Privacy Policy

1. Who we are and what this covers

Tulbelt is a website and lead-management service for Australian tradies, operated by Spectras, a sole trader based in Melbourne, Victoria ([CONFIRM WITH VAMSI: ABN]). This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

It covers tulbelt.com.au, the app at app.tulbelt.com.au, the websites we host for our customers on sites.tulbelt.com.au or their own domains, and the enquiry form our customers embed in websites they already have. Questions about privacy go to hello@tulbelt.com.au.

2. What we collect

• Account holders: your name, email address, mobile number, business name, trade and suburb, plus the words, photos, services and settings you add to your website and inbox.
• People who enquire through a customer's website or embedded form: the name, phone number, email address, suburb, message and any photos they choose to send.
• Billing: Stripe handles payments. We keep your Stripe customer and subscription identifiers, your plan and billing status. We never see or store card numbers.
• Technical: a salted hash of the IP address behind each enquiry-form submission, kept for 24 hours to limit spam; the push-notification subscription for devices where you turn alerts on; the cookies that keep you signed in; and aggregated, cookie-free page analytics from Vercel.
• Support: anything you send us by email.

3. Why we use it

• To run the service: host your website, deliver enquiries to your inbox, and send push and email alerts to you and the addresses you nominate.
• To manage your account and billing.
• To keep the service secure and free of spam and abuse.
• To support you and to tell you about changes to the service, prices or these terms.

We do not sell personal information and we do not use it for third-party advertising.

4. Who we share it with

Providers that process data for us, each under their own contracts and security commitments:

• Supabase: database and photo storage, hosted in Sydney, Australia.
• Vercel: hosting and content delivery over a global network, a United States company.
• Resend: transactional email such as lead alerts and sign-in codes, United States.
• Stripe: payments and invoicing, United States with Australian operations.
• Apple, Google and Mozilla: push-notification delivery to your device.
• Twilio: calls and text messages, United States, once the business-number add-on launches.

We also share information when the law requires it, or to protect the rights and safety of our customers and the public.

5. Enquiries made through a customer's website

When you fill in an enquiry form on a tradie's website, or a form they have embedded elsewhere, Tulbelt processes that information on behalf of that business so they can respond to you. The business decides how to use it and is responsible for its own privacy obligations; its contact details are on its website. You can also contact us and we will pass your request on, or act on it ourselves where we can.

6. Where it is stored

Our database and uploaded photos live in Sydney, Australia. Some of the providers above operate from, or route traffic through, other countries, chiefly the United States. By using Tulbelt you consent to those disclosures. We choose providers with strong security practices and contractual protections.

7. Security

Data is encrypted in transit. Row-level access control means each business can only see its own data. Staff access is limited to what is needed to run and support the service, and we hold no card numbers.

No system is perfectly secure. If we learn of a breach likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

8. How long we keep it

• Account data: while your account is open and for 30 days after it closes, then deleted or de-identified. [CONFIRM WITH VAMSI: retention periods]
• Enquiries: until the business deletes them or its account closes.
• Rate-limit hashes: 24 hours.
• Billing records: as long as tax law requires. Stripe holds the payment records.
• Backups: roll off within 30 days of the data being deleted.

9. Access, correction and complaints

Email hello@tulbelt.com.au to ask for a copy of your information, to correct it, or to have it deleted. We respond within 30 days. If you are unhappy with our answer you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Cookies

We use only essential cookies: the ones that keep you signed in and remember which business you last had open. Analytics is cookie-free and aggregated. We set no advertising or cross-site tracking cookies.

11. Changes

We will post any changes here with a new date. For significant changes we will email account holders first.