Privacy Policy

Novato is a product of NADAR & CO PTY LTD, trading as Novato Tech (ACN 671116091, ABN 36671116091) ("Novato", "we", "us", "our"), based in Australia. This policy explains how we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy applies to everyone who interacts with Novato: account holders who manage projects ("customers"), the subcontractors and tradies those customers invite onto the platform ("workers"), and clients who follow a project in the client portal.

1. Information we collect

We collect only what we need to run the platform and keep the records customers are required to keep:

• Account information: name, email address, phone number, business name and role, collected when you or your organisation sign up.
• Worker information: name, email, phone number, and trade details, collected when a customer invites a subcontractor, or when a worker registers themselves after being invited.
• Compliance documents: licences, insurance certificates, induction cards (such as White Cards), method statements and similar documents uploaded to a project or to a person's or business's Vault, along with details we read from them (document type, issuer, expiry date).
• Project and site records: tasks, drawings, photos, safety records, who signed in on site and when, and the history of changes to each record.
• Billing information: plan selection and transaction records. Card details are collected and processed directly by our payment processor. We do not store full card numbers ourselves.
• Usage and device information: log data, IP address, browser type, and how you interact with the platform.

We generally avoid collecting sensitive information as defined by the Privacy Act. Where a document incidentally contains sensitive information, we only use it for the purpose it was provided for.

2. How we use information

• To check that uploaded documents are current and match the person or project they relate to.
• To track expiries and send renewal reminders and compliance notifications.
• To operate accounts, process subscription billing, and provide customer support.
• To keep audit trails that our customers may need to demonstrate compliance to insurers, principal contractors, or regulators.
• To improve the reliability and accuracy of our checks.

3. AI-assisted reading and drafting

Novato uses Anthropic's Claude AI models in two ways: to read details from uploaded documents, and to draft or suggest content on your behalf based on what you type in. When a document is read, the image or file itself is sent to Anthropic. Only the content needed for that specific task is sent, and we do not use it to train third-party AI models. See our AI Policy for the full list of AI features and what data each one involves.

4. Who we share information with

We share personal information only where necessary to run the service:

• Supabase: our database, authentication, and file storage provider.
• Stripe: for subscription billing and payment processing.
• Anthropic: for AI-assisted document reading and drafting, as described above and in our AI Policy.
• Your own organisation and the businesses you share with: a worker's compliance records are visible to the customer that invited them, and a person or business can share a credential with a builder for as long as they choose and take the share back.

We do not sell personal information, and we do not share it with third parties for their own marketing purposes.

5. Overseas disclosure

Your database and uploaded files are held in Sydney, Australia. Some of the providers listed above, including Anthropic, Stripe, and our cloud infrastructure providers, may store or process information on servers located outside Australia. Where this occurs, we take reasonable steps to ensure the overseas recipient handles personal information consistently with the Australian Privacy Principles.

6. Data retention

We retain compliance documents and worker records for as long as the related account or project is active, and for a reasonable period afterwards to support audit and legal record-keeping needs (typically up to 7 years, consistent with standard business record-keeping practice). Some safety records are kept for the length of time work health and safety law requires. You can request earlier deletion, see section 8.

When a builder checks a credential you have shared, they keep a copy of it as it was, so they can show what they relied on. That copy is kept for 7 years from the check. After that, the image of your credential is deleted and the licence number is shortened to its last three characters. The result of the check, the kind of credential, your name and the dates are kept. Withdrawing your sharing stops builders seeing your credentials, but does not remove a copy a builder already keeps.

7. Security

We apply access controls, encryption, and database-level row security to protect personal information from misuse, loss, or unauthorised access. Full detail is on our Security page.

8. Access, correction, and complaints

You can request access to, or correction of, the personal information we hold about you at any time by contacting us at support@novato.com.au. If you believe we have mishandled your personal information, you can lodge a complaint with us at the same address, and we will respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Deleting your account

You can delete your account yourself from your account page, under Delete my account. We delete it 14 days after you ask, and you can cancel any time before then. We then remove your login, email address, mobile number, passkeys, access to companies and projects, and the credentials and files in your Vault. We keep your name, your business and trade, and the dates you worked on the project and safety records you took part in, because building and work health and safety law requires those records to be kept and a claim can arrive years later. After the retention period in section 6, your name on those records is cut to initials. The copy of a credential that a builder checked stays with that builder for the same period. The only owner of a company, or the holder of a billing account, hands that over first.

If an account has not been used for a long time, we email the person and give them 30 days to sign in before we delete it in the same way. We switch this on only after setting the period, and we never include company owners, billing account holders or our own staff.

9. Cookies

We use essential cookies to keep you signed in and to remember your preferences. We do not currently use third-party advertising or tracking cookies.

10. The public demo

Novato has a public demo at demo.novato.com.au. It uses made-up people and a made-up company. Please do not enter real names, contact details or files in it. Everyone who opens the demo shares the same sample logins, so anything you enter can be seen by other visitors until the demo resets, which happens every night at 3 am Sydney time. We count how many visitors use the demo and when the last visit happened, and we use the same essential sign-in cookies described in section 9. The demo is kept out of search results.

11. Changes to this policy

We may update this policy from time to time as our practices or the law change. Material changes will be notified to account holders by email or an in-app notice.

12. Contact us

Questions about how we handle your personal information can be sent to support@novato.com.au.