Privacy Policy

Version 2026-10-20.1 · In effect from 20 October 2026

Samuel Charles Stephen O'Donnell (ABN 47 761 441 190) operates SiteTrack. We hold other companies’ drawings and their staff’s contact details, so we handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), whether or not the Act strictly applies to a business of our size. This policy explains what we collect, why, who sees it, and your rights. It forms part of the Terms of Service.

In short. We collect only what we need to run SiteTrack. Your company’s drawings and progress are kept separate from every other company’s. We do not sell personal information. Some service providers (such as payments and the drawing-reading service) may handle information overseas.

1. Who we are and our role

For the drawings and staff details that a company puts into SiteTrack, that company decides what is uploaded and who has access, and we act as its service provider, holding and processing the information only to run the service. For the account and billing details we need to run SiteTrack itself, we are the one responsible. Contact: sam.odonnell.au@gmail.com.

2. What we collect

Information	Examples and where it comes from
Account details	Name, work email, mobile or work phone number, role (manager, installer or viewer), company, a hashed password (we cannot read it), sign-in times, the version of these policies you accepted and when. Given by you or by your company’s manager.
Company drawings and job data	The PDF drawings you upload, the plan and schedule produced from them, job names, numbers, locations and revisions, and your company logo. These can include site addresses, lot numbers, street names and, sometimes, names of developers, owners or engineers shown on a drawing.
Work records	Who ticked each task and when, issues and notes raised on site (and their locations), earth readings and who recorded them, the activity log, your display preferences, and the quality-assurance inspection sheets staff complete (answers, readings, comments, typed name and a drawn signature), which are kept as PDFs with the job.
Billing information	Plan, trial and subscription status, invoices. Card details are collected and held only by Stripe; we see the card brand, expiry and last four digits at most.
Technical information	A session cookie to keep you signed in, IP address, device and browser type, and error logs used for security, rate limiting and fixing faults. We do not use advertising or tracking cookies. Your browser may store a copy of recent work on your device so SiteTrack works offline.

We do not knowingly collect sensitive information (such as health, biometric or political information) and SiteTrack is not for children. Please do not put that kind of information in notes, issues or comments. A drawn signature is treated as an image of a signature and is not used to identify anyone.

3. Why we use it

To create and secure accounts, sign you in, and let a company’s people work together.
To read your drawings into a plan and tick-list, show progress, produce QA sheets and reports, and send alerts to your company’s managers.
To bill and manage plans and trials, prevent fraud and handle disputes.
To support you, find and fix faults, improve and secure the service, and keep backups.
To meet legal obligations. We do not sell personal information and do not use it for third-party marketing. We may send service notices (billing, security, changes to our policies) to the email you registered.

Staff phone numbers are collected so a company’s managers can contact the people working on its jobs and so we can contact an account holder about the service. They are shown only to managers of the same company. We do not use them for marketing and do not routinely view them.

4. Who can see it

Your company. Managers see their company’s drawings, progress, users, contact details and who did what. Installers and viewers see the jobs and progress of their company but not who ticked what or when.
Other companies cannot. Each company’s data is separated from every other company’s.
Us. The administrator of SiteTrack can see account-level information (company name, plan and trial status, number of users and jobs, sign-in activity) to run the service. We do not browse companies’ drawings, jobs or progress. If a drawing fails to read, a copy of that drawing is kept for up to 30 days so the administrator can find and fix the problem, then deleted. Technical access to the stored data is limited to what is needed to run, secure, back up and repair the service, to respond to a request from you, or as the law requires.
Service providers who help us run SiteTrack: payment processing (Stripe), cloud hosting and storage, and an automated drawing-reading service that receives the pages of a drawing you upload so they can be read into a plan. They may use the information only to provide those services to us.
Others where the law requires, such as a court order or a regulator, to protect people or property, or in a sale or restructure of our business (in which case the new owner must honour this policy).

5. Overseas disclosure (APP 8)

Some of our providers, including Stripe and the drawing-reading service, are located or process data in other countries, most commonly the United States, and cloud hosting may be outside Australia. When we send information to them we take reasonable steps to make sure they handle it consistently with the APPs, for example by choosing providers with published privacy and security commitments. By using SiteTrack you consent to information being handled overseas in this way and acknowledge that APP 8.1 will then not apply and we will not be accountable under the Privacy Act for what those providers do. If you cannot accept this for a particular drawing, do not upload it.

6. Security, backups and breaches

Passwords are stored hashed. Connections should be run over HTTPS. Access to each company’s data is checked on every request. No system is perfectly secure, and we cannot guarantee that information will never be accessed, lost or disclosed without authority.
We keep automatic backups of the whole database for disaster recovery, kept for about 30 days and then overwritten. Information deleted from live data can remain in backups until they roll over.
If we suspect an eligible data breach we will assess it promptly and, if it is likely to result in serious harm, notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. Companies and users must keep their passwords secret and tell us straight away if they suspect an account has been compromised.

7. How long we keep it

We keep a company’s data while its account exists, including while it is read-only after a trial or cancellation. A company can delete jobs in the app, and can ask us in writing to close the account and delete its data; we will do so within a reasonable time (normally within 30 days), except for records we must keep by law (such as invoices, kept for 5 years). We may delete the data of an account that has been read-only for 90 days after notice to its registered email. A person who leaves a company can ask for their account to be removed; their past ticks, readings and notes may remain in the company’s job record, with their name, because they are part of that company’s work history.

8. Companies and their staff

A company that adds or approves staff must tell them that their name, contact details and work activity are recorded in SiteTrack and seen by the company’s managers, and must have the right to give us that information. This policy is the notice we give about our own handling (APP 5). The company, not us, is responsible for its own compliance with privacy, employment and workplace laws in how it uses SiteTrack.

9. Your rights: access, correction and complaints

You can ask to see the personal information we hold about you, and to correct it. People can update their own name, email and phone number under Settings > My details. Contact sam.odonnell.au@gmail.com for anything else. We may need to confirm who you are first, and for information held for a company we may refer you to that company.
If you have a complaint, contact us first. We will reply within 30 days. If you are not satisfied you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

10. Limits

This policy describes our practices and is not a promise that goes beyond the law. To the extent the law allows, we are not liable for loss arising from unauthorised access to or disclosure of information that results from events outside our reasonable control, from a user’s own act or failure to keep credentials safe, or from the acts of a company’s own managers and staff. Section 7 of the Terms of Service (limits on liability) applies to this policy.

11. Changes

We will update this policy when our practices change, and post the new version here with its date. For a material change we will also give notice in the app or by email.