Privacy Policy

This Privacy Policy applies to all personal information collected by Buds At Work ("we", "us", "our") through our website at budsatwork.com, our customer and crew portals, and in the course of delivering our services.

We may update this policy from time to time. When we do, we will revise the "Last updated" date above. Continued use of our site or services after changes are posted constitutes acceptance of the revised policy. For significant changes we will provide a more prominent notice.

If you have questions about this policy or want to make a privacy complaint, please contact us at admin@budsatwork.com or call 0474 766 703.

We collect the following categories of personal information:

• Identity and contact details: name, email address, phone number, and property address when you request a quote, create an account, or make a booking.
• Service information: preferred appointment times, accessibility requirements, special instructions, and photos of areas to be serviced that you choose to share.
• Payment and financial information: billing details necessary to process payments. Card numbers are handled directly by Stripe and are never stored on our servers.
• Account credentials: email address and hashed password if you create a portal account.
• Feedback and communications: messages, bug reports, feature ideas, and other content you submit via our feedback form or by email.
• Usage and technical data: IP address, browser type, device identifiers, pages visited, and session duration collected automatically when you use our website.
• Cookie and analytics data: aggregated behavioural data collected via Google Analytics (GA4) to understand how visitors use our site.
• Staff and crew information: if you work with us, we collect employment-related information necessary to manage your engagement, schedule, and payments.

We collect personal information in the following ways:

• Directly from you: when you complete our quote builder, contact form, feedback widget, create an account, or communicate with us by email, phone, or SMS.
• Automatically: when you visit our website, our servers and Google Analytics collect technical and usage data via cookies, pixels, and similar technologies.
• From third parties: where you use a third-party payment method (e.g. Apple Pay or Google Pay via Stripe) or sign in via a linked account.

We collect and use personal information only for the purposes for which it was collected or related purposes, including:

• Providing and managing services: scheduling appointments, coordinating crew, confirming bookings, and delivering the cleaning, yard care, detailing, laundry, and other services you request.
• Processing payments: charging for completed work, issuing tax invoices and receipts, and managing refunds or credits.
• Communication: sending booking confirmations, appointment reminders, service updates, and responding to your enquiries.
• Marketing (with consent): sending promotional emails or SMS messages about our services. You can opt out at any time.
• Improving our services: using anonymised analytics data to understand how the site is used and to identify areas for improvement.
• Legal and compliance: meeting our obligations under Australian tax law (ATO), employment law, and any other applicable legislation.
• Safety: protecting the safety of our staff, customers, and the public.

We share your personal information with trusted third-party service providers who assist us in operating our business. These providers are contractually bound to use your information only for the purposes we specify and to maintain appropriate security.

• Stripe (stripe.com) — payment processing. Stripe is PCI-DSS Level 1 certified and processes card payments on our behalf. Your card details are handled directly by Stripe. Data is stored in the United States.
• Supabase (supabase.com) — database and authentication. Customer records, quotes, bookings, and account credentials are stored in Supabase infrastructure hosted on AWS (United States and/or other regions).
• Google Analytics / GA4 (analytics.google.com) — website analytics. Anonymised usage data is transmitted to Google servers in the United States to help us understand site traffic.
• Resend (resend.com) — transactional and notification emails. Your email address and name are processed by Resend to deliver booking confirmations, receipts, and service updates. Data may be processed in the United States.
• Crew members and subcontractors — we share only the minimum information required (your name, address, and booking details) with the team member assigned to your job.

We do not sell your personal information to any third party for marketing or commercial purposes.

Some of our third-party providers store and process data outside Australia, primarily in the United States. By using our services, you acknowledge that your personal information may be transferred to and processed in countries that may not provide the same level of data protection as Australia.

We take reasonable steps to ensure overseas recipients handle your information in accordance with the Australian Privacy Principles and under appropriate data processing agreements.

Our website uses cookies and similar technologies for the following purposes:

• Analytics cookies (Google Analytics / GA4): help us understand how visitors interact with our site by collecting anonymised usage statistics. These cookies are only set if you accept the cookie banner.
• Session and authentication cookies: keep you logged in to your portal account during your session.
• Preference storage (localStorage): remembers your cookie consent choice and quote progress so you don't have to start over.

You can control cookies through your browser settings or by declining the cookie consent banner on your first visit. Note that disabling cookies may affect some site functionality. Google Analytics opt-out is also available via the Google Analytics Opt-out Browser Add-on.

• All data transmitted between your browser and our site is encrypted using HTTPS/TLS.
• Database access is restricted to authorised personnel and systems using role-based access controls.
• Payment card data is processed and stored by Stripe under PCI-DSS Level 1 compliance; we do not store card numbers.
• We conduct periodic reviews of our security practices and update them as threats evolve.

While we take reasonable steps to protect your information, no system is completely secure. In the event of a data breach that is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches (NDB) scheme.

• Financial records (invoices, payments, bookings): retained for seven years as required by the Australian Taxation Office.
• Account information: retained while your account is active and for a reasonable period after closure to resolve disputes.
• Analytics data: retained in aggregated, anonymised form in accordance with Google Analytics' retention settings (default 14 months).
• Feedback submissions: retained for up to two years to track patterns and improve our services.
• Server logs: retained for up to 90 days for security and diagnostic purposes.

When retention periods expire, we securely delete or anonymise personal information. You may also request earlier deletion (subject to our legal obligations — see section 11).

We comply with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth). If we become aware of a data breach that is likely to result in serious harm to any affected individuals, we will:

• Contain the breach and assess its nature and scope as quickly as possible.
• Notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable.
• Notify affected individuals directly, or by public notice if direct notification is not practicable.
• Provide guidance on the steps affected individuals can take to protect themselves.

Under the Australian Privacy Principles you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate, incomplete, or out of date.
• Deletion: request deletion of your personal information where we no longer have a legal obligation to retain it.
• Opt-out of marketing: unsubscribe from marketing emails by clicking "Unsubscribe" in any email, or reply "STOP" to any SMS. Transactional messages (booking confirmations, receipts) cannot be opted out of while your account is active.
• Complaint: lodge a complaint with us first, and if not resolved, escalate to the OAIC at oaic.gov.au or 1300 363 992.

To exercise any of these rights, email us at admin@budsatwork.com or call 0474 766 703. We will respond within five business days for access/correction requests and within 30 days for more complex requests.

Our services and website are intended for individuals aged 18 and over. We do not knowingly collect personal information from children under 18 without verifiable parental or guardian consent. If you believe we have inadvertently collected information from a minor, please contact us immediately at admin@budsatwork.com and we will promptly delete it.

If you have questions, concerns, or a complaint about how we handle your personal information, please contact our Privacy Officer:

• Email: admin@budsatwork.com
• Phone: 0474 766 703
• Business hours: Monday–Friday, 8 am–5 pm AEST

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.