Privacy Policy

Last updated: [date of publication]

This policy explains how Dwayne Charrington trading as Rangefront Labs (ABN [ABN], [business address]) ("Rangefront", "we", "us") handles personal information in Rangefront Waste. We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Two roles

Rangefront Waste is used by businesses ("operators"), such as septic pumpers and inspectors. We handle personal information in two ways:

• Our own users. For people who have an account with us, such as an operator's staff, we decide how the information is used. This policy covers that fully.
• Operators' customers. Operators enter information about their own customers, such as householders and property owners. The operator decides why and how it is used. We hold and process it on the operator's behalf, under our Customer Data Addendum. If you are an operator's customer, the operator is the main point of contact for your information. Contact them first about access, correction or deletion. We will help them respond, and will pass on requests sent to us.

What we collect

Account users (operators' staff and technicians): name, email address, phone number, role and permissions, password (stored hashed), sign-in and session records, the devices enrolled to your account, and actions recorded in the audit log.

Operators' customers and contacts (entered by the operator, the customer through a booking form or portal, or a technician):

• name, phone number and email address;
• billing and service addresses;
• property details and wastewater system details, such as tank type, size, location and service history;
• site photos and documents;
• job, quote and invoice records, payment status and messages with the operator;
• inspection results, defects and compliance reports, which may be sent to local councils;
• for phone calls to an operator using the phone assistant: the caller's number, a recording or transcript of the call, and a summary.

Customer payment card details are handled by Stripe and are not stored by us.

Technician location. If the operator turns it on, the field app records a technician's location while they work (for example when they arrive at or leave a job). The operator decides the use, such as dispatch, tracking links for customers, and records of attendance. We keep location events for 90 days by default.

Device and diagnostic data. The field app and console collect device model, app version, operating system, connection and sync status, and error information. We use this to fix faults and to keep the Service secure.

Cookies and local storage. The console and field app store a sign-in token, interface preferences and offline data in your browser or on your device's storage. We do not use advertising cookies. If we add analytics, we will say so here.

Website visitors. Booking forms may use Cloudflare Turnstile to detect bots. It processes your IP address and browser signals.

How we collect it

We collect information directly from you, from the operator you deal with, from your devices when you use the app, and from integrations the operator connects, such as accounting software.

Why we use it

• to provide, secure, support and improve the Service;
• to send service messages, such as sign-in codes, booking and job notifications on an operator's behalf, and notices about your account;
• to bill operators;
• to detect and prevent fraud and abuse;
• to meet our legal obligations; and
• to respond to enquiries and complaints.

We do not sell personal information. We do not use customers' personal information for advertising, and we do not use it to train AI models.

Sensitive information

We do not seek sensitive information (such as health or biometric templates). Biometric unlock on a phone is handled by the phone's operating system, and we do not receive the biometric data. If an operator enters sensitive information in a free-text field, the operator is responsible for having the right to do so.

Marketing

We contact operators with product information if they have consented or the law allows it. You can unsubscribe at any time. We do not market to operators' customers.

AI features and automated processing

The Service has optional AI features: tidying job notes, drafting messages, quotes and report summaries, and a phone assistant that answers calls for an operator. They use Anthropic's Claude. Each request sends only the text needed for that feature, for the operator making it, to Anthropic in the United States. Our records of AI requests keep time, user, feature and usage counts, and not the text, other than call transcripts, which are part of the call record.

AI output is a draft that a person reviews before it is used, with one exception: the phone assistant talks to callers and records booking requests and messages, which office staff confirm. It does not decide anything that significantly affects a person's legal rights or interests. It tells callers it is an automated assistant and that the call may be recorded and transcribed. From 10 December 2026, Australian law requires entities to describe in their privacy policies the kinds of personal information used in substantially automated decisions that significantly affect individuals. We do not make decisions of that kind. If that changes, we will update this policy first.

Operators can turn AI off for their business.

Disclosure

We disclose personal information to:

• the operator whose customer or user you are;
• our service providers listed on the Subprocessors page;
• recipients the operator directs, such as councils receiving compliance reports, accounting software, or payment providers;
• professional advisers, insurers and auditors, under confidentiality;
• a purchaser, if the business is sold, with notice where required; and
• law enforcement and regulators when the law requires or allows it.

Overseas recipients

Some providers handle information outside Australia. Based on the Subprocessors page:

• United States: Anthropic (AI), Twilio (SMS and voice), Resend (email), Mapbox and Google (maps and routing), Expo (push notifications), Stripe, and Cloudflare.
• Germany: OpenRouteService, if an operator selects it.
• Hosting: Railway and our object storage provider. [region to be confirmed]

Before disclosing personal information overseas we take reasonable steps to make sure the recipient handles it consistently with the APPs, usually through the provider's contract terms. By using the Service, operators accept that their information will be disclosed to these recipients. Operators have to take their own steps for their customers under APP 8 and APP 5, and we help with that through this policy and the addendum.

Security

Measures include isolation of each operator's data, encryption in transit, hashed passwords, permission checks on every request, revocable device enrolment, scanning of uploads, and an audit log. Details are in the Customer Data Addendum. No system is perfectly secure.

Retention

• Operators' data is kept while their account is active, then handled under the Terms: export for 30 days after termination, then deletion.
• After a free trial, data is read-only for the retention period (60 days), then deleted unless the operator subscribes.
• Technician location events: 90 days by default. Field app sync records: 180 days by default.
• Backups are overwritten within the backup cycle.
• Some records, such as invoices and tax records, are kept for the period the law requires.

When we no longer need personal information, we delete or de-identify it.

Access and correction

You may ask for access to, or correction of, personal information we hold about you. If you are an operator's customer, we will refer you to the operator, or help them respond. Email [legal contact email]. We will respond within 30 days. We may refuse access where the Privacy Act allows, and will explain why.

Data breaches

If a data breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires. When we hold information for an operator, we tell the operator without undue delay so that it can meet its obligations, as set out in the addendum.

Complaints

Contact us first at [legal contact email]. We will acknowledge within 7 days and aim to resolve it within 30 days. If you are not satisfied, you may complain to the OAIC at oaic.gov.au or on 1300 363 992.

Changes

We may update this policy. The date at the top shows the latest version. For material changes we will notify operators.