Privacy policy.

CabiPro ("we", "us", "our") is committed to protecting your personal information and respecting your privacy.

This Privacy Policy explains how we collect, use, store, and disclose information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

CabiPro is a job management platform for cabinet makers, manufacturers, and joinery workshops. Because it is used to run a business, it holds information not only about you, but about your customers, your suppliers, and your employees. This policy covers both.

We have written it to be specific rather than vague. If anything here is unclear, we would rather you asked: [email protected]

1. What this policy covers

This policy applies to:

• our website (cabipro.com)
• our SaaS platform (CabiPro)
• communications and support interactions
• any services we provide to you

It explains how we handle personal information, meaning information about an identifiable person, and the business data you store inside CabiPro.

This policy should be read alongside our Terms of Service, which set out our respective responsibilities for the data you upload.

2. Who we are

CabiPro is operated under ABN 47 864 983 873, based in South Australia, Australia.

We have a designated privacy contact who is responsible for handling privacy enquiries, access requests, and complaints. You can reach them at [email protected].

3. Information we collect

We collect information only when reasonably necessary for our functions and services.

3.1 Information you provide directly

This includes information you submit when you:

• create an account or are invited to an existing account
• join our waitlist
• book a demo
• contact support
• fill out forms on our website
• use features inside the platform

We may collect:

• name
• email address
• phone number (including a WhatsApp number, if you choose to receive notifications that way)
• business name and trading details
• role or job title
• account login details (passwords are stored only as a salted one-way hash, never in a readable form)
• communication and support messages
• subscription and invoicing details

3.2 Business data you store in CabiPro

CabiPro is designed for cabinet manufacturing operations. You may upload or generate data such as:

• customer and client contact details, addresses, and project history
• supplier records and purchase orders
• quotes, invoices, and payment records
• production schedules, stages, and job allocations
• materials, inventory, and stock movements
• project notes, drawings, photos, and documents
• expense claims, mileage claims, and receipts
• calendar entries and meeting records

Employee records. If you use CabiPro to manage staff, the platform can store detailed employee information, including:

• name, employee ID, role, and job title
• email address and phone numbers
• date of birth
• home address
• emergency contact name and phone number
• bank account name, number, and BSB
• superannuation account details
• Tax File Number (TFN)
• ABN, education, availability, and notes

Some of this is sensitive, and some of it is regulated separately. Section 4 explains how we handle Tax File Numbers and financial details specifically.

This remains your data. We process it only to provide the service and support you.

We do not use your business data for:

• advertising
• sale to third parties
• unrelated data analytics
• training AI or machine learning models

We only access it when necessary, for support, security, or maintenance, and such access is limited to authorised personnel and logged.

3.3 Information collected automatically

When you visit our website or use our app, we collect:

• IP address
• browser, device type, operating system, and app version
• a device identifier used to manage your active sessions
• usage and navigation patterns
• pages viewed and actions taken
• diagnostic and error logs

We use this to:

• keep you signed in and let you review or revoke your active sessions
• improve performance
• detect fraud or misuse
• enhance features and usability
• maintain security

Activity logs. CabiPro also keeps an audit log of actions taken inside an account, recording which user created, changed, or deleted a record and when. This exists so account administrators can trace changes and so we can investigate security incidents. See section 15 for what this means if you are an employee using an account set up by your employer.

4. Tax File Numbers & financial details

CabiPro can store Tax File Numbers, bank account details, and superannuation details for your employees. We treat this as the most sensitive information in the platform.

Tax File Number information is regulated by the Privacy (Tax File Number) Rule 2015, a legally binding rule made under section 17 of the Privacy Act, which applies in addition to the Australian Privacy Principles. Accordingly:

• we store TFN information solely so that you can use CabiPro to administer your own payroll and tax obligations
• we do not use TFN information for any other purpose, and we do not use it to identify individuals
• we do not disclose TFN information to any third party, except where required or authorised by law
• we never include TFN, bank, superannuation, or date-of-birth information in the data sent to our AI providers (see section 6)
• access is restricted to the authorised users in your own account, and to our personnel only where strictly necessary for support or security
• we take reasonable steps to destroy or de-identify TFN information once it is no longer required by law or for the purpose it was collected

If you believe TFN or financial information in your account has been handled incorrectly, contact us immediately at [email protected].

5. Why we collect your information

We collect and use information to:

• create and manage accounts
• provide and maintain access to CabiPro
• improve the reliability and performance of our services
• communicate about updates, changes, or service issues
• respond to enquiries and support requests
• issue invoices and manage subscriptions
• ensure security, fraud prevention, and compliance
• develop new features and improvements
• meet legal and regulatory requirements

We do not sell personal information.

6. AI features

CabiPro includes an AI assistant that can answer questions about the data in your account, such as which jobs are behind schedule or what a particular client has ordered before. This section explains exactly how that works, because it involves sending some of your data to third-party AI providers.

