Privacy Policy

Last updated: 5 September 2026

1. Who this policy is about, and who it's for

This Privacy Policy explains how DispatchOS ("DispatchOS," "we," "us," or "our"), operated by Josh Deniz (ABN 62 477 607 861), trading as DispatchOS, of Suite 17, 89-97 Jones Street, Ultimo, NSW 2007, collects, uses, discloses, and protects personal information in connection with our software-as-a-service product for electrical contracting businesses (the "Service").

There are two distinct groups of individuals whose personal information this policy covers, and it's important to be clear about the role we play for each:

• You, the Business Owner ("Customer," "you," "your account holder"): if you sign up for DispatchOS to run your electrical business, you are our direct customer. For your own account information, DispatchOS is the data controller — we decide why and how it's collected and used, as described below.
• Your Customers (the people who contact your electrical business): DispatchOS stores and processes information about the people who enquire about or use your services — their name, contact details, and the content of their enquiries — on your behalf, so you can respond to and manage them. For that information, you (the Business) are the data controller, and DispatchOS acts only as your data processor / service provider. If you are a Business's customer and have a question about how your personal information is used, your first point of contact should be the electrical business you contacted — DispatchOS provides them the software, but they decide what they collect from you and why.

Where this policy uses "personal information," it has the meaning given in the Privacy Act 1988 (Cth), including any information or opinion about an identified individual, or an individual who is reasonably identifiable.

A note on legal applicability: Small businesses with annual turnover under AUD $3 million are, in some circumstances, exempt from parts of the Privacy Act. DispatchOS is currently a pre-revenue, early-stage business. Regardless of whether that exemption currently applies to us, we have chosen to draft and operate this policy to the standard of the Australian Privacy Principles (APPs) described below, because we intend to grow past that threshold and because it's the right way to handle data about tradespeople's customers.

2. Information We Collect

2.1 From you, the Business Owner (Account Holder)

When you create and use a DispatchOS account, we collect:

• Identity and contact details — your name, email address, and business details (business name, trade, service area) provided at signup.
• Login credentials — your account is authenticated through Supabase Auth (see Section 4). We never see or store your plaintext password; Supabase handles credential storage and hashing.
• Billing information — if you subscribe to a paid plan, your payment card details are collected and processed directly by Stripe, our payment processor. DispatchOS does not store your full card number; we retain only what Stripe provides back to us for account and invoicing purposes (e.g., subscription status, last four digits, billing history).
• Content you create in the product — job records, quotes, service catalogue pricing, notes, and any photos you upload (stored in our private job-photos storage bucket) relating to jobs you manage through the Service.
• Optional connected-account information — if you choose to connect your own Stripe account (to generate payment links for your customers' invoices) or your Xero account (to read your invoice/accounts-receivable data), we receive and store the authorization tokens and the data needed to provide those features, as described in Section 3.
• Support communications — anything you send us at josh@dispatchos.com.au.

2.2 About Your Customers (collected by you, processed by us on your behalf)

When someone contacts your electrical business — via a web enquiry form, a phone call, or SMS — the following information may be captured and stored in DispatchOS on your behalf:

• Name, phone number, email address, and street address/suburb.
• The content of their enquiry (what they wrote or said, and any details extracted from it, such as the type of job or urgency).
• A record of the communications sent to them through the Service (acknowledgments, follow-up emails/SMS) and whether they were opened, replied to, or actioned.
• If your enquiry channel includes a phone call, call metadata (e.g., call time, whether it was answered) needed to detect a missed call and support the missed-call recovery feature.

DispatchOS does not decide to collect this information independently — it is collected because you, the Business, use our Service to run your customer-facing operations. You are responsible for ensuring you have a lawful basis to collect and use your own customers' personal information (for example, that your own customer-facing enquiry form or phone line makes clear that their details will be used to respond to their enquiry).

2.3 Automatically Collected / Technical Information

We collect a limited amount of technical information necessary to operate the Service securely:

• Session/authentication cookies set by Supabase Auth, required to keep you logged in (see Section 8 — Cookies).
• Standard server/application logs (e.g., timestamps, error traces, IP address of requests) used for security monitoring, debugging, and abuse prevention, generated as part of running the Service on Vercel and Supabase infrastructure.

We do not currently deploy any analytics or advertising tracking cookies or scripts in the Service. If that changes in the future, we will update this policy and, where required, seek your consent first.

3. How We Use Information, and Why (Tied to Actual Features)

We use personal information only for the following purposes, each tied to a real feature of the Service:

We do not sell personal information, and we do not use your customers' data to advertise to them or to any other business.

