Privacy Policy

This Privacy Policy explains how TrueAgent Pty Ltd ACN 636 626 956, ABN 70 636 626 956, trading as Snap Job Reports (we, us or our), collects, uses, holds, discloses and protects personal information when you visit snapjobreports.com (the Website), enquire about or sign up for the Snap Job Reports software-as-a-service application, use our web or mobile field app, or otherwise interact with us (together, the Services).

We handle personal information in accordance with the Australian Privacy Principles (APPs) set out in the Privacy Act 1988 (Cth) (Privacy Act). We operate from Australia. We host the database and file storage that hold Customer Data in Sydney, Australia. Some other parts of the Services, including our AI voice features, are run by overseas providers. Clause 5 and clause 6 set out what is processed where, and what crosses Australia’s borders. If we expand to offer the Services in other countries, we will update this policy and notify customers before doing so.

Capitalised terms not defined in this policy have the meaning given in our Terms of Service.

1Who this policy applies to

This policy applies to:

• Visitors to the Website, and people who submit our beta-interest or support forms;
• Administrator users who sign in to the Snap Job Reports administrator portal on behalf of a customer organisation;
• Field technicians who use the Snap Job Reports field app, either the web app opened from ServiceM8 or another Connected Platform, or our iOS or Android mobile app;
• Customers’ clients and other individuals whose personal information is captured by the Services (for example, building occupants or members of the public visible in photographs taken at job sites, people named or heard in voice notes, or signatories on certificates); and
• Prospects, leads and recipients of marketing communications.

We act in two different capacities, and your rights differ depending on which applies:

• Where we handle information in our own right — for example, beta-interest and support-form submissions, marketing-list contacts, administrator and billing-contact identities, and our own technical and security logs — we are the APP entity responsible for that information, and you can exercise the rights in clause 10 directly with us.
• Where we handle Customer Data on a customer’s behalf — the job, photo, voice-note and field-capture content inside a customer’s account — the customer decides how that information is used, and we act as their service provider. Individuals seeking access, correction or deletion of personal information held by us on a customer’s behalf should generally direct those requests to the customer in the first instance, and we will assist the customer to respond.

2The kinds of personal information we collect

The categories of personal information we collect depend on how you interact with us.

2.1 Account and identity information

• Name, email address, role/title and avatar of administrators;
• Tenant organisation name, trading name, address, ABN, contact email and contact phone;
• When a business connects Snap Job Reports to ServiceM8, contact details for that business drawn from its ServiceM8 account (such as business email addresses of its staff), so we can welcome and support the new account;
• Last sign-in time and similar account-activity timestamps;
• Membership role within the customer’s account (administrator, editor, viewer);
• Invitation, revocation and access-history records.

2.2 Beta-interest and support enquiries

When you submit our beta-interest form or our support form on the Website, we collect what you type into it. For the beta-interest form: your name, work email, company name and the platform you use. For the support form: your name, work email, a subject line, the platform you use, and a free-text message (up to 5,000 characters) describing your query. We use this information to respond to you, to assess and manage beta access, and to operate and improve our support. Please see clause 5.1 and clause 6 for an important explanation of where these submissions are sent and stored, and clause 7.5 for how long we keep them.

2.3 Field-technician session and device information

• The technician’s name, email and role as supplied by the Connected Platform (e.g. ServiceM8 staff record);
• Short-lived, job-scoped session tokens (not stored after expiry);
• A one-way HMAC hash of the IP address used to launch the session (we do not keep the plain-text IP address in our own session records; see clause 2.9 for our analytics provider);
• Device metadata such as device model, operating system, app version, browser type and screen size (for diagnostics);
• If you use our mobile app and allow notifications, a push-notification token for your device, so we can tell you about newly assigned jobs and approved reports.

If you turn on Face ID or fingerprint unlock in our mobile app, your device checks your face or fingerprint. We never receive or store biometric data.

