Privacy Policy

1. Who We Are

MasterPlan Construction Consulting Pty Ltd is an Australian company based in Melbourne, Victoria, Australia. Your data is accessed only by authorised personnel and is never shared except where required to deliver the service through the third-party infrastructure described in Section 6.

2. What Personal Information We Collect

We only collect information that is necessary to provide the platform and support your account.

2.1 Account Registration

When you create an account, we collect:

• First name and last name
• Email address
• Phone number
• Company name and company subdomain
• Position or role within your organisation
• Timezone preference
• Password (stored securely using industry-standard encryption — we cannot read your password)

2.2 Organisation Profile

When you set up your organisation, we collect:

• Company name, address, website
• Company logo (uploaded image)
• Brand colours (hex values)
• LinkedIn and Instagram URLs (if provided)
• Report email address (if different from account email)

2.3 Platform Usage Data

In the course of using the platform, you and your team create:

• Project records (name, address, description)
• Defect records (title, description, location, trade, priority, status, photos)
• Floor plan images with pin locations
• Inspection reports (PDF and Excel)
• Team member records (names, emails, roles)
• Subcontractor records (names, emails)
• Comments and activity logs on defects

2.4 Technical Data

We automatically collect the following technical data when you use the platform:

• IP address (used for rate limiting and security — not linked to your profile)
• Browser type and version
• Device type (desktop, mobile, tablet)
• Session tokens (to keep you logged in — stored as secure cookies)
• Error logs (to identify and fix platform issues)

We do not use this technical data to build profiles, track behaviour across websites, or for any advertising purpose.

2.5 Support Communications

If you contact us via the support form or by email, we collect:

• Your name and email address
• The content of your message
• Any attachments you provide

3. How We Use Your Personal Information

We use your personal information only for the following purposes:

To provide the platform: Delivering the core features of MasterPlan Defects — project management, defect tracking, report generation, team collaboration, and offline data sync.

To manage your account: Creating and maintaining your account, verifying your email address, managing your subscription, and processing account changes.

To send transactional emails: We send the following emails as a direct result of your actions on the platform:

• Email verification on signup
• Welcome email after account verification
• Team invitation emails sent to people you invite
• Password reset emails
• Subscription confirmation emails
• Cancellation confirmation emails
• Trial expiry reminder emails

We do not send marketing emails or newsletters unless you have separately requested them.

To provide support: Responding to your support requests and resolving technical issues with your account.

To maintain security: Detecting and preventing unauthorised access, fraud, abuse, and security incidents.

To improve the platform: We may review error logs and usage patterns to identify bugs and improve performance. This is done by the platform owner only and is not shared with third parties.

To comply with legal obligations: Where required by Australian law or a court order.

4. White-Label Platform — Your Clients' Data

MasterPlan Defects is a white-label platform. If you are using the platform under your own brand, your clients and subcontractors will interact with the platform using your logo, colours and company name — they may not know that MasterPlan Defects is the underlying platform.

In this context:

• You (the account holder) are the data controller for your clients' and subcontractors' data
• We (MasterPlan Defects) act as a data processor on your behalf
• Your clients' personal information (names, emails, defect data) is stored and processed solely to deliver the platform services to you
• We do not contact your clients directly, market to them, or use their data for any purpose other than delivering the platform to you
• You are responsible for obtaining any necessary consents from your clients and subcontractors for their data to be stored on the platform

5. Cookies and Local Storage

5.1 Session Cookies

We use a single session cookie to keep you logged in while using the platform. This cookie:

• Is created when you sign in
• Is deleted when you sign out or your session expires
• Is a secure, HTTP-only cookie (cannot be read by browser JavaScript)
• Is required for the platform to function — it cannot be disabled

5.2 Security Cookie

Our authentication system uses a CSRF (cross-site request forgery) protection token stored as a cookie. This is a security requirement and cannot be disabled.

5.3 Offline Data (IndexedDB)

When you use the platform offline or on a mobile device, defect data, project data and photos may be stored locally on your device in your browser's IndexedDB storage. This data:

• Is stored on your device only — not transmitted to our servers until you are back online
• Is scoped to your user account — other users on the same device cannot access your offline data
• Can be cleared from the Settings page under “Offline Data”

5.4 No Tracking or Advertising Cookies

We do not use:

• Google Analytics or any other web analytics service
• Facebook Pixel or any other advertising network
• Any cookie that tracks you across other websites
• Any third-party tracking scripts of any kind

6. Third-Party Services We Use

We use the following third-party services to operate the platform. Your data is shared with these services only to the extent necessary to deliver the platform.

