Privacy Policy

Last updated 30 July 2026

Footing is job-management software for Australian trade and construction businesses. This policy explains what personal information we handle, why, where it is stored, and the choices you have. It is written to meet our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

In this policy, “we” means Footing, operated by [registered entity name], ABN [ABN]. “You” means a person whose information we handle. “Customer” means a business that subscribes to Footing.

The two roles we play

This distinction matters, because it changes who you should contact about your information.

• Our own customers. When a builder signs up, we decide how their account information is handled. We are responsible for it, and this policy governs it.
• Data our customers put into Footing. A builder using Footing records details about their clients, staff, sub-contractors and sites. We hold and process that information on their instructions, as their service provider. We do not decide what they collect or what they do with it, and we do not use it for our own purposes. If your builder holds information about you and you want to see, correct or delete it, ask them first — they control it. We will support them in responding.

What we collect

From our customers

• Account and identity: name, email address, phone number, business name, ABN, role.
• Billing: subscription tier, billing cycle, invoice history. Card details go directly to Stripe — we never see or store a card number.
• Usage and technical: pages visited, actions taken, IP address, browser and device type, and server logs used to run and secure the service.

Recorded by our customers about other people

Depending on how a customer uses Footing, this can include:

• Their clients and client contacts — names, email addresses, phone numbers, billing and site addresses, ABNs.
• Their staff and sub-contractors — names, contact details, roles, licences and credentials, insurance details, labour cost and charge-out rates, timesheets and attendance records.
• Job records — sites, schedules, quotes, invoices, payments, variations, purchase orders, photos and documents.
• Work health and safety records — SWMS, JSA and induction forms, incident reports, and the signatures captured on them.
• Signed documents — accepted quotes, variations and progress claims, stored as PDFs with a SHA-256 hash so the signed copy can be shown to be unaltered.

Some of this is sensitive information under the Privacy Act — health information in an incident report, for example. Our customers are responsible for having a lawful basis to collect it. We hold it under the same protections described below.

Why we use it

• To provide the service — running jobs, quotes, invoices, scheduling and compliance workflows.
• To send transactional email — invoices, quote and variation approval requests, invitations, reminders and notifications. These are not marketing.
• To take payment and manage subscriptions.
• To secure the service — authentication, access control, abuse and fraud prevention, and diagnosing faults.
• To support customers who contact us.
• To meet legal and record-keeping obligations.

We do not sell personal information. We do not use customer data to train, fine-tune or otherwise improve machine-learning models.

Where your information is stored

Application data — the databases and uploaded files — is stored in Amazon Web Services in the Asia Pacific (Sydney) region, ap-southeast-2. Each customer’s data lives in its own separate database rather than a shared one.

Some of the providers listed below operate outside Australia, so information can be disclosed overseas as part of running the service. Where that happens we take reasonable steps to ensure the provider handles it consistently with the APPs.

Who else handles it

We use these providers to deliver the service. Each is bound by its own agreement with us.

We also disclose information where the law requires it, or to protect the rights or safety of a person.

AI assistant connections

Footing can be connected to an AI assistant such as Claude or ChatGPT. This is off by default and must be switched on deliberately by a customer administrator.

When it is switched on, that assistant can read and act on the connecting customer’s Footing data on their behalf, and information is sent to whichever AI provider they chose. That provider’s own terms then apply to how it is handled. A customer can revoke the connection at any time in Settings, which immediately stops further access. We do not send data to any AI provider unless a customer has connected one.

Sharing links you may receive

Footing lets our customers send quotes, invoices, variations and progress updates by an emailed link that opens without a password. Anyone with the link can view that document, so treat it as confidential. Links can be revoked by the customer who issued them.

How long we keep it

We keep customer account data for as long as the account is open. After an account closes we retain it for up to 90 days so it can be restored or exported, then delete or de-identify it, except where we must keep records longer — Australian tax and financial records generally need to be kept for five years.

Credentials used for a one-off data import are encrypted for the duration of the import and deleted within five minutes of it finishing. Backups are retained on a rolling cycle and overwritten in the ordinary course.

How we protect it

• Encrypted in transit with TLS, and at rest in AWS-managed storage.
• Access tokens for connected services — Xero, Stripe, email — are individually encrypted with a key unique to each customer, so a single compromised key cannot unlock another customer’s credentials.
• Each customer’s records live in a separate database, not a shared table.
• Role-based access inside the product, so staff and sub-contractors only see what their role allows.
• Access to production systems is restricted to the people who need it to operate the service.

No system is completely secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Cookies

We use cookies and similar browser storage that are necessary to keep you signed in and to remember interface preferences. We do not use advertising or cross-site tracking cookies.

Your rights

You can ask us to give you access to the personal information we hold about you, correct it if it is wrong, or delete it where we are not required to keep it. You can also withdraw consent to optional processing, and ask how we handle your information.

Email hello@getfooting.com.au. We will respond within 30 days. We may need to verify who you are first. If your information was recorded by a business using Footing, we will refer you to them, since they control it.

Complaints

If you think we have mishandled your information, email hello@getfooting.com.au and we will investigate and respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes

We may update this policy. The date at the top shows when it last changed. If a change materially affects how we handle your information we will tell affected customers by email before it takes effect.

Contact

[Registered entity name], ABN [ABN]
hello@getfooting.com.au