2.4 Field-capture content

• Photographs taken or uploaded through the field app. When we create the optimised copies of each photo that are shown in the app and placed in reports, we remove the EXIF metadata embedded by the capturing device, including geolocation coordinates and camera details. The original file you upload is kept as uploaded, so it may still contain that metadata until the original is deleted (see clause 7.2);
• Annotations, ratings, defect notes, environmental readings (e.g. temperature, humidity), tags and other field data captured by technicians;
• Schematic diagrams, floor plans or other drawings uploaded for annotation;
• Signature images captured for certificates of compliance.

2.5 Voice notes and transcripts

On plans that include AI voice features, technicians can dictate notes instead of typing. When a technician uses voice capture, we collect:

• The audio recording, which contains the technician’s voice and may pick up other people speaking nearby;
• The text transcript of the recording; and
• The form-field suggestions produced from the transcript (for example, a rating or a defect description).

We keep the audio recording in the customer’s account so there is a record of what was said, and so we can check and improve the accuracy of the voice features for that customer. We do not use voice recordings to identify or verify who is speaking. Clause 4A explains how the voice features work and which providers process this information.

2.6 Job and business information from Connected Platforms

With the customer’s authorisation, we synchronise data from Connected Platforms (currently ServiceM8), which may include: job numbers, job descriptions, client names, site addresses, assigned staff, materials lists, checklists and similar operational information. Some of this information may identify individuals (for example, a client’s contact name or a site address).

2.7 Plan, usage and billing information

We record which plan an account is on (including the free plan and any free trial), trial start and end dates, the number of reports generated against the plan’s monthly allowance, and any top-up packs purchased. When paid billing is available, we also hold the billing contact name and email, organisation name, ABN and invoice history. Card payments will be processed by our payment provider, which will collect and hold your card details. We will not store full card numbers; we will keep only a reference to the payment method and the transaction. We will add our payment provider to our Sub-processor list before paid billing starts (see clause 5.1).

2.8 Communications

Records of your correspondence with us, including support submissions, emails and (where permitted and with notice) recorded voice calls.

2.9 Technical, security and analytics information

• Device, browser, operating system, language preferences and timezone;
• Pages and screens viewed and actions taken within the Services, request timestamps and response codes;
• Product analytics and error reports from the administrator portal, the web field app and the mobile app, collected by PostHog. Users are identified by an internal account identifier, not by name or email. PostHog also receives your IP address and uses it to estimate your general location;
• Session-replay recordings of the administrator portal and the web field app, captured by PostHog. Replays show what was on screen and what was clicked. Text typed into input fields is masked, and some photo views are hidden, but other on-screen content (such as job details, client names, site addresses and some photos) can appear in a replay. Replays also capture browser console messages;
• Application logs and metrics (OpenTelemetry) sent to Grafana Cloud, and server logs held by our hosting provider, for diagnosing faults and securing the Services. Logs mainly contain identifiers, timings and error details. At the date of this policy, logs from our voice features can also include the text of voice transcripts and the prompts and results of AI form filling, which may contain job details;
• Cookies, local storage and similar identifiers (see clause 11).

2.10 Marketing information

Where you sign up for our newsletter, request a demo, attend an event we organise, or otherwise provide your contact details for marketing purposes: your name, email, organisation, trade and any preferences you indicate.

2.11 Sensitive information and children

We do not intentionally solicit sensitive information (as defined in the Privacy Act — such as health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record or biometric templates), and we ask that you do not submit it through the Services. We recognise, however, that sensitive information could be captured incidentally — for example in a free-text support message, a field note, a voice note, or a photograph that happens to show a person’s face or health-related details. Where that occurs, we handle the information consistently with APP 3 and APP 4: we will not use it for any purpose for which it was not provided, and we will delete or restrict it where appropriate and on request. Please avoid including sensitive details in free-text fields and voice notes.

We do not knowingly collect personal information about children. The Services are intended for use by adult tradespeople and businesses. If you believe a child’s personal information has been provided to us, please contact us and we will delete it unless we are required by law to retain it.

