Privacy Policy

1. Who this policy covers

This policy applies to:

• Visitors to our website and marketing pages.
• Account holders — the business owners and staff who sign up for and use BronzeOffice.
• Our customers' customers — the people whose details a trade business stores in BronzeOffice (for example a homeowner who receives a quote or invoice). For that information the trade business is the party collecting it and deciding how it is used; we process it on their instructions and under this policy's security commitments. Questions about your details held by a particular business should go to that business first.

2. What we collect

Information you give us

• Account details: your name, work email address, password (stored only as a one-way hash), phone number and job title.
• Business details: business name, trade, ABN, address, logo and bank or payment details you choose to display on quotes and invoices.
• Business records you create in the product: leads, customers, quotes, jobs, invoices, payments, staff records, timesheets, leave requests, payslips, notes, files and messages.
• Communications with us, such as support requests and feedback.

Information collected automatically

• Usage and device data: pages visited, features used, browser type, approximate location derived from IP address, and timestamps.
• Log data: IP address, user agent, session identifiers and error reports, kept for security and troubleshooting.
• Cookies: an essential, httpOnly session cookie that keeps you signed in, and analytics cookies described in section 4.

Information from third parties

• If you sign in with Google, we receive your name, email address and profile picture from Google.
• If you connect Xero, Stripe, Meta (Facebook/Instagram/WhatsApp) or another integration, we receive the data that integration shares with us as described in section 6.
• Lead enquiries sent to your business from your website form, Meta or Google lead ads, which we store in your CRM.

We do not knowingly collect information from children under 16, and BronzeOffice is not designed for them.

3. Why we collect it

We collect, hold and use personal information to:

• provide and operate the BronzeOffice service, including sending quotes, invoices, SMS and emails on your instruction;
• set up and manage your account, trial and subscription, and bill you;
• provide support and respond to your requests;
• keep the service secure, detect fraud and misuse, and meet our legal obligations;
• understand how the product is used so we can improve it;
• send service messages (for example receipts, security notices and trial reminders) and, with your consent or where permitted, product news you can opt out of at any time.

We do not sell personal information.

4. Analytics and cookies

Our marketing pages and the signed-in app use Google Analytics 4 to measure traffic and feature use. GA4 sets cookies and collects usage data, device information and a truncated IP address. We do not load analytics on our customers' hosted blogs, customer portals or payment pages. You can block analytics cookies in your browser or with Google's opt-out add-on without affecting the service.

5. AI features

Some features (for example drafting quote follow-ups, blog posts, website chatbot replies and WhatsApp or Messenger enquiry handling) use large language models accessed through OpenRouter and the model providers it routes to. When you use an AI feature, the text needed to complete that task (such as a quote summary or an enquiry message) is sent to the model provider for processing. We do not use your data to train models, and we only send what the feature needs. AI output is a draft — you remain responsible for checking it before it goes to a customer.

6. Who we share information with

We share personal information only with service providers that help us run BronzeOffice, each under terms that restrict their use of it:

We may also disclose information where the law requires it, to protect our rights or safety, or as part of a sale or restructure of our business (in which case this policy continues to apply).

7. Where your data is stored (overseas disclosure)

Our primary database and file storage are hosted in the Sydney, Australia region. Some of the providers above (including Stripe, Twilio, Meta, Google, Vercel, Resend and OpenRouter) process data in the United States and other countries. Before relying on an overseas provider we take reasonable steps to ensure it protects personal information in a way that is at least substantially similar to the APPs, and we rely on each provider's contractual data-protection commitments.

8. Security

We protect personal information with encryption in transit (TLS) and at rest, hashed passwords, encrypted storage for connected-service keys, access controls that separate each business's data, logging and regular backups. No system is perfectly secure; if a data breach is likely to cause serious harm we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

9. How long we keep it

• Account and business records are kept while your subscription is active.
• After an account is closed we keep your data for 90 days so you can export it or reactivate, then delete or de-identify it, except where we must keep it longer (for example tax and billing records, which Australian law requires us to retain for seven years).
• Server logs are kept for up to 12 months. Backups roll off within 35 days.

10. Access, correction and your choices

You can view and update most account and business details yourself in Settings. You may ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete your account. We will respond within 30 days and will not charge for a reasonable request. If we refuse a request we will tell you why in writing. You can unsubscribe from marketing email using the link in any message; service messages about your account will still be sent.

11. Complaints

If you think we have mishandled your personal information, contact us at support@ozsystems.com.au and we will acknowledge your complaint within 7 days and aim to resolve it within 30. If you are not satisfied with our response you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

12. Changes to this policy

We may update this policy from time to time. We will post the new version here with a new "last updated" date and, for material changes, notify account holders by email or in the app.

13. Contact

Oz Systems Pty Ltd trading as BronzeOffice, Perth, Western Australia. Privacy enquiries: support@ozsystems.com.au.