Privacy Policy

Subino is operated by Subino Pty Ltd(ACN 701 879 601, ABN 52 701 879 601), a company registered in Victoria, Australia. In this policy “Subino”, “we” and “us” mean that company.

We make estimating and job-management software for construction subcontractors. This policy covers both this website, subino.com.au, and the Subino application at app.subino.com.au. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Anything on this page: support@subino.com.au.

This website is open to anyone. It collects what you type into a contact or demo form, and analytics about how the website is used, with form inputs masked.

The Subino app is behind a login and is used by businesses. It holds their projects, their costs, their staff and their clients. Sections 4 and onwards are about the app, and they are the bulk of this policy.

There is a further distinction inside the app. Information about our own account holders is ours to handle. Information a customer puts intoSubino about their clients, suppliers and staff belongs to that customer — we host and process it on their instructions, and each customer’s data is kept separate from every other customer’s. If your employer entered your details, they control that record; see section 11.

When you contact us or book a demo: your name, company, email address, phone number and whatever you write in the message.

Forms are saved as you type.Once you have entered a valid email address or phone number, what you have typed into the form so far is saved to our database, even if you never press Send. We do this so that if the form fails or you get stuck, we can get in touch and help. Only the form’s own fields are saved (name, company, email, phone, the tools question and the message) — nothing else on the page. If you do not send it, a member of our team may contact you once about it; we never send automatic follow-up emails.

Unsent forms are deleted after 30 days unless we have already made contact with you about them, in which case they are kept with your enquiry.

Session recording. We use PostHogto record how visitors move through this website — pages viewed, clicks, scrolling and whether a form showed an error — so we can find and fix what gets in people’s way. Everything typed into form fields is masked in the recording: it shows that a box was used, never what was typed. PostHog stores an identifier in your browser for the visit. Recording only runs on this marketing website, never inside the Subino app.

Who sees it.Saved forms and recordings are seen only by Subino staff, in our own admin system. Where a form was not sent, an AI model (Anthropic) may read the recorded clicks — not the masked values — to write a short note on why the form was not sent.

Account details.Your email address and name, your role and what you are permitted to see and do, whether your account is active, and an hourly rate where your employer uses Subino to cost labour. A business’s account is set up when the business signs up for a trial or a plan, or when we set up its workspace. After that, the business’s administrator invites each user.

Project and business information entered by users. Jobs and site addresses; quotes, estimates and cost sheets; contact details for clients and suppliers; purchase orders, requests for quotation, supplier bills, variations and progress claims; tasks, notes and follow-ups.

Work records.Clock-in and clock-out times, shift durations and overtime, recorded against a named worker, and — where the business has the location setting on and the worker allows it — the phone’s position at those two taps (see section 5). We treat this as sensitive, because it is information about identifiable people’s working hours and pay.

Files and photographs. Photos and documents attached to site diaries, jobs, purchase orders and supplier bills, company branding images, and anything sent through the in-app feedback form.

Email sent and received. Subino sends quotations, purchase orders and notifications on your behalf, so we hold the recipient addresses, subject lines, message content and attachments. When someone replies to one of those emails, the reply comes back into Subino and is stored against the relevant document.

Technical information. Ordinary server and hosting logs, including IP addresses, kept for security and troubleshooting.

No tracking inside the app. The Subino application contains no analytics package, tag manager or session recorder of any kind. The analytics and session recording described in section 3 run on this marketing website only.

No advertising. No ad networks, no advertising identifiers, no profiling. We do not sell personal information, and we do not share it with advertisers or data brokers.

No third-party tracking cookies. In the app, the only things stored in your browser are your login session and your interface preferences.

No location tracking — only a location at the clock taps.Where a business has the Time Clock’s location setting on (it is on unless the business turns it off), the phone’s position is recorded once when a worker clocks in and once when they clock out, if the worker allows it on their phone. Subino never follows a phone between those two taps and never tracks location in the background. The business can see those two points on the timesheet; the business is responsible for telling its workers about this.

No payment card details and no biometrics. Subino does not collect or store payment card details or biometric information.

To provide the software a customer has engaged us for; to send the notifications and documents users ask Subino to send; to keep accounts secure and investigate misuse; to support users who ask for help; and to fix faults and improve how Subino works.

We use information from this website to reply to your enquiry, arrange demonstrations and — where you would reasonably expect it — tell you about Subino.

We do not use information a customer enters into the app for any purpose of our own beyond running the service for them.

