.8.2. Vercel may process this information in the United States and other jurisdictions.

10.9 We encourage you to review the privacy policies of all third-party services that interact with the Service.

11. Your Rights

11.1 Under the Australian Privacy Principles, you have the following rights in relation to your personal information:

11.2 Right of Access

You have the right to request access to the personal information we hold about you. You can access most of your information directly through the App. For information that is not accessible through the App, you may contact us using the details in Section 20.

11.3 Right of Correction

You have the right to request correction of any personal information we hold about you that is inaccurate, out of date, incomplete, irrelevant, or misleading. You can correct most of your information directly through the App.

11.4 Right of Deletion

You have the right to request deletion of your personal information. You can delete your account and associated data through the App or by contacting us. Deletion is subject to our data retention obligations as set out in Section 8.

11.5 Data Portability

You have the right to request a copy of your personal information in a structured, commonly used, and machine-readable format. The Service enables you to export your data, including reports in PDF format.

11.6 Right to Withdraw Consent

You have the right to withdraw your consent to the collection and processing of your personal information at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You may withdraw consent by deleting your account or contacting us.

11.7 Right to Opt Out of Direct Marketing

You have the right to opt out of receiving direct marketing communications from us at any time. We do not currently engage in direct marketing, but if we do so in the future, you will be able to opt out by following the unsubscribe instructions in any marketing communication or by contacting us.

11.8 Individuals Who Do Not Hold an Account

If you used a customer portal, quote link, hosted report link, or public enquiry form, you do not hold an account with us and the information you provided is held by us on behalf of the business you were dealing with. The rights in this Section apply to you, and the first place to exercise them is that business, because they hold the record and they decide what happens to it.

A customer portal includes a deletion request facility. A request submitted through it is recorded, and the business is notified so they can approve or decline it. We do not decide those requests and we do not delete a business's job records on the instruction of a third party.

Messages, files, and acceptance decisions submitted through a portal cannot be edited or withdrawn by the person who submitted them. They form the record of what was communicated and agreed between two parties, and allowing either side to alter it would deprive both of a reliable record.

If you cannot reach the business, or you are not satisfied with how they have handled your request, contact us at privacy@matora.app and we will deal with it or pass it on. Where applicable law requires us to act on your request directly, we will do so and will notify the business. You may also complain to the Office of the Australian Information Commissioner as set out in Section 19.

11.9 To exercise any of your rights, please contact us using the details in Section 20. We may need to verify your identity before processing your request.

11.10 There is no charge for making a request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

12. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act 1988 (Cth).

We will take all reasonable steps to contain and remediate any data breach and to minimise any resulting harm.

13. Cookies and Local Storage

13.1 The Matora App does not use cookies. The App uses local on-device storage (such as AsyncStorage) and device identifiers as described in Section 3.7 to store preferences and enable functionality.

13.2 Our website and other web-based services use cookies and similar technologies to enhance your experience, analyse usage, and provide functionality. In particular, Microsoft Clarity and Tawk.to (described in Section 10) may set cookies on our website. Cookies are small text files stored on your device by your web browser.

13.3 You can manage cookie preferences through your web browser settings. Disabling cookies may affect the functionality of our web-based services.

13.4 We do not use cookies or similar technologies for advertising or cross-context behavioural advertising purposes.

13.5 Separately from cookies, the customer-facing pages we host store a randomly generated session identifier in the browser's session storage, which is cleared when the tab is closed, so that repeat views within one visit are not counted as separate visitors. Pages on which a form can be filled in also store a draft of what has been typed in the browser's local storage, so that an interrupted form is not lost; that draft stays on the device and is removed once the form is submitted.

14. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information as soon as practicable.

If you are a parent or guardian and believe that your child has provided personal information to us, please contact us using the details in Section 20.

15. Sensitive Information

15.1 We do not intentionally collect sensitive information as defined under the Privacy Act (such as health information, biometric information, or racial or ethnic origin). However, photographs or audio recordings you upload to the Service may incidentally contain sensitive information (for example, images that capture individuals' physical features or audio that captures voice characteristics).

15.2 By uploading photographs or audio recordings to the Service, you consent to the collection of any sensitive information incidentally contained in that media, to the extent required by APP 3.3. You are responsible for ensuring that you have obtained any necessary consents from individuals whose sensitive information may be captured in media you upload.

