Privacy Policy

• Your account. Details about you as a Blu Koller user, such as your name and email. We decide how this is used, as set out in this policy.
• Information businesses keep in Blu Koller. Businesses use Blu Koller to record their customers, service addresses, jobs, workers and so on. We hold and process that information on the business's behalf and only to provide the Service. The business is responsible for it. If you are a customer or worker of a business that uses Blu Koller, please contact that business first about your information; we will help it respond.

• Account details: your name, email address and password. Passwords are stored only in a scrambled (hashed) form by our sign-in provider; we can't see them. Blu Koller staff accounts also use an authenticator app for two-step sign-in.
• Business details: business name, country, time zone, currency, trades, tax settings and plan.
• What you and your team enter: customers and their contact details, service addresses and access instructions, jobs, tasks, schedules, notes, quotes, invoices, payment records, price-book items, worker details (including pay rates and ABNs where entered) and clock-in and clock-out times.
• Technical information: when you sign in or use the Service, our hosting providers record things like your IP address, browser or device type, the time and any errors, to keep the Service secure and working.
• On your device: the app keeps you signed in (in the phone's secure storage, or a cookie in your browser) and remembers your light/dark appearance choice.

We don't collect your phone's location, contacts or photos, and we don't use advertising identifiers.

• to provide the Service: sign-in, scheduling, documents, maps and everything else in the app;
• to keep accounts and businesses secure and separate, and to prevent misuse;
• to send account emails, such as confirming your email or resetting your password;
• to answer your questions and fix problems;
• to improve the Service, using usage and error information;
• to meet our legal obligations.

We don't sell personal information, we don't show advertising, and we don't use a business's customer information for our own marketing.

We use these service providers to run Blu Koller. They may only use the information to provide their service to us.

• Supabase (database, sign-in and storage). Your Blu Koller data is stored in Sydney, Australia, on Amazon Web Services.
• Vercel (hosting the web app), which serves pages from its global network, including the United States.
• Google Maps Platform (address search, map locations, travel times and maps). Addresses you type into address search, saved service addresses, and pairs of job addresses for travel times are sent to Google. Maps shown in the web app are loaded from Google. See the Google Privacy Policy.
• Resend (sending account emails such as confirmations and password resets), based in the United States.
• Google Play and Apple (delivering the mobile app), under their own privacy policies.

When paid plans start, a payment provider will process card payments; we will update this policy first. We may also share information if the law requires it, to protect people's safety or our rights, or as part of a sale or restructure of our business (the new owner would have to follow this policy).

Some of the providers above handle information outside Australia, mainly in the United States. We choose providers with strong security and contracts that protect personal information, and we take reasonable steps so that overseas recipients handle it in line with the Australian Privacy Principles.

• All connections to Blu Koller are encrypted (HTTPS), and our providers encrypt stored data.
• Every business's information is kept separate by database rules, and each person only sees what their role in that business allows.
• Changes go through checks on our servers, not just in the app.
• Blu Koller staff access is limited and needs two-step sign-in.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will tell you and the regulator as the law requires.

We keep information while your account or business is active. When an account or business is closed, we delete or anonymise its information within a reasonable time (see our Terms of Service), unless the law requires us to keep it longer. Businesses are responsible for keeping their own records, such as invoices, for as long as tax law requires. Our providers keep technical logs for a limited time.

• You can see and correct your name and the information your role allows in the app.
• You can ask us for a copy of the personal information we hold about you, or to correct it.
• Depending on where you live (for example the UK or New Zealand), you may have extra rights, such as objecting to some uses or receiving your information in a portable form.

Email [CONTACT EMAIL]. We may need to confirm your identity first, and we aim to reply within 30 days.

To delete your Blu Koller account, email [CONTACT EMAIL] from the email address you sign in with and ask us to delete it. We will confirm and delete your account and personal details within 30 days.

If you own a business, deleting your account also closes the business, and its information is deleted as described above (the owner can ask for a copy first). If you are a team member of someone else's business, the business keeps its own records of the work you did for it, such as job history and timesheets.

The web app only uses cookies needed to keep you signed in and secure. We don't use advertising or tracking cookies.

Blu Koller is for businesses and is not meant for anyone under 18.

We may update this policy. The date at the top shows the current version, and we will tell you by email or in the app about significant changes.

Contact us at [CONTACT EMAIL] ([COMPANY NAME], ABN [ABN]). If you aren't happy with our answer, you can complain to the Office of the Australian Information Commissioner, or the privacy regulator where you live, such as the New Zealand Privacy Commissioner or the UK Information Commissioner's Office.