6.1 Railway (Database Hosting)

What it does: Hosts our PostgreSQL database containing all account, project, defect and user data.

Data location: United States

Privacy policy: https://railway.app/legal/privacy

6.2 Cloudinary (File and Image Storage)

What it does: Stores all uploaded images including defect photos, floor plans and company logos. Also stores automated backup files.

Data location: United States

Privacy policy: https://cloudinary.com/privacy

6.3 Email (SMTP Provider)

What it does: Delivers transactional emails including account verification, welcome emails, team invitations, password resets, and subscription notifications.

Data shared: Recipient email address and email content only.

Data is not retained by the email provider beyond delivery.

6.4 Stripe (Payments)

What it does: Processes subscription payments and stores payment method details (card numbers are tokenised by Stripe — we never see, store or have access to your actual card data).

Data location: United States

Privacy policy: https://stripe.com/privacy

6.5 No Other Third Parties

We do not use:

• Google Analytics, Mixpanel, Amplitude or any analytics service
• PayPal or any other payment processor — we use only Stripe (see Section 6.4)
• Intercom, Zendesk or any third-party support platform
• Any social media tracking pixels
• Any advertising networks

7. Data Storage and Security

7.1 Where Your Data Is Stored

Your data is stored on Railway servers located in the United States. Images and files are stored on Cloudinary servers also located in the United States. By using the platform, you consent to your data being transferred to and stored in the United States.

7.2 Security Measures

We implement the following security measures:

• All data transmitted between your device and our servers is encrypted using HTTPS
• Passwords are stored using industry-standard secure hashing — your password is never stored in plain text and cannot be read by anyone including us
• You cannot reuse recent passwords when changing your password
• Session tokens are stored as secure, encrypted cookies
• API rate limiting is in place to protect against automated attacks
• File uploads are validated and verified before being accepted
• Database access is restricted to the platform application only

7.3 Backups

Automated daily backups of your data are stored on Cloudinary. The 8 most recent backups are retained (approximately 8 days of rolling history). Backups are used only for disaster recovery.

7.4 Limitations

While we take all reasonable steps to protect your data, no internet-based service can guarantee absolute security. You are responsible for maintaining the security of your account credentials and for any activity that occurs under your account.

8. Data Retention

We retain your personal information for the following periods:

After account cancellation, all your data is permanently and irreversibly deleted after 30 days. You can request a full data export before this occurs by contacting support@masterplandefects.com.au.

9. Disclosure of Personal Information

We do not sell, rent, or trade your personal information to any third party.

We may disclose your personal information only in the following circumstances:

Service delivery: To the third-party infrastructure providers listed in Section 6, solely to deliver the platform services.

Legal requirements: If we are required by Australian law, a court order, or a request from a government authority to disclose your information. We will notify you of any such request where we are legally permitted to do so.

Business transfer: In the unlikely event that MasterPlan Construction Consulting is sold or merged, your data may be transferred to the new owner. You will be notified in advance and given the option to delete your account and data before any transfer occurs.

10. Your Rights Under Australian Privacy Law

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights:

Right to access: You can request a copy of the personal information we hold about you. We will respond within 30 days. We do not charge a fee for access requests.

Right to correction: If any personal information we hold is inaccurate, incomplete or out of date, you can request that we correct it. You can also update most of your information directly in the platform Settings.

Right to deletion: You can request that we delete your personal information. We will delete your data within 30 days of your request, subject to any legal obligations to retain certain records.

Right to complain: If you believe we have breached the Australian Privacy Principles, you have the right to make a complaint. Please contact us first at support@masterplandefects.com.au and we will attempt to resolve your concern within 30 days. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

To exercise any of these rights, contact us at support@masterplandefects.com.au.

11. Children's Privacy

The MasterPlan Defects platform is intended for use by construction industry professionals. We do not knowingly collect personal information from anyone under the age of 18. If you believe a person under 18 has provided us with personal information, please contact us at support@masterplandefects.com.au and we will delete it promptly.

12. Links to Other Websites

The platform and marketing website may contain links to third-party websites. We are not responsible for the privacy practices of those websites and recommend you review their privacy policies before providing any personal information.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Send a notification email to all registered account holders

Your continued use of the platform after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to the changes, you should stop using the platform and request deletion of your account.

14. Contact Us

For all privacy-related enquiries, access requests, correction requests, or complaints:

MasterPlan Construction Consulting Pty Ltd
Melbourne, Victoria, Australia
ABN: 63 686 164 036
Email: support@masterplandefects.com.au

We aim to respond to all privacy enquiries within 5 Business Days.