16. International Data Transfers and Overseas Users

16.1 As an Australian-based service, your data is primarily stored and processed in Australia. However, some third-party service providers may process data in other jurisdictions.

16.2 Where we transfer personal information overseas, we rely on the accountability approach under APP 8.1 of the Australian Privacy Principles. We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the APPs, including through contractual arrangements that require recipients to protect personal information to a standard comparable to the protections afforded under the Privacy Act. We remain accountable for any acts or practices of overseas recipients that would breach the APPs.

16.3 As at the date of this Privacy Policy, our primary cloud infrastructure (Supabase) is hosted in Sydney, Australia (AWS ap-southeast-2 region). Certain other service providers may process limited personal information overseas: Stripe (payment processing), Resend (email delivery), Vercel (website and customer page hosting), and our website analytics and live-chat providers, Microsoft Clarity and Tawk.to, may process information in the United States and other jurisdictions. Personal information collected through a customer portal or enquiry form is stored in Australia; the network address and page path of a visit to one of those pages passes through Vercel in the course of serving the page, and the notification emails carrying such a link pass through Resend.

16.4 Users in the European Union and United Kingdom

If you are located in the European Economic Area (EEA) or United Kingdom (UK), the following additional information applies to you:

• 1. Lawful bases for processing: We process your personal data on the following lawful bases under the General Data Protection Regulation (GDPR):
  • a. performance of our contract with you (Article 6(1)(b));
  • b. your consent (Article 6(1)(a)), which you may withdraw at any time;
  • c. our legitimate interests (Article 6(1)(f)), including improving the Service and ensuring security; and
  • d. compliance with legal obligations (Article 6(1)(c)).
• 2. Data Protection Officer: We have not appointed a Data Protection Officer as we are not required to do so under Article 37 of the GDPR. For privacy-related enquiries, please contact us using the details in Section 20.
• 3. EU/UK Representative: We have not appointed an EU or UK representative under Article 27 of the GDPR. If required by applicable law, we will appoint a representative and update this Privacy Policy accordingly.
• 4. Transfer mechanisms: Where personal data is transferred outside the EEA or UK, we rely on the European Commission's adequacy decision for Australia (where applicable) or standard contractual clauses approved by the European Commission.
• 5. Automated decision-making: We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects on you.
• 6. Additional rights: In addition to the rights set out in Section 11, EEA and UK users have the right to lodge a complaint with their local supervisory authority.

16.5 Users in California, United States

If you are a California resident, the following additional information applies to you under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• 7. Categories of personal information collected: identifiers, commercial information, internet or electronic network activity information, and geolocation data (as described in Section 3).
• 8. We do not sell your personal information. We do not share your personal information for cross-context behavioural advertising.
• 9. You have the right to: (i) know what personal information we collect, use, and disclose; (ii) request deletion of your personal information; (iii) opt out of the sale or sharing of personal information (not applicable as we do not sell or share); and (iv) not be discriminated against for exercising your privacy rights.
• 10. To exercise your rights, contact us using the details in Section 20.

17. Data Processing Agreement

17.1 Where you use the Service to process personal information of your clients or other third parties and require a Data Processing Agreement (DPA) to satisfy your obligations under applicable privacy legislation (including the GDPR), we will make a DPA addendum available upon request. Please contact us using the details in Section 20 to request a DPA.

18. Changes to This Policy

18.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

18.2 We will notify you of any material changes by posting the updated Privacy Policy within the App and updating the "Last updated" date at the top of this document. Where required by law, we will provide additional notice (such as an in-app notification or email).

18.3 Your continued use of the Service after any changes to this Privacy Policy constitutes your acceptance of the updated policy. For material changes to this Privacy Policy, if you do not agree to the changes, your sole remedy is to cancel your subscription within fourteen (14) days of the change taking effect and receive a pro-rata refund of any prepaid subscription fees for the unused portion of your subscription period.

18.4 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal information.

19. Complaints

If you believe we have breached the Australian Privacy Principles or otherwise mishandled your personal information, you may lodge a complaint with us using the contact details in Section 20. We will investigate your complaint and respond to you within a reasonable period.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Online: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001, Australia

20. Contact Us

20.1 If you have any questions or concerns about this Privacy Policy or our handling of your personal information, please contact us:

20.2 We will respond to your enquiry within a reasonable period.