4. Third-Party Service Providers

We rely on the following named third-party service providers to run DispatchOS. Each is a real, currently-integrated processor — this list is not aspirational and will be kept current:

Overseas disclosure (APP 8): Our production database runs on Supabase's ap-southeast-2 (Sydney) AWS region — your data and your customers' data is stored on infrastructure physically located in Australia, not sent overseas by that provider. However, several of the other providers above (Vercel, Stripe, Resend, Twilio, OpenAI, and Anthropic) do operate infrastructure and/or have corporate presence outside Australia, principally in the United States, so personal information processed through those providers' ordinary infrastructure (e.g., an enquiry sent to OpenAI or Anthropic for AI triage, or an email sent via Resend) may still be transmitted to or handled by systems located overseas. Each of these providers is a well-established company with its own privacy and security commitments, and we select and use them for the specific, limited purposes described in this policy.

We do not permit any of these providers to use your data, or your customers' data, for their own independent marketing purposes. Each is used strictly to deliver the specific function of the Service described above.

5. Data Security

We take the security of the personal information in DispatchOS seriously, including these specific, real measures:

• Database-level tenant isolation. DispatchOS is a multi-tenant product used by many electrical businesses. We enforce strict Row-Level Security (RLS) at the Postgres database layer — meaning one business's data (its customers, enquiries, jobs, quotes, and financial information) is never visible to another business, enforced by the database itself, not merely by application code. The application's runtime database connection uses a restricted, non-privileged database role that cannot bypass this isolation.
• Authentication is handled by Supabase Auth using industry-standard credential hashing; we never store your plaintext password.
• Encryption in transit — connections to the Service are made over HTTPS/TLS.
• Least-privilege access — access to production data is restricted, and the founder-operated support workflow does not require broad ad-hoc database access for routine support.
• Human-approval gate on outbound communications — AI-drafted messages to your customers are never sent automatically; a real send only occurs after you explicitly approve it, which limits the blast radius of any AI or system error.

No method of storing or transmitting data is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach that is likely to result in serious harm, we will comply with our notification obligations under the Notifiable Data Breaches scheme in the Privacy Act.

6. Data Retention and Deletion

• We retain your account information, and your customers' information stored in your account, for as long as your account remains active, so the Service can continue to function (e.g., showing your enquiry and job history).
• If you cancel your subscription through the self-serve billing portal, your account may move to a read-only or suspended state consistent with the plan you were on; we do not currently auto-delete your data immediately upon cancellation, since you may wish to export it or re-subscribe.
• There is currently no self-serve "delete all my data" button in the product. If you want your account data, or a specific customer's data, deleted, please email josh@dispatchos.com.au with your request. We will act on legitimate deletion requests, subject to any data we are legally required to retain (e.g., financial/billing records required by tax law).
• Retention after cancellation: we retain your data for up to 90 days after cancellation, in case you wish to export it or reactivate, after which it may be permanently deleted. If you'd like it deleted sooner, email josh@dispatchos.com.au and we will action it.

7. Your Rights

If you are an Australian individual (whether a Business Owner using DispatchOS, or a Business's customer whose information is stored in DispatchOS), you have rights under the Australian Privacy Principles, including the right to:

• Access the personal information we (or, for a Business's customer, the Business via DispatchOS) hold about you.
• Request correction of personal information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading.
• Make a complaint if you believe your privacy has been interfered with.

How to exercise these rights:

• If you are a Business Owner, contact us directly at josh@dispatchos.com.au.
• If you are a Business's customer (i.e., you contacted an electrical business that uses DispatchOS), please contact that business directly first, since they control what information they collect from you and why. If you're unable to resolve it with them, you may also contact us at josh@dispatchos.com.au and we will assist in facilitating your request with the relevant Business.

If you're not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

8. Cookies

The Service uses a small number of strictly necessary cookies set by Supabase Auth to keep you securely logged in during a session. These cookies are required for the Service to function — they are not used for advertising, cross-site tracking, or analytics profiling.

As of the date of this policy, DispatchOS does not deploy any analytics or advertising tracking cookies or scripts. If this changes in the future (for example, if we add product analytics), we will update this policy and, where legally required, present a cookie consent mechanism before deploying them.

9. Children's Privacy

DispatchOS is a business-to-business product intended for use by adult tradespeople and their staff to run an electrical contracting business. It is not directed at, marketed to, or intended for use by children, and we do not knowingly collect personal information from anyone under 18. If we become aware that a child's personal information has been provided to us in a manner inconsistent with this policy, we will take reasonable steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time as the Service, our providers, or applicable law changes. If we make a material change, we will update the "Last updated" date at the top of this document and, where the change is significant, notify active Business Owners by email or an in-app notice. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

11. Contact Us

Questions about this Privacy Policy, or requests relating to your personal information, can be sent to:

josh@dispatchos.com.au

This is a template for informational purposes. Consult with a qualified attorney for legal advice specific to your situation.