Draft prepared: 31 October 2026 · Effective date: To be confirmed on publication
1. About this policy
SubbieFlow is operated by Brandon Kermeci trading as SubbieFlow (ABN 65 256 377 693), based in Victoria, Australia. This Privacy Policy explains how we handle personal information collected through subbieflow.com.au and the SubbieFlow software platform.
We aim to handle personal information consistently with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and Australian Privacy Principles where they apply to us. Some obligations may apply independently of whether an organisation is covered by the Privacy Act.
2. Information we collect
Depending on how you use SubbieFlow, we may collect names, business names, ABNs, email addresses, phone numbers, company roles, account credentials and authentication identifiers, support enquiries and communications.
Our platform may contain project and package information, work records, progress claims, variations, supporting documents, invoices, compliance records, payment status and transaction-related records. Subcontractors may provide BSB and bank account numbers for payment administration.
We may also collect technical information such as IP addresses, browser and device information, security events, access logs and essential session or authentication information. Subscription payment processing is handled by Stripe; we do not intend to store complete payment card numbers or card security codes on our own servers.
3. How information is collected
We receive information directly from visitors, company representatives, staff users and subcontractors; from company administrators who invite or manage users; through the documents and records uploaded to the platform; and from service providers that support authentication, billing, hosting and communications.
Trade companies and subcontractors are responsible for ensuring that information they enter or share through the platform is accurate and that they have authority to provide it.
4. Why we use information
We use information to review access requests, create and administer accounts, provide the platform, manage project and claim workflows, facilitate recordkeeping and payment administration, process subscriptions, send service notifications, respond to enquiries, investigate misuse, maintain security and meet legal obligations.
We may use contact information to communicate important changes to the service, policies or account arrangements. Promotional communications, if introduced, will be handled in accordance with applicable Australian marketing and spam laws, including unsubscribe requirements where applicable.
5. Company access and subcontractor banking details
Information entered into a company's workspace is made available to authorised users of that company and relevant invited subcontractors according to their roles and the platform's implemented access controls. Company administrators determine who is invited and which work is assigned.
Subcontractor BSB and bank account details are intended to be accessible only to authorised Admin and Finance users of the relevant company for payment administration and confirmation. Project Managers and other users should not have permission to view or confirm those details. We will verify these controls before launch.
SubbieFlow provides software for recording and managing payment information. It does not itself transfer subcontractor payments or independently verify the ownership of a bank account.
6. Service providers and disclosures
We use third-party services to operate SubbieFlow, including Supabase for database and authentication infrastructure, Stripe for subscription payments, and hosting and email services. We may share information with these providers to the extent reasonably needed to deliver their services.
We may also disclose information with your direction, to professional advisers under appropriate confidentiality arrangements, or where required or authorised by law. We do not describe customer project data as being sold to advertisers.
7. Storage and overseas processing
Our Supabase project's primary database region is Oceania (Sydney), Australia. This does not mean that every copy of information or every related processing activity remains in Australia.
Some infrastructure, support, payment, email, logging or other service providers may process or access information outside Australia. We will assess applicable cross-border privacy obligations and the locations and safeguards of relevant providers before launch, and update this policy as needed.
8. Security
We seek to protect information using access restrictions, authentication, role-based permissions, logging and other reasonable technical and organisational safeguards appropriate to the information involved. No online service can guarantee absolute security.
We will verify the production configuration, access permissions, banking-data controls, backup arrangements and incident-response procedures before launch. Users should protect their login credentials and notify us promptly of suspected unauthorised access.
9. Retention and account closure
Ending a paid subscription does not automatically delete a company's historical records. Subject to the platform's available features and lawful restrictions, an inactive company may retain read-only access to historical projects, claims, invoices and payment records.
We retain information for as long as reasonably needed for the purposes described in this policy, legitimate operational requirements, disputes, security and applicable legal recordkeeping obligations. When information is no longer needed and retention is not required or justified, we will take reasonable steps to delete or de-identify it. Backup deletion may take additional time.
Account closure and deletion requests can be sent to admin@subbieflow.com.au. We may need to verify the requester's identity and authority and explain any records that cannot yet be removed.
10. Access, correction and complaints
You can contact us to request access to, or correction of, personal information we hold about you. We may need to verify your identity, and legal exceptions may apply. If a trade company controls information within its workspace, we may direct you to that company or coordinate with it as appropriate.
To raise a privacy complaint, email admin@subbieflow.com.au with details of your concern. We will review the complaint and respond within a reasonable period. Where applicable, you may also have the right to complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
12. Updates and contact
We may update this policy as our services, providers or legal obligations change. We will publish the updated version with a revised effective date and provide additional notice where appropriate.
Privacy contact: admin@subbieflow.com.au. General support: support@subbieflow.com.au. Business operator: Brandon Kermeci trading as SubbieFlow, ABN 65 256 377 693, Victoria, Australia.