3How we collect personal information

We collect personal information:

• Directly from you, when you submit a beta-interest or support form, sign up, install our ServiceM8 add-on, configure your branding, contact us, request a demo or use the Services;
• From your Authorised Users, when administrators or technicians log in, capture photos, record voice notes, enter data or generate reports;
• From Connected Platforms, with your authorisation, when we synchronise jobs, staff lists, checklists and similar data;
• Automatically, through cookies, device identifiers, log files, analytics, session replay and error-monitoring tools when you interact with the Services;
• From third parties, such as referral partners or publicly available business directories, in limited circumstances and only where doing so complies with the Privacy Act. Where we obtain your contact details this way, we rely on a lawful basis to contact you (including, for marketing, consent that is express or that can reasonably be inferred from an existing or enquiry relationship — see clause 10.3), and we will tell you the source on request.

4Why we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for the following purposes:

1. Providing the Services — setting up and authenticating accounts; minting field-technician sessions; ingesting, processing, storing and rendering field-capture content into PDF reports; turning voice notes into text and form-field suggestions; sending push notifications to the mobile app; delivering reports back to Connected Platforms or to email recipients designated by the customer.
2. Responding to enquiries and support — receiving and acting on beta-interest and support-form submissions, managing beta access, and answering your questions.
3. Operating and securing the Services — monitoring availability, performance and error rates; detecting and responding to fraud, abuse, security incidents and policy violations; maintaining audit trails for accountability.
4. Communicating with you — sending transactional messages (e.g. sign-in codes, report-delivery notifications, plan-usage and trial notices, billing notices, security alerts) and, where permitted under the Spam Act 2003 (Cth), product updates and marketing (see clause 10.3).
5. Plan, billing and account management — managing free plans, free trials and paid plans, counting reports against plan allowances, processing top-up purchases and subscriptions, generating tax invoices, recovering overdue Fees.
6. Improving the Services — analysing how the Services are used, diagnosing bugs, checking the accuracy of voice features, prioritising features. We use de-identified, aggregated Service Analytics where we can.
7. Complying with law — meeting our legal, tax, regulatory and audit obligations and responding to lawful requests from regulators, courts and authorities.
8. Enforcing our terms — investigating suspected breaches of our Terms of Service and exercising or defending our legal rights.

We do not use Customer Data to train AI or machine-learning models. We only send Customer Data to AI providers under terms that do not allow them to train their models on it, and our agreements with other Sub-processors that handle Customer Data require them not to use it to train their own models. Checking the accuracy of our voice features for a customer, using that customer’s own recordings and transcripts, is not model training.

4A AI voice features

Our voice features use AI services from other companies. They work like this:

1. A technician holds the voice button and speaks. The audio is sent to OpenAI, either as a live stream from the technician’s device or as a recording through our servers, and OpenAI returns a text transcript.
2. We send the transcript, together with details about the item being inspected (such as the asset type and its components) and the list of form fields to fill, to OpenRouter. OpenRouter passes the request to the AI model we have selected, which currently is an OpenAI model. The model suggests values for the form fields.
3. The technician sees the transcript and the suggestions and decides what to keep. Nothing is added to a report unless a person in the customer’s business accepts it or approves the report.

OpenAI and OpenRouter process this information in the United States. They receive it only to provide these services to us, and our terms with them do not allow them to use it to train their models. Voice features only run when a technician chooses to use them. If a customer does not want voice data sent to these providers, their technicians can type instead.

5Who we share personal information with

We disclose personal information only in the following circumstances:

5.1 Our Sub-processors

We use carefully selected service providers to host and operate the Services. A current list is maintained at snapjobreports.com/sub-processors. At the date of this policy, our Sub-processors are:

Important: how our beta-interest and support forms work. When you submit the beta-interest form or the support form on our Website, the details you enter are sent to, and recorded in, a Google Chat space (operated by Google in the United States and Australia) using an incoming webhook. That Chat message is currently our system of record for these enquiries. There is no separate Website enquiry database. We have told you this here, and we repeat it in a short notice next to each form, so that you can decide what to include before you submit. Please do not include sensitive information or more personal detail than you need to in the free-text fields. We keep these enquiries only as long as set out in clause 7.5.

We require each Sub-processor, by contract (which for some providers means their standard data processing terms), to: (a) handle personal information only on our documented instructions; (b) implement appropriate technical and organisational security measures; (c) maintain confidentiality; and (d) cooperate with our compliance obligations. We remain accountable for our Sub-processors’ handling of personal information.

