Privacy Policy

Tradeforge Pty Ltd (trading as Karven) ("Karven", "we", "us", "our") is an Australian company that builds a quoting platform for licensed tradies. We respect the privacy of every person whose personal information we hold, whether you're a tradie who has signed up, a customer whose details a tradie has uploaded into Karven to send a quote, or a visitor to our marketing pages.

This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, where it is stored, how long we keep it, and the rights you have under the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs). It also covers the General Data Protection Regulation (GDPR) where applicable, for example if a tradie's customer is located in the European Union.

If you have any questions about this policy or about how Karven handles your personal information, please contact our Privacy Officer at privacy@karven.com.au. Our registered business address is The Avenue, Granville NSW 2142.

We try to collect the minimum information needed to deliver the service. The categories below describe everything we may hold about a given person. Most accounts only generate a subset.

• Account information: your name, email address, password (stored as a salted hash, never in plain text), business name, ABN, postcode, business phone, business hours, and any logo you upload.
• Quote and customer data: the names, addresses, phone numbers, email addresses, site notes, photos and dimensions you key into Karven when preparing a quote for one of your customers. We treat this as your data: you are the controller, we are the processor.
• Subcontractor data: where you use the subbies module, the personal information and compliance documents (public liability certificate of currency, licence, white card) you upload for each subcontractor.
• Billing information: a Stripe customer ID, your subscription plan, the status of your subscription, invoice metadata and the email address you use for billing. We never see or store full card numbers; Stripe holds those under its own PCI-DSS Level 1 compliance.
• Usage and device information: pages visited on karven.com.au, IP address, browser type, operating system, viewport size, referrer URL, and timestamps for each action you take while signed in.
• How you found us: if you arrived on a tagged link (for example from one of our Instagram or TikTok posts), the link's campaign tags, the website that sent you (the site name only, never the full address) and the first page you landed on. We keep this in a cookie only if you allow analytics cookies, and we also read the tags on the signup page link itself when you sign up. If you answer the optional "How did you hear about Karven?" question during setup, we keep that answer too. It is stored on your account, is only seen by the Karven team, and is used to count which posts and channels bring tradies to Karven.
• Feedback and testimonials: if you answer "How's Karven going?" in the app, your rating, your words, any photo you add (with its location data removed) and the sharing boxes you ticked, with the date and the exact wording you agreed to. We store every answer the same way whatever the rating. We only quote you on our website or social media if you ticked that box and we have approved it, and only with the details you ticked (first name, trade and town; business name; photo). Email us any time to take it down.
• Communications: any email, SMS or in-app message you send us, plus our reply. We retain support correspondence for at least 24 months so the next person who picks up your ticket has the full thread.
• Cookies and similar technologies: see Section 9 and the separate Cookie Policy for the full list of what we set and why.

We do not knowingly collect sensitive information as the Privacy Act defines it (health, racial or ethnic origin, religious beliefs, sexual orientation and the like). Please do not put that kind of information into quotes, customer notes, photos or support emails.

Karven is a B2B product for licensed Australian tradies. We do not knowingly collect personal information from anyone under 16. If you believe a child has signed up, email the Privacy Officer and we will delete the account.

Most personal information is collected directly from you: when you sign up, complete onboarding, build a quote, upload a logo, upload a subcontractor certificate, configure billing, or contact support.

Sometimes we collect information from a public source instead of from you directly. For example, when you or a subcontractor enter an ABN, we look it up on the Australian Business Register to show the registered name and GST status.

We may also collect anonymous usage data automatically (page views, button clicks, feature use) for the purpose of improving the product. Where that data can be tied back to an identifiable person it is treated as personal information under this policy.

We only collect personal information that is reasonably necessary for what we do. That is:

• Delivering the Karven service: building and pricing quotes, generating PDFs, sending quote emails and texts, the optional AI features (see Section 5), processing payments, and customer support. Legal basis: performance of our contract with you (your subscription).
• Communicating with you about the service: onboarding, important product updates, subbie compliance reminders, billing notices, security alerts. Legal basis: contractual necessity. You cannot opt out of transactional emails while your account is active.
• Marketing communications: newsletters and product announcements. Legal basis: your express or inferred consent. Every marketing email contains a one-click unsubscribe link, and we honour that link within 24 hours as required by the Spam Act 2003 (Cth).
• Improving the product: diagnostic analytics, A/B testing, and aggregated usage analysis. Legal basis: our legitimate interest in operating a competitive product; aggregated data only and never used to profile individuals.
• Complying with the law: responding to a lawful request from an Australian regulator, court order, or law enforcement agency where we are legally compelled to disclose.