6.1 What is sent, and to whom

To make your data searchable by the assistant, we:

• convert text summaries of your records into numerical representations (embeddings) using Google's Generative Language API
• send your question, together with the most relevant matching records, to DigitalOcean's Gradient Serverless Inference service, which generates the answer

The records that can be summarised and indexed this way are: clients, suppliers, projects, lots, quotes, purchase orders, material orders, inventory items, meetings, and employees.

6.2 What is deliberately excluded

Employee records are filtered before they are indexed. Only name, employee ID, role, email, phone, education, availability, and notes are included. Tax File Numbers, bank account and BSB details, superannuation details, dates of birth, home addresses, and emergency contact details are never sent to any AI provider.

6.3 Training and retention

We do not use your data to train any AI or machine learning model, and our AI providers do not train their models on data submitted through CabiPro.

We retain the conversation history of your AI sessions so you can return to earlier questions. You can delete a session from within the app at any time.

We record token usage counts per organisation for capacity and fair-use purposes. These counts are numerical only and contain no content.

6.4 Location of processing

Both AI providers process data outside Australia. See section 9.

6.5 Control and accuracy

If you would prefer that AI features be disabled for your organisation, contact us at [email protected] and we will disable them for your account.

AI-generated answers can be incomplete or wrong. They are a convenience, not a source of truth, and should not be relied on for financial, legal, safety, or employment decisions. Always check the underlying records.

7. Cookies, analytics & tracking

We use cookies and similar technologies to:

• keep you signed in and maintain your session
• remember preferences
• measure site performance
• improve functionality

Essential cookies. Some cookies are required for CabiPro to work at all, including the cookies that hold your login session. These cannot be disabled without breaking the platform.

Analytics. Our public website uses Google Analytics 4 to understand how visitors find and use the site. This sets identifiers in your browser and sends information, including your IP address, to Google. We use it for aggregate measurement, not to identify you individually.

Advertising and remarketing.Our Google Analytics property is linked to a Google Ads account. As a result, our public website also loads Google's advertising tag, which can build remarketing audiences - meaning you may later see CabiPro advertising on other sites after visiting ours. This applies to our marketing website only. It is not present in the CabiPro application, and it never has access to your business data.

You may adjust cookie settings via your browser; however, some features may not work properly if cookies are disabled.

8. Service providers we use

We use a small number of trusted third-party providers to deliver CabiPro. We disclose information to them only to the extent needed to perform their function. Each of them:

• operates under confidentiality obligations
• may only use data to perform agreed services
• is selected on the basis that it maintains privacy protections consistent with Australian standards

Our current providers are:

• DigitalOcean- application hosting, database hosting, and file storage. Files and images are stored in DigitalOcean's Sydney region.
• DigitalOcean Gradient Serverless Inference - generates AI assistant responses (see section 6).
• Google - the Generative Language API creates the embeddings that power AI search (see section 6); the Places API provides address lookup and autocomplete when you type an address; Google Analytics 4 measures traffic on our public website; Google Ads receives remarketing signals from our public website (see section 7).
• Mailgun - delivers transactional and notification email, including quotes and invoices you send to your own clients through CabiPro.
• Meta Platforms- delivers WhatsApp notifications via the WhatsApp Business Cloud API, if your plan includes WhatsApp messaging and you have opted in. This involves sending the recipient's phone number and the notification content to Meta.
• Xero - accounting synchronisation, if you choose to connect it (see section 10).

We may also disclose information where legally required, for example:

• responding to lawful requests
• preventing fraud or wrongdoing
• enforcing our terms

If our business structure changes, such as a sale or merger, we will notify you and ensure continued protection under applicable laws.

9. Overseas transfers

Your core business data - the database and the files, drawings, and photos you upload - is hosted in Australia, in DigitalOcean's Sydney region.

Some of our providers process information outside Australia. Under APP 8, we tell you where:

• United States - Google (Generative Language API, Places API, Analytics, Ads), DigitalOcean Gradient Inference, Mailgun, Meta Platforms.
• New Zealand, Australia, and the United States - Xero, depending on the service.

Where information is disclosed overseas, we take reasonable steps to ensure the recipient handles it in a manner consistent with the Australian Privacy Principles. You should be aware that overseas recipients may be subject to the laws of their own jurisdiction, including lawful access requests, and that Australian law may not be enforceable against them in the same way.

10. Connecting third-party accounts

CabiPro can connect to Xero so that your quotes, invoices, bills, and contacts stay in step with your accounting system. This connection is optional and is only established when an administrator in your account authorises it.

When connected, CabiPro can:

• read and write invoices, credit notes, quotes, and purchase orders
• read and write contacts, in order to match or create clients and suppliers
• read payments, so payment status can be mirrored into CabiPro
• read accounting settings such as account codes and tax rates

We deliberately do not request broader access to your accounting data than these functions require.

To maintain the connection, we store access and refresh tokens issued by Xero. These are encrypted at rest. You can disconnect at any time from within CabiPro, or revoke our access directly in your Xero account, which immediately ends our ability to read or write anything.