New Sub-processors. Before we add a new Sub-processor or materially change what an existing one does, we update the Sub-processor list and notify account administrators as described on that page. For example, we will add our payment provider before paid billing starts, and we will add any AI provider used by future AI features (such as AI report writing) before those features go live.

5.2 Connected Platforms

Where the customer authorises an integration, we read from and write to those Connected Platforms (for example, attaching a generated PDF to a ServiceM8 job). The handling of personal information by Connected Platforms is governed by those platforms’ own terms and privacy policies.

5.3 Customer’s own recipients

Reports generated through the Services may be sent or shared by the customer to its own clients, regulators, insurers or others. We act on the customer’s instructions in delivering those reports; the customer chooses the recipients and is responsible for the contents of, and the recipients of, those reports.

5.4 Professional advisers

Our lawyers, accountants, auditors and similar professional advisers, under confidentiality obligations.

5.5 Business transfers

In connection with a proposed or actual merger, acquisition, financing, sale of assets, restructure or insolvency, we may disclose personal information to prospective buyers, advisers and other parties involved in the transaction, subject to confidentiality obligations. If a transaction proceeds, personal information may be transferred as part of the assets, with notice to affected customers.

5.6 Law enforcement and regulators

Where required or permitted by law, we may disclose personal information to law enforcement, regulators, courts or other authorities (for example, in response to a subpoena, court order or a request made under the Australian Privacy Principles or the Notifiable Data Breaches scheme).

5.7 With consent

To any other person where you have consented to the disclosure.

5.8 We do not sell personal information

We do not sell, rent or trade personal information for marketing purposes.

6Overseas disclosure (APP 8)

Some of the Sub-processors listed in clause 5.1 process personal information outside Australia. Specifically:

• Singapore: Railway, which renders report PDFs and in doing so processes job photographs (which may show individuals), site addresses, signatures, defect notes and report narrative;
• United States: OpenAI and OpenRouter, which process voice recordings, transcripts and inspection context for our voice features (clause 4A); Resend, which delivers report-delivery emails including the report PDF and its contents together with the recipient’s email address; Expo, Apple and Google, which deliver push notifications that can include a job number and site address; PostHog, which receives product analytics, error reports, IP addresses and session replays that can show job details (clause 2.9); and Google (Workspace and Chat), which receives our beta-interest and support-form submissions (including free-text), sign-up alerts and operational alerts;
• Outside Australia (location depends on our hosting provider’s configuration): Vercel, which operates the Website and application and therefore processes personal information in transit and in short-term server logs, which can include voice transcripts. Its compute region is set in our hosting provider’s configuration and is presently outside Australia; we treat all Vercel processing as an overseas disclosure for the purposes of this clause.

The database and file storage that hold Customer Data (Supabase) are in Sydney, Australia, and our application logs and metrics (Grafana Cloud) are held in Australia. Some of these providers are based overseas, and their personnel may access the data from outside Australia to support and secure their services.

Before disclosing personal information to an overseas recipient, we take reasonable steps (consistent with APP 8.1) to ensure the recipient does not breach the APPs in relation to that information, including by putting in place contractual terms requiring each recipient to handle personal information in a manner substantially equivalent to that required under the Australian Privacy Principles. Because some report content (Resend), voice content (OpenAI and OpenRouter), replay content (PostHog) and enquiry content (Google) is comparatively rich, we pay particular attention to these flows: we limit what is sent, customers control who reports are delivered to, voice features only run when a technician uses them, and we keep report links and access controlled. We remain accountable under the Privacy Act (including section 16C) for personal information we disclose to these overseas recipients. If an overseas recipient mishandles your information, we may be liable as if we had done so ourselves. If you would prefer that we not disclose your personal information overseas, please contact us. In some cases we may not be able to provide the Services, deliver a report, process a voice note or respond to an enquiry without doing so.