If we ever want to use your personal information for a purpose materially different from the ones above, we will seek your express consent first.

We do not sell, rent or trade your personal information. We share it only with the service providers we use to run Karven, and only what each one needs to do its job. Each provider is bound by its own terms and data-protection commitments. This is the full list of providers that can receive personal information, what each one does, and where it stores or processes data:

• Supabase, Inc. (our database, sign-in and file storage). Your account, quotes, customers, photos and uploaded files are stored in Supabase's Sydney region (Australia).
• Vercel, Inc. (hosts the Karven website and app). Our servers run in Vercel's Sydney region. Pages are delivered through Vercel's worldwide network, which sees request details such as IP address and the page requested. Vercel is a United States company.
• Stripe (Stripe Payments Australia Pty Ltd and Stripe, Inc.). Takes payment for your Karven plan, and processes card payments your customers make to you through your own Stripe account. Stripe holds card details; we never see full card numbers. Stripe stores and processes data in Australia, the United States and other countries.
• Resend, Inc. (email). Sends quote emails, receipts, reminders and password resets, and receives replies sent to Karven addresses. Sees the recipient's address and the email content. United States.
• Twilio Inc. (text messages and phone calls). Sends texts to your customers and to you when you choose text, and handles calls if you turn on call forwarding or missed-call text-back. Sees phone numbers and message content. United States, with infrastructure in other countries.
• Anthropic, PBC (AI). Powers the AI features, such as drafting a quote from a job description, enquiry or photo, suggesting replies, summarising messages, and reading price lists and receipts. When you use one of these features, the text, photos or documents you give it (which can include a customer's name, address or message) are sent to Anthropic to produce the result. Processed in the United States. Under Anthropic's commercial terms this data is not used to train its models.
• OpenAI, L.L.C. (AI). Turns voice memos you record into text. The audio is sent to OpenAI for transcription. Processed in the United States. Under OpenAI's API terms this data is not used to train its models by default.
• Mapbox, Inc. (maps). Shows job locations on your schedule map and plans driving routes. Job addresses are sent to Mapbox to place them on the map. United States.
• Google LLC (sign-in and calendar). Only if you choose to sign in with Google or connect Google Calendar. Sees your Google account details and, for calendar, the bookings Karven adds. United States and other countries.
• Xero Limited and ServiceM8 (accounting and job management). Only if you connect them and push a quote or invoice across; we send the details of that quote or invoice. Each stores data under its own privacy policy, in the locations it sets out there.
• Our professional advisers (lawyers, accountants, auditors) under confidentiality where it is necessary for them to advise us, and our debt collection partners if your account becomes severely overdue.

If Karven is ever acquired or merges with another business, the acquirer will be bound by this Privacy Policy in respect of all personal information collected before the change of control. We will notify you of the change before any new uses begin.

Our main database and file storage are in Sydney. But some personal information does leave Australia, because several of the providers in Section 5 are overseas, mostly in the United States. In particular:

• Emails and texts you send through Karven pass through Resend and Twilio in the United States.
• Card payments are processed by Stripe, which stores data in Australia, the United States and elsewhere.
• Anything you give an AI feature (text, photos, documents, voice memos) is processed by Anthropic or OpenAI in the United States.
• Job addresses shown on your schedule map are sent to Mapbox in the United States.
• Requests to the website pass through Vercel's worldwide network.
• If you connect Google, Xero or ServiceM8, the data you send to them is held where they hold it.

Before we use an overseas provider we take reasonable steps to make sure it handles personal information in a way that is consistent with the Australian Privacy Principles, and we choose providers with published security and data-protection commitments. By using Karven you acknowledge that personal information may be processed in the countries listed above.

We hold personal information only for as long as we need it for the purpose it was collected or for as long as the law requires us to keep it.

• Live account data: kept for the life of your subscription plus 30 days after closure. The 30-day window gives you time to change your mind and lets us complete any pending billing or refund actions.
• Quote and customer data: kept while your account is active. Soft-deleted when you delete the account, hard-deleted 30 days later.
• Billing records (invoices, tax records): kept for seven years to satisfy obligations under the Income Tax Assessment Act 1997 (Cth) and the A New Tax System (Goods and Services Tax) Act 1999 (Cth).
• Email delivery logs: retained by Resend for 30 days for deliverability diagnostics, then purged.
• Backups: encrypted daily snapshots retained for 30 days then automatically destroyed.
• Privacy and security incident records: kept for at least seven years from the date of the incident to comply with our Notifiable Data Breaches obligations.