We use a small number of service providers, each receiving only what it needs. This is the complete list as at the date at the top of this page.

Supabase — our database, login system and file storage. Application data is hosted in Sydney, Australia.

Netlify — serves this website and the app, and sees ordinary request information such as IP addresses.

Resend — sends and receives email on our behalf: notifications, quotations and purchase orders, including recipient addresses, subject lines, message content and attachments. Resend processes email outside Australia.

Anthropic (Claude) — powers AI features such as the in-app assistant, summarising follow-up notes and messages, and reading a supplier quotation or email a user has uploaded or forwarded. Content is sent to be processed and the result returned. Anthropic is based in the United States. Its commercial terms do not allow it to train its models on this content.

Google(Gemini) — reads supplier bills a business uploads or forwards, so the user can check the filled-in bill. It also reads tender emails forwarded into Subino, and writes short summaries of each job’s latest messages. Only the document or text needed is sent, and the result is returned. Google processes this outside Australia.

TypeSafe (Jev) — a small decision model that sorts short pieces of text (for example, which kind of email or request something is) so the right feature handles it. It receives only the short text being sorted. TypeSafe is hosted in the United States and its terms do not allow it to train models on that text.

Apple and Google push services — deliver notifications to phones and browsers. They receive the notification text and a device token.

Notion — receives messages sent through the in-app feedback form.

Xero — accounting integration, used only where a customer connects their own Xero account. Bill and invoice information is exchanged.

Stripe— takes card and BECS direct-debit payments for Subino subscriptions. It receives the payer’s name, email address and card or bank details. Subino never sees or stores full card or bank details. Stripe may process this information outside Australia.

Meta (WhatsApp) — only if you ask us to contact you on WhatsApp from this website: your name, phone number and messages are exchanged through WhatsApp.

PostHog — session recording and analytics on this marketing website only, with form inputs masked, as described in section 3. PostHog is hosted in the United States.

Some of these providers process information outside Australia. Where they do, we take reasonable steps to ensure it is handled consistently with this policy. We may also disclose information where the law requires it, or to establish or defend a legal claim.

Subino lets a user send a purchase order, request for quotation, variation, progress claim, drawing or follow-up to someone outside their business — a builder or a supplier — as a link. Anyone holding that link can open the document and respond to it without a Subino login. The link contains a long random token and is neither published nor indexed, but it is not password-protected.

Only the document that was shared, and messages explicitly marked as shared, are visible through such a link. Internal notes, costs and margins are never included. Treat these links as you would an email attachment: anyone you forward one to can open it.

Application data and files are held by Supabase in Sydney, Australia. Website enquiries are stored with our cloud database provider with access restricted to authorised personnel.

Information is encrypted in transit. Access is controlled per business, so one customer’s users cannot reach another customer’s data, and within a business what each person can see and do is controlled by their role. Access to production systems is limited to those who need it.

No system is perfectly secure. If a data breach occurs that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

We keep a customer’s information while its account is active. When the subscription ends, or the account is locked and stays locked, we keep the information for 90 days so the customer can export it or come back. We email the account’s administrator at least 14 days before the 90 days end. We then permanently delete it from our live systems, and backup copies are gone within a further 30 days. A customer can ask us in writing to delete its information sooner, or to keep it longer. Construction records are often needed years later, so customers should export them before they leave. We keep invoices and payment records for as long as tax law requires. Website enquiries are kept only as long as they are useful for responding to you. A website form that was saved as you typed but never sent is deleted after 30 days, unless we have already contacted you about it.

You can ask us what personal information we hold about you, ask us to correct anything wrong, or ask us to delete information where we are not required to keep it. Write to support@subino.com.au. We will respond within a reasonable time, and may need to verify who you are first.

If a business entered your details — for example your employer recording your hours — that business controls the record. Please contact them first. If you cannot resolve it with them, contact us and we will help.

Each user’s login is created and managed by the business’s administrator. To close a login, ask your administrator, or contact us and we will arrange it. To end a business’s whole subscription, see our Subscription Agreement.

Subino is a tool for businesses and is not directed at children. We do not knowingly collect information about anyone under 18, other than where an employer records a lawfully employed apprentice or worker.

If you think we have mishandled your information, tell us first at support@subino.com.au. We will acknowledge your complaint and respond within a reasonable time. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We may update this policy from time to time. The current version is always published on this page with its last-updated date. Where a change materially affects how we handle personal information, we will tell account holders by email before it takes effect.