7Where we hold personal information and how long for

7.1 Hosting and storage

Customer Data and account information, including voice-note recordings, are hosted by Supabase in Sydney, Australia (AWS ap-southeast-2). Backups are taken in the same region. Application logs and metrics are held by Grafana Cloud in Australia. Product analytics, error reports and session replays are processed by PostHog in the United States. Voice notes are processed by OpenAI and OpenRouter in the United States. Report-delivery email passes through Resend in the United States; push notifications pass through Expo, Apple and Google in the United States; beta-interest and support-form submissions are recorded in Google Chat (United States and Australia); and PDF rendering occurs on Railway in Singapore. See clause 6.

7.2 Retention of Customer Data

While a customer’s account is active, we retain Customer Data for as long as the customer requires it for their business purposes. A customer’s administrator can set a retention period for original photographs, which defaults to 365 days. We have not yet built automatic deletion of original photographs at the end of that period. Until we do, the setting is recorded but not applied, and the operative controls are: original photographs are retained while the account is active and are deleted on account termination in accordance with clause 7.3, or earlier on request to privacy@snapjobreports.com. We will update this clause when automatic deletion is live. Optimised copies of photographs used to compose reports are kept for the life of the account to preserve report integrity. Voice-note recordings and transcripts are kept for the life of the account, and are deleted on termination in accordance with clause 7.3 or earlier on request.

7.3 Retention after termination

On termination of an account:

• The customer’s administrators retain export access for 30 days;
• Customer Data is deleted from primary production systems within a further 60 days;
• Backup copies are purged in the ordinary course of our backup rotation cycle, and in any event within 90 days after termination.

Certain limited records (billing records, audit trails, security logs) may be retained for longer where necessary to comply with law (for example, taxation records under the income-tax legislation).

7.4 Marketing data

Marketing contact records are retained until you unsubscribe or otherwise object, plus a reasonable suppression period to honour your opt-out.

7.5 Beta-interest and support enquiries

Beta-interest and support-form submissions recorded in Google Chat (clause 5.1) are retained for no longer than 12 months from the date of the enquiry, after which we delete or de-identify them, unless (a) the enquiry has become part of an active account or support matter, or (b) we are required to retain it to comply with law or to establish, exercise or defend a legal claim. You can ask us to delete your enquiry sooner by emailing privacy@snapjobreports.com.

7.6 Product analytics, session replay and logs

Session replays processed by PostHog (clause 2.9, clause 6) are deleted after 30 days. Product-analytics events and error reports processed by PostHog are retained for no longer than 12 months and are then deleted or de-identified in the ordinary course. Application logs held by Grafana Cloud and our hosting provider are kept only for the limited period our logging plans allow, and are then deleted automatically.

8Security

We take security seriously and apply layered technical and organisational measures, including:

• Transport encryption: TLS for all traffic between users, the Services and Sub-processors;
• Encryption at rest: managed-database and object-storage encryption provided by Supabase and other Sub-processors;
• Secrets management: Connected Platform tokens are stored within Supabase Vault and referenced by secret identifier — raw access tokens are not stored in application tables;
• Tenant isolation: Postgres Row-Level Security policies enforce per-tenant access scoping at the database layer;
• Authentication: administrators authenticate through ServiceM8 OAuth, so sign-in (including any multi-factor authentication) is governed by the customer’s ServiceM8 configuration; field technicians verify their identity by a one-time code and receive short-lived, signed, job-scoped session tokens. In the mobile app, the session token is kept in the device’s secure storage, and technicians can turn on Face ID or fingerprint unlock;
• AI access keys: our main AI provider keys stay on our servers. Devices that stream audio for live transcription receive only a short-lived, single-purpose key;
• IP-address minimisation: where we record IP addresses in our own session records for security purposes, we keep only an HMAC hash;
• Session-replay masking: text typed into input fields is masked, network requests and responses are not recorded, and some photo views are hidden in session replays;
• Access controls: production access by our personnel is restricted, role-based and audit-logged;
• Logging and monitoring: application and security events are sent to Grafana Cloud and PostHog for monitoring and incident response;
• Backups and disaster recovery: regular automated backups with documented restore procedures;
• Secret rotation: high-privilege credentials (e.g. ServiceM8 OAuth client secrets) are rotated on a scheduled basis.

