Privacy Policy

Effective 6 October 2026 · Version 1.10

This policy explains how Investment Collective Capital Pty Ltd (ABN 43 684 516 854) — "we", "us" — handles personal information in the KeystonePal mobile app and this website. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

The short version: your business data is yours. It lives in Australia; only you, the people you invite into your business (as their role allows) and anyone in a Site Chat you share can see it; we don't sell it and we don't use it to train AI models; and you can export or permanently delete all of it from inside the app.

1. What we collect

Information you give us

• Account details — your email address and password (stored hashed, never in plain text).
• Business profile — business name, ABN, contact details, address, logo, rates and terms.
• Business records you create — customers, suppliers, workers, jobs, quotes, invoices, payments, purchase orders, expenses, assets and vehicles. These records commonly contain personal information about other people, such as your customers' names, addresses and phone numbers. You can also fill in a customer from your phone's contacts. The app uses your phone's own contact picker, so it sees only the contacts you pick, never your whole address book, and it keeps only the name, phone number, email and address, nothing else from the contact (no photo or birthday). Nothing is saved until you choose to add them.
• Voice recordings you make to create a quote, price a variation or add items.
• Worker and subcontractor details — names, contact details, rates, ABNs and, where you choose to record them, licence, ticket, induction-card and certificate numbers.
• Site dockets and signatures — daily plant/truck dockets you complete, including the supervisor's on-screen signature.
• Photos of job sites, receipts and documents you capture or upload.
• Documents you store in the Filing Cabinet, such as licences, insurances and certificates.
• Site Chat content — messages and attachments in a job chat, and the name a guest gives when they open your invite link.
• Ask conversations — the questions you ask Ask and the answers it gives, kept so you can look back at them. Only you can open your Ask history; nobody else in your business can. You can delete a conversation at any time, and all of them are deleted with your account (section 10 says how long backups last).
• Support correspondence, including problem reports you send from inside the app.

Information collected automatically

• Usage and diagnostic data — app version, device model, operating system, crash reports and error logs, and a log of AI feature usage and its cost to us. Crash reports go to Sentry (section 4) and include your account's internal ID, not your name or email, so we can find the problem you hit. They are not meant to contain anyone's details, but an error message can occasionally include text that was on screen at the time.
• Notification tokens — if you allow notifications, we store a token that lets us send them to your phone through Google Firebase (section 4). It is removed when you sign out, or when the phone stops accepting it.
• Approximate job locations — where you enter a job address, we convert it to map coordinates so the job can appear on your jobs map, and we use those coordinates to fetch weather forecasts for your work days.
• Approval evidence — when a customer approves a quote or variation through a link we send them, we record the time and the IP address of the approval as evidence.

Location information

KeystonePal collects precise device location only in the situations below. It never tracks anyone without their say-so: the only continuous recordings are a logbook trip you have started yourself, and a worker's location while clocked on, which only the worker can turn on:

• Vehicle logbook trips — if you use the GPS trip recorder, your route and distance are recorded from the moment you tap start until you tap stop, with a visible notification while recording (on iPhone, keep the app open while a trip records).
• Crew clock events — when a worker clocks in, clocks out or checks in at a site, whether in the app or using their clock-in link, a single location stamp is taken at that moment (if the worker allows it — a declined permission never blocks clocking in), together with the distance from the job site. Unless the worker has turned on location while clocked on (below), nothing is recorded between taps. The stamp and distance are part of the business's time records, which the business's office users can see, and the business must tell its crew about this (section 7). This applies whether the worker is an employee or a contractor.
• Site photos — when you take a photo for a job in the app and have already allowed location, we record where the photo was taken, so the business can see how far it was from the job site. The app never asks for location just to take a photo. Location data embedded in the photo file itself is removed before upload.
• Location while clocked on — if a worker turns this on themselves in the app (the business can ask, but only the worker can turn it on, and they can turn it off at any time), the app sends the phone's location to the business at most every 5 minutes, and only after the worker has moved about 250 metres, while they are clocked on, starting at clock-on and stopping at clock-off, with a notification or location indicator showing the whole time; the business's office users see the latest position on a map, the worker can see and delete their own trail for the day, and every position is deleted after 30 days.
• Weather and maps — job coordinates are used to fetch forecasts and show maps.

Information from services you connect

• Accounting (Xero) — if you connect Xero, we hold encrypted access tokens and the name of the organisation you connected. Invoices, quotes and bills you choose to push, and the customer or supplier details on them, are sent to Xero, and we read back whether an invoice has been paid.
• Accounting (MYOB) — if you connect MYOB, we hold encrypted access tokens and the name of the company file you connected. Invoices, quotes and bills you choose to push, and the customer or supplier details on them, are sent to MYOB, and we read back whether an invoice has been paid.
• Card payments (Stripe) — if you turn on card payments, we store your business's Stripe account ID and, for each card payment, the amount, whether it succeeded, and whether it was refunded or disputed. Your customer gives their card, and their email if Stripe asks for it, to Stripe on Stripe's own page. KeystonePal never sees or stores card numbers.
• Email (Microsoft Outlook) — if you connect a mailbox for the AI assistant, we hold encrypted access tokens and metadata and summaries only: sender, subject, date, a short preview and an AI-generated summary. We do not store the body of your emails. Message content is fetched from your provider when you open a thread and is discarded afterwards.

