Privacy policy

Information used by the service

Account information includes your name, email address and authentication records. Business information can include company name, ABN, contact details, logo and default safety settings. Documents can include project addresses, tasks, hazards, controls, equipment, worker or signatory names and other details you choose to enter. Payment records include subscription status and payment-provider identifiers. Technical records may include requests, errors, device information and activity needed to operate and protect the service.

Only enter personal information you are authorised to share. Avoid unnecessary sensitive information in safety documents or ChatGPT messages.

How information is used

Information is used to authenticate accounts, save and retrieve documents, provide business defaults, generate requested draft content, manage subscriptions, respond to support requests and diagnose or prevent service failures and misuse. Email is used for account verification, authentication and service communications.

ChatGPT and AI features

Connecting the app authorises ChatGPT to use tools that read your documents and business profile and save draft documents or hazard/control steps in your account. Information returned by those tools becomes available to ChatGPT and can appear in your conversation. Your use of ChatGPT is also governed by OpenAI's terms, privacy policy and the data controls applicable to your account.

The app's own AI-generation feature sends the work description and relevant document inputs to the Lovable AI service and its model providers to generate drafts. Using this feature is separate from connecting ChatGPT. AI drafts must be reviewed before use.

The ChatGPT connection stores hashed authorisation codes and access/refresh tokens linked to your account. It does not store your password or the Supabase session token used to identify you during connection. Disconnecting in ChatGPT removes the connection from your ChatGPT account. To request revocation of all app-side grants, contact support; changing your app password does not by itself revoke these separate grants.

Payments

Card entry and payment processing take place through Stripe checkout in the SWMS app. The ChatGPT tools do not collect card numbers, security codes or payment passwords. The app uses subscription records and Stripe customer/subscription identifiers to determine PDF-download eligibility and provide billing management. Do not put card details into a ChatGPT message or a safety document.

Analytics and advertising measurement

The website uses Google Analytics and Google Ads tags (Google LLC) to measure site visits and count when an account is created or a subscription is purchased after visiting from an ad, including the purchase amount and an order reference. These tags use cookies and device information; we