No system is perfectly secure. While we work hard to protect personal information, we cannot guarantee that it will not be subject to unauthorised access, loss, misuse or disclosure.

9Data breaches and notification

If a data breach occurs, two separate sets of obligations may apply, and we keep them distinct:

9.1 Our obligations as an APP entity (statutory: Notifiable Data Breaches scheme)

For personal information we hold in our own right (for example, beta-interest and support enquiries, marketing-list contacts, administrator and billing-contact identities, and our own technical and security logs), we are responsible under the Notifiable Data Breaches (NDB) scheme in Part IIIC of the Privacy Act. If we suspect on reasonable grounds that an eligible data breach may have occurred, we will carry out a reasonable and expeditious assessment and take all reasonable steps to complete it within 30 days (and faster where we can). If we determine there are reasonable grounds to believe an eligible data breach has occurred, we will notify the Office of the Australian Information Commissioner (OAIC) and the affected individuals as soon as practicable, in accordance with the scheme. These statutory timeframes are not the same as, and are not replaced by, the contractual commitment described in clause 9.2.

9.2 Our contractual commitment to customers (for Customer Data we process on their behalf)

Where we process Customer Data on behalf of a customer, the customer is usually the APP entity for that data and runs its own NDB assessment. To help the customer meet its obligations, we commit by contract to notify the customer’s designated administrator contact of any suspected or confirmed eligible data breach affecting their Customer Data without undue delay and, for a confirmed breach, in any event within 72 hours of confirming it, and to provide reasonable assistance and information for the customer’s own assessment and notifications. This 72-hour figure is our own service commitment to customers. It is not a requirement of the NDB scheme, which operates on the statutory timeframes described in clause 9.1.

We also recognise that a serious invasion of privacy can give rise to claims under the statutory tort that commenced on 10 June 2025. Our security measures (clause 8), including session-replay masking, and the limits we place on what we send to AI providers, are designed with that in mind.

10Your rights — access, correction, deletion and complaints

10.1 Access and correction

You may request access to, or correction of, your personal information held by us. We will respond within a reasonable period (and in any event within 30 days) and we will not charge for making the request (although we may charge a reasonable fee for the cost of providing access where significant work is required). If we refuse a request, we will give you written reasons and information about how to complain.

10.2 Deletion

You may ask us to delete personal information about you. We will comply except where retention is required by law, necessary for the establishment, exercise or defence of legal claims, or otherwise permitted under the Privacy Act. Where personal information is held by us on behalf of a customer (for example, an administrator’s account record, a photograph or a voice note within a customer’s tenant), we will refer the request to the customer in the first instance. Where we hold the information in our own right (for example, a beta-interest or support enquiry under clause 7.5), we will action your deletion request directly.

10.3 Marketing and the Spam Act 2003

We send commercial electronic messages (such as product-update and marketing emails) only where we have your consent — either express consent, or consent that can reasonably be inferred from an existing customer relationship or from an enquiry you have made about products of the kind we offer. Signing up for a free plan or a free trial is not, by itself, consent to marketing unless you tell us otherwise. Every marketing message will clearly identify us as the sender and include a functional unsubscribe facility. You may opt out at any time using the unsubscribe link in any marketing message, or by emailing privacy@snapjobreports.com; we will action unsubscribe requests within 5 business days. Transactional messages (sign-in codes, plan-usage and trial notices, billing notices, security alerts, service-critical notifications) are not marketing and cannot be opted out of while you have an active account.

10.4 Anonymity and pseudonymity

Where lawful and practicable, you may interact with us anonymously or under a pseudonym. However, most uses of the Services require an identifiable account.

10.5 Complaints

If you believe we have breached the Australian Privacy Principles or this policy, please contact our Privacy Officer at privacy@snapjobreports.com. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or by phone on 1300 363 992.