The phone assistant

If you switch on the AI phone assistant and divert missed calls to your assistant number, calls to that number are answered by an AI agent. For those calls we (and our voice providers) handle the call audio, a transcript, a recording, the caller's phone number and any details the caller leaves, so we can show you what happened and who to call back. The assistant identifies itself as an automated assistant at the start of every call. It only ever states prices you have pre-approved, and it takes a message with the caller’s details. If the business has turned on bookings, it can also offer a free time: it then stores the caller’s name, number, address and the job in their own words for the business to confirm or decline (or, only if the business has switched on hard booking, books the job in).

Texts customers send back: if a customer replies to a text the assistant sent, or texts your assistant number, the text is stored for the one business they replied to, so it can read it and quote from it. Texting STOP stops further texts from that number.

If you call a KeystonePal assistant number: your call is answered by an automated assistant that tells you at the start of the call that it is automated and that the call is recorded. The business you called receives the recording, a transcript and your number so they can call you back. To have a recording deleted, ask the business you called, or contact us at support@keystonepal.com.au.

Online booking page

If a business uses KeystonePal's online booking page, the name, phone number, email address, address and job details a customer enters there are sent to that business so it can confirm the booking, and are stored as that business's records. When the business confirms the booking, we text the customer at that number to say so.

Customer portal

If a business turns on its customer portal and you log in to it, we send a six-digit code to your email address and keep a scrambled (hashed) copy of it, which works for 10 minutes and is deleted within a day; once you are in, we keep a session record (when it was made and last used, and your browser's description of itself) for up to 30 days so you stay logged in, and the portal shows you only your own quotes, invoices, jobs, site assets and contracts.

Sensitive information

We do not seek sensitive information as defined by the Privacy Act. Documents you choose to store in the Filing Cabinet may incidentally contain it. Please don't upload sensitive information you don't need to keep.

2. Why we collect and use it

• To provide the app: creating quotes, jobs, invoices and reports, and syncing to services you connect.
• To run AI features you trigger — transcribing your voice notes, reading receipts, drafting text, summarising your inbox and answering questions about your own data.
• To send transactional messages such as sign-in and password emails, and messages you choose to send to your own customers.
• To keep the app working — diagnosing crashes, preventing abuse and enforcing fair-use limits.
• To meet our legal obligations.

We do not sell your personal information, and we do not use your business data to train AI models.

3. Automated decision-making

KeystonePal uses automated processing in a limited way. Where you connect a mailbox, the AI assistant automatically categorises messages, summarises them, estimates urgency and suggests which need a reply. Elsewhere, AI drafts quote line items, text and reminders. These are suggestions only. Nothing is sent, charged or committed without you reviewing and approving it, and no automated process makes a decision that produces a legal or similarly significant effect for you or your customers. You can turn these features off, or simply not use them.

4. Who we disclose it to

We share personal information only with service providers who help us run KeystonePal, and only for that purpose.

We may also disclose information where required by law, to enforce our Terms, or to protect someone's safety. If our business is ever sold or restructured, information may transfer to the new owner under this policy.

5. Google user data (Google sign-in and Gmail)

Where you choose to sign in with Google, or connect a Gmail mailbox to the AI assistant, KeystonePal receives data from Google APIs. This section sets out exactly what we receive, what we do with it, and what we never do with it. It applies in addition to the rest of this policy.

What we access.

• Google sign-in: your name, email address and profile picture, used only to create and identify your KeystonePal account.
• Gmail, and only if you connect a mailbox: the messages in that mailbox — senders, subjects, message bodies and attachments — and the ability to save a draft or send a message when you tell us to.

What we use it for. Google user data is used only to provide features you can see and have switched on: sorting your inbox, summarising a message or a thread, drafting a reply for you to review, reading a supplier invoice so it can be proposed as an expense, saving an email or attachment to your filing cabinet, and answering your questions about your own mail. Nothing is sent on your behalf without you reviewing and approving it first.

What we store, and where. Senders, subjects, snippets and the summaries we generate are stored in our database in Sydney, Australia, scoped to your account so that no other account can read them. Where you choose to save an email to your filing cabinet, the full message and its attachments are stored there as well. Access tokens for your Google account are encrypted and are never sent to the app on your phone. You can disconnect the mailbox at any time in the app, and you can revoke our access at any time from your Google Account at myaccount.google.com/permissions. Deleting your KeystonePal account permanently deletes this data, as set out in section 11.