After the relevant retention period the personal information is either destroyed or de-identified so it can no longer be associated with you.

You have the following rights in respect of the personal information we hold about you. Most of them are available self-service inside the Karven app; the rest are one email to the Privacy Officer.

• See your information: you can ask for a copy of the personal information we hold about you. Request it from Settings in the app (Connections, then Data export), or email the Privacy Officer.
• Correct your information: ask us to correct any personal information that is inaccurate, out-of-date, incomplete, irrelevant or misleading. Most fields you can edit yourself inside Karven; for everything else, email the Privacy Officer.
• Delete your account: you can close your account yourself from Settings (Account and password, then Delete account), or by emailing the Privacy Officer. Your business name, ABN, phone and logo are removed straight away and you are signed out; the rest of your data is permanently deleted after 30 days. Some records (billing and security incident records) are kept for the legal periods in Section 7. Download a copy of your data first: the ATO expects you to keep business records for five years.
• Right to withdraw consent: at any time, for any purpose for which we relied on your consent. Withdrawing consent does not affect the lawfulness of any processing we did before you withdrew it.
• Right to make a complaint: see Section 11.
• Anonymity: where lawful and practical you may interact with us anonymously, for example when contacting our public support inbox. You cannot operate a paid account anonymously because we are legally required to identify the contracting party.

We will respond to any access or correction request within 30 days of receipt. Where a request is unusually complex we may extend that period by up to 30 days and will let you know in writing.

We use a small number of strictly-necessary cookies (session, CSRF, plan) plus optional analytics cookies that only run with your consent. The full list is in our Cookie Policy.

On first visit a banner offers three choices: accept all, reject non-essential, or manage preferences. Your decision is stored in localStorage and in the cookie_consents table so we have a verifiable record of consent. You can change your decision any time from the footer link or by clearing your browser storage.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Tenant isolation is enforced at the database layer via Postgres row-level security, not at the application layer. A bug in our code cannot leak data across tenants.
• Access to production data by Karven staff requires SSO, hardware-key 2FA, and a logged just-in-time elevation. There is no shared admin password.
• All code changes go through pull-request review and automated security checks (npm audit, secrets scanning, dependency review) before they reach production.
• We follow a documented incident-response plan and rehearse it at least annually.

Despite our best efforts no method of transmission over the internet or method of electronic storage is 100% secure. If we become aware of an eligible data breach we will notify affected individuals and the OAIC under the Notifiable Data Breaches (NDB) scheme. See Section 12.

Step one: email the Privacy Officer at privacy@karven.com.au with a description of what happened, when, and what outcome you'd like. Or use the form at /privacy-contact. We will acknowledge within five business days and respond substantively within 30 days.

Step two: if you are unhappy with our response, you can lodge a complaint with the Office of the Australian Information Commissioner at https://www.oaic.gov.au or on 1300 363 992. The OAIC may investigate the complaint and make a determination that is binding on us.

Step three (EU/UK residents only): you may also lodge a complaint with your local data-protection authority. The OAIC will refer EU complaints to the appropriate authority where applicable.

Karven complies with the Notifiable Data Breaches scheme set out in Part IIIC of the Privacy Act 1988 (Cth). If we suffer an eligible data breach, one likely to result in serious harm to an affected individual, we will notify affected individuals and the OAIC as soon as practicable.

The notification will describe the breach, the kinds of information affected, the steps we recommend you take to protect yourself, and what we are doing in response. We will also publish a summary on our status page once any active investigation is complete.

We may update this policy from time to time. The version date at the top tells you when the current version took effect; an archive of prior versions is available on request.

If we make a material change, for example adding a new category of personal information or a new overseas recipient, we will notify you by email at least 14 days before the change takes effect. Minor edits (typo fixes, clarifications) are deployed silently and reflected in the version date.

Privacy Officer: privacy@karven.com.au

General support: info@karven.com.au

Postal: Tradeforge Pty Ltd (trading as Karven), The Avenue, Granville NSW 2142.

We endeavour to respond to all privacy-related correspondence within five business days.