Privacy Policy — Office Toolbox

Document version: privacy-ot-v1.0 Last updated: 18 October 2026 Effective date: 18 October 2026

BuildManager.Cloud Pty Ltd (ACN 702 052 202), trading as Office Toolbox ("Office Toolbox", "we", "us", "our"), provides a cloud-based document and template platform for builders and trades at officetoolbox.com.au and app.officetoolbox.com.au (the "Service"). This Privacy Policy explains how we collect, use, hold, disclose and protect personal information, and how we comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").

By creating an account, joining our waitlist or using the Service, you acknowledge the practices described in this Policy.

1. Who this Policy applies to

This Policy covers personal information we handle about:

• Subscribers and their users — the builders, tradespeople, staff and contractors who sign in and use the Service.
• People named on a job — principal contractors, supervisors, site contacts, first aiders and other people whose names and phone numbers a subscriber enters against a job.
• Waitlist members — people who leave their email address on our website to be told when sign-up opens.
• Visitors to our website and sign-up pages.

Each subscribing business (a "subscriber") is responsible for the information it enters into its workspace; we handle that information on the subscriber's behalf and to operate the Service.

2. Information we collect

Account and identity information: name, email address, and sign-in credentials (passwords are stored only as salted hashes by our sign-in provider — we never see them in plain text).

Business profile: company name, ABN, licence details and logo, which are printed on the documents a subscriber downloads.

Job details: information a subscriber enters for each job, including the site address, assembly point, nearest hospital, emergency address, and the names and phone numbers of the principal contractor, supervisor, site contact and first aider.

Documents and files: documents a subscriber generates from our templates or uploads, with their version history, and construction details a subscriber uploads to their private library (such as PDF files, DWG drawings and photos).

Shared catalogue content: when the Office Details catalogue is available, any construction details a subscriber chooses to publish to it, the name shown with them, and any comments made in discussions about them.

Waitlist information: the email address you give us when you join the waitlist.

Usage and technical data: log data, device and browser information, IP address, and actions taken in the Service, collected automatically to operate, secure and improve the platform.

Billing information (if and when paid plans are enabled): plan selection and subscription status. Card payment details are handled by our payment processor and are not stored by us.

We generally do not seek sensitive information. Please do not upload sensitive information (such as health information) unless it is necessary for a legitimate work health and safety purpose.

3. How we collect it

We collect information directly from you when you sign up, join the waitlist, enter data or upload files; and automatically through your use of the Service. Where a subscriber enters the details of a person named on a job, that information is provided to us by the subscriber, not by that person. Subscribers are responsible for having the permission of, or giving notice to, the people whose details they enter.

4. Why we use it

We use personal information to: create and administer accounts; provide and operate the Service; generate the documents you download with your business and job details printed on them; store your documents, details and version history; enforce workspace isolation and access controls; show published catalogue content to other subscribers; send sign-in, confirmation and password-reset emails; tell waitlist members when sign-up opens; provide support; maintain security and prevent misuse; meet legal and record-keeping obligations; and improve the Service. We do not sell your personal information.

5. Disclosure and our service providers (sub-processors)

We do not sell personal information. We disclose information to trusted service providers who help us run the Service, under contractual confidentiality and security obligations:

• Supabase — database, file storage and sign-in, hosted in Sydney, Australia (ap-southeast-2).
• Vercel — hosts our website and web application. Requests are served from Vercel's network, with application functions run in Sydney.
• Google Cloud (Google LLC) — generates the PDF and Word documents you download, in Sydney, Australia (australia-southeast1). To do this it receives the document content and the business and job details printed on it.
• Resend — sends sign-in, confirmation and password-reset emails. It receives your email address and the content of the email.
• Stripe — payment processing for paid subscriptions, when paid plans are enabled. Card details are handled by Stripe and are not stored by us.
• Google Fonts — our website loads fonts from Google, which receives your IP address and browser details when a page loads.

If a subscriber publishes a construction detail to the Office Details catalogue, that detail, the name shown with it and any discussion comments are visible to other subscribers.

We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety and property of Office Toolbox, our customers or others.

6. Overseas disclosure

Our database and uploaded files are hosted on Supabase infrastructure located in Sydney, Australia (ap-southeast-2), and our application functions and document generation run in Sydney. Some information is disclosed to recipients outside Australia:

• United States — Vercel's network, which may serve website and application requests; Google, for fonts; and Stripe, when paid plans are enabled.
• Japan — Resend processes our emails in Tokyo.

Where information is disclosed to an overseas recipient, we take reasonable steps to ensure the recipient handles personal information consistently with the APPs, including through contractual data-protection terms.

7. Storage, security and retention

We take reasonable steps to protect personal information, including workspace isolation, access controls, and encryption of data in transit. No system is perfectly secure, and we cannot guarantee absolute security.

We retain personal information for as long as an account is active and as needed to provide the Service. When an account closes, we may keep its data for as long as we reasonably need it for our business purposes — including construction details published to the Office Details catalogue — to meet legal requirements, or to resolve disputes. Some records — particularly our own financial records about a subscription — are retained for at least 7 years to meet Australian legal obligations. Waitlist email addresses are kept until sign-up opens and we have told you, or until you ask us to remove yours. When data is no longer required, we take reasonable steps to delete or de-identify it.

8. Notifiable data breaches

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

9. Access and correction

You may request access to, or correction of, the personal information we hold about you by emailing hello@buildmanager.cloud. We will respond within a reasonable period. If we decline a request, we will explain why where required. Subscribers can also access and amend much of their data directly within the Service. If you are named on a job, you may also ask the subscriber who entered your details to correct or remove them.

10. Cookies and local storage

The Service uses essential cookies to keep you signed in, a cookie to remember which job you are working on, and browser storage to remember your colour-scheme choice. These are necessary for the Service to function as you expect. We do not use advertising or tracking cookies.

11. Children

Office Toolbox is intended for use by adults in a professional context. It is not directed at children, and we do not knowingly collect personal information from anyone under 16.

12. Complaints

If you believe we have breached the APPs, contact us at hello@buildmanager.cloud and we will investigate. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Changes to this Policy

We may update this Policy from time to time. The current version will always be available on our website and within the Service, and material changes will be notified by reasonable means.

14. Contact us

BuildManager.Cloud Pty Ltd, trading as Office Toolbox — ACN 702 052 202
Email: hello@buildmanager.cloud
Websites: officetoolbox.com.au and app.officetoolbox.com.au
Location: Gold Coast, Queensland, Australia