11Cookies and similar technologies

The Services use cookies, local storage, device storage and similar technologies. Our marketing Website does not currently use analytics or advertising cookies. Categories we use in the administrator portal and field apps:

• Strictly necessary — required for the Services to function (e.g. authentication, session management, CSRF protection, and offline storage of photos and notes waiting to upload);
• Functional — remember your preferences and improve usability (e.g. language, theme);
• Analytics and session replay — help us understand how the Services are used (PostHog, using an internal account identifier rather than your name or email);
• Error monitoring — capture diagnostic information when errors or app crashes occur (PostHog).

You may refuse cookies through your browser settings; however, parts of the Services may not function properly without them. We do not knowingly use cookies for cross-site advertising.

12Photographs, voice notes and on-site individuals

The Services are designed to capture photographs of equipment, buildings, defects and job-site conditions. On-site individuals (occupants, building staff, members of the public) may sometimes be visible in those photographs. Voice notes may also pick up other people speaking, or mention a person by name. We remove EXIF metadata, including geolocation coordinates and camera details, from the optimised copies of photographs used in the app and in reports (see clause 2.4 for original files). Where photographs or voice notes identify or are reasonably capable of identifying a person, they may be personal information. When included in a report PDF, photographs are delivered by email through our United States email provider, and voice notes are processed by our United States AI providers (clause 5.1, clause 6).

If you are a customer of Snap Job Reports, you are responsible for: (i) ensuring you have a lawful basis (including, where required, the consent of identifiable individuals) to capture, store and share such photographs and voice notes; (ii) any required notices to visible or recorded individuals, including telling your technicians that voice notes are sent to AI providers; and (iii) the consequences of sharing generated reports with third parties (such as your own clients), including any individuals identifiable in those reports.

If you believe a photograph, voice note or report held by us identifies you and you have not consented, please contact us and we will work with the relevant customer to resolve your concern.

13Individuals outside Australia

The Services are currently offered only to businesses in Australia, and the database and file storage that hold Customer Data are in Sydney. We do not presently target or market the Services to individuals in other countries. If we expand into another region (for example, New Zealand or the United Kingdom), we will update this policy to describe the local privacy protections that apply and notify customers before the change takes effect.

14Automated decision-making and profiling

The Services do not use computer programs to make decisions about individuals that could reasonably be expected to significantly affect their rights or interests. In particular:

• Voice features (clause 4A) use AI to turn speech into text and to suggest values for form fields, such as a condition rating or a defect description. These are suggestions about the equipment or site being inspected, not decisions about a person. A technician reviews every suggestion, and a person in the customer’s business approves the report before it is issued.
• Plan limits: the Services count reports against a plan’s monthly allowance and hold report approval when the allowance is used up, until an administrator buys a top-up pack or changes plan. This applies the plan the business has chosen. It does not assess any individual.
• Other automatic processing, such as photo optimisation, queue ordering and template suggestions, assists the customer’s personnel and remains subject to human review.

If we introduce a feature that uses personal information to make, or substantially and directly help make, a decision that could significantly affect an individual’s rights or interests, we will update this policy before that feature goes live to describe the kinds of personal information used and the kinds of decisions made, as the Privacy Act requires from 10 December 2026.

15Changes to this policy

We may amend this policy from time to time. The current version is always available at snapjobreports.com/privacy, and the version number and “Effective” date at the top are updated whenever we make changes.

If a change materially reduces your rights or materially increases your obligations, we will give reasonable advance notice (at least 30 days) to all affected account-holders (including those on a free plan or free trial) by email or in-product notice before the change takes effect, and we will describe what is changing. Before such a change takes effect, you may close your account and export your data without penalty if you do not agree to it; if you continue to use the Services after a material change takes effect, that constitutes acceptance of it. We will not treat your mere continued use as acceptance of a rights-reducing change unless we have first given you that notice and that opportunity to leave. Minor or non-material updates (for example, clarifications, contact-detail or typographical corrections) take effect when posted.

16How to contact us

For privacy enquiries, requests for access or correction, complaints, or data-breach-related notices:

Privacy Officer, Snap Job Reports
TrueAgent Pty Ltd (ACN 636 626 956, ABN 70 636 626 956)
Level 1, 255 Whitehorse Road, Balwyn VIC 3103, Australia
Email: privacy@snapjobreports.com