11. How we protect your data

We take reasonable steps to safeguard personal information. Our current measures include:

• encrypted data transmission (HTTPS/TLS)
• passwords stored only as salted one-way hashes
• encryption at rest for third-party integration tokens
• role-based access control, so users only see the modules and records their role permits
• session management that lets you see active sessions and revoke them, with server-side revocation
• rate limiting on authentication and sensitive endpoints
• malware scanning of every uploaded file, which refuses the upload if the file cannot be scanned or is found to be unsafe
• input sanitisation and a content security policy to guard against injected content
• audit logging of record changes and monitoring for suspicious activity
• data hosted in Australia, with backups

We take full backups of your data on a fortnightly basis, and again immediately before we deploy an update to the platform.

While no system is completely risk-free, we continuously work to maintain strong protections.

12. Notifiable Data Breaches (NDB Scheme)

If a data breach occurs that is likely to result in serious harm, we will:

• investigate promptly
• take corrective measures
• notify affected individuals where required
• notify affected account administrators so they can meet their own obligations to their staff and customers
• notify the Office of the Australian Information Commissioner (OAIC), in line with the NDB scheme

Transparency matters, and we will always act responsibly.

13. Data retention & deletion

We retain information only as long as necessary for:

• account management
• service provision
• legal compliance
• dispute resolution
• security or audit purposes

How deletion works in CabiPro. When you delete a record or a file in the app, it is first marked as deleted and moved out of normal view. This is deliberate: it means an accidental deletion can be recovered by an administrator. The data still exists in our systems during this period.

Employment and financial records. Where data relates to employment or tax, Australian law sets minimum retention periods - for example, employee records must generally be kept for seven years under the Fair Work Act, and many tax records for five years under ATO requirements. Where those obligations apply to you as the employer, you are responsible for meeting them; where they apply to us, we will retain the data for as long as required and no longer.

If you cancel your account, you may request deletion of stored data unless retention is required by law. Our Terms of Service set out the export and deletion process after cancellation.

14. Your rights under Australian privacy law

Under the Australian Privacy Principles, you have the right to:

• request access to personal information we hold about you (APP 12)
• ask for corrections to inaccurate, out-of-date, or incomplete information (APP 13)
• request deletion where lawful and reasonable
• opt out of marketing communications
• ask us to tell you whether we hold your information, and how we handle it
• raise concerns or complaints about privacy handling

To submit a request, contact [email protected]. We aim to acknowledge requests within 5 business days and to respond substantively within 30 days. If we cannot meet that timeframe, we will tell you why and when to expect a response. We will not charge you for making a request, though a reasonable cost may apply to providing access in an unusual format.

We may need to verify your identity before processing requests, which we will handle promptly and fairly.

If your employer set up your account. If your information is in CabiPro because your employer uses the platform, your employer controls that data. We will direct your access or correction request to them, and assist them in responding.

15. Employee records & workplace monitoring

If you are an employee, contractor, or installer whose details are stored in CabiPro by your employer, it is worth understanding what the platform records.

Your employer may be able to see:

• the personal and payroll details they have entered about you
• the jobs and stages you have been assigned to
• expense and mileage claims you submit, and their approval status
• an audit log of records you create, change, or delete, with timestamps
• your active sessions, including device type, operating system, and IP address

We provide these features so businesses can run their operations and trace changes. We do not use them to monitor individuals on our own account.

Employer responsibilities. If you use CabiPro to store information about your staff, you are responsible for telling them what you collect and why, for having a lawful basis to collect it, and for complying with any workplace surveillance and record-keeping laws that apply in your state. Our Terms of Service make this obligation explicit.

16. Marketing communications

We may send occasional service updates, news, or product information.

You can opt out at any time using the unsubscribe link provided or by contacting us directly.

Essential service notifications, such as security alerts, billing notices, and outage information, may still be sent where necessary.

Notifications inside CabiPro, including email and WhatsApp notifications, are controlled by your own notification preferences in the app.

17. Children's privacy

CabiPro is intended for business use and is not directed at children. Account holders must be at least 18 years old.

We do not knowingly collect personal information directly from individuals under 16. If such information is identified, we will delete it.

We recognise that an employer may store records for an apprentice or trainee under 18. Where that occurs, the employer is responsible for having appropriate authority to do so, and for any additional protections that apply to a young person's information.

18. Links to third-party sites

Our platform or website may include links to external sites.

We are not responsible for their privacy practices and encourage you to review their policies separately.

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• legal changes
• platform updates, including new features and new service providers
• security improvements

Any updates will be posted on this page with a revised "Last updated" date. Where a change materially affects how we handle your information - for example, adding a new category of data or a new overseas recipient - we will give you reasonable notice by email or in-app before it takes effect.

20. Complaints

If you think we have mishandled your personal information, tell us first. Email [email protected] with the details. We will acknowledge your complaint within 5 business days, investigate, and give you a written response, normally within 30 days.

If you are not satisfied with our response, you can escalate to the Office of the Australian Information Commissioner:

• Online: oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

21. Contact us

If you have questions, feedback, or privacy concerns, please contact:

CabiPro - Privacy
[email protected]
15b Blueberry Road, Parafield Gardens, 5107
South Australia, Australia

For general support enquiries, email [email protected].

We believe privacy should be clear, respectful, and transparent, and we're always happy to clarify anything further.