Who else sees it. To provide the AI features above, the relevant message text or attachment is sent to our AI provider, xAI, which processes it and returns a result. xAI does not train its models on this data; it holds API requests encrypted for up to 30 days for auditing and then deletes them. We do not share Google user data with anyone else, we do not sell it, we do not use it for advertising, and we do not use it to train any AI model of our own.

Human access. No one at KeystonePal reads your mail. The only exceptions are where you specifically ask us to look at something in order to help you, where it is necessary for security — for example investigating abuse — or where the law requires it.

Limited Use. KeystonePal's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Sending information overseas (APP 8)

Your core business data is stored in Australia. Some processing happens overseas — most significantly, content you submit to AI features (voice recordings, photos, receipt images, questions you type or say to Ask, and the text of emails you ask the assistant to work on) is sent to xAI in the United States for processing and returned, and if you use the phone assistant, call audio, transcripts and recordings are processed by Retell AI in the United States. Crash reporting and subscription management also involve United States providers. By using these features you consent to that disclosure. We take reasonable steps to ensure overseas recipients handle your information consistently with the APPs, but overseas laws may differ from Australian law.

7. Your customers' and workers' information

When you enter details about your customers, suppliers or workers, you are responsible for that information: for collecting it lawfully, for telling those people how it will be used, and for having the right to enter it into KeystonePal. We handle it on your behalf as part of providing the service.

If you give a worker a clock-in link, or they clock on and off inside the app, each tap records the time and, with the worker's permission, their location at that moment. The link page tells the worker this plainly before they use it. As the employer, you must tell your crew that clock-ins record time and location — workplace surveillance laws in some states require written notice — and the app gives you a ready-made message for that purpose. The same applies to location while clocked on (section 1): only the worker can turn it on, and you must still tell your crew how their positions are used.

8. Site Chat

A Site Chat is visible to everyone the account holder invites to it, and an invite link can be forwarded. Anything put in a chat — messages, photos, documents, and the name a guest gives when they open the link — can be read by everyone in that chat. A guest is often someone else's customer or builder, so the name they give is their personal information: don't put anything in a chat you would not want every person holding the link to read. Content can be reported and removed; removed content may be retained for a period for moderation and safety purposes.

9. Security

• Data is encrypted in transit (HTTPS/TLS) and at rest.
• Every record is scoped to your account at the database level, so one account cannot read another's data.
• Access tokens for connected services (Xero, MYOB, Outlook and Gmail) are encrypted and are never sent to the app.
• AI and payment credentials are held only on our servers, never inside the app.
• Access to production systems is limited to those who need it.
• Our staff don't browse your records. Someone may look at a specific record to fix a fault you've reported, for security (for example investigating abuse), or where the law requires it.

No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

10. How long we keep it

Audio: voice notes you record are kept until you delete them or your account; phone-assistant call recordings and transcripts are kept for up to 12 months and then deleted, unless you delete them sooner or the law requires longer.

Site Chat is not covered by that 12-month rule. Chat messages, guest names and chat attachments are kept for as long as the chat exists, or until the account that started it is deleted.

We keep your data while your account is open. When you delete your account, your data is permanently deleted from our live systems, generally immediately. Encrypted backups are retained for up to 30 days and then expire. We may keep a minimal record where the law requires it, or where we need it to resolve a dispute.

11. Access, correction, export and deletion

• Access and correct — most of your information is visible and editable in the app.
• Export — go to Your account → Account & data → Download my data for a complete copy.
• Delete — go to Your account → Account & data → Delete my account, or More → Help & Account → Delete account. This is permanent. See deleting your account.

You can also email us and we'll help. We may need to verify your identity first, and we'll respond within a reasonable period — usually 30 days.

Deleting your KeystonePal account does not delete records you have already pushed to Xero, and does not cancel a subscription bought through the App Store or Google Play — cancel that separately in your store account.

12. Marketing

Messages KeystonePal sends on your behalf to your own customers — quotes, invoices, receipts and reminders — are sent at your direction and you are responsible for them, including complying with the Spam Act 2003 (Cth). We will only send you marketing about KeystonePal if you have opted in, and every such message has an unsubscribe link.

13. This website

This site uses no advertising or third-party tracking cookies. We may keep minimal server logs for security and reliability.

14. Children

KeystonePal is a business tool intended for people aged 18 and over. We do not knowingly collect information from children.

15. Changes

We may update this policy. If a change is significant we'll let you know in the app or by email before it takes effect. The version and date at the top always show the current release.

16. Contact us, and complaints

Questions, requests or complaints: support@keystonepal.com.au. We'll acknowledge your complaint and aim to resolve it within 30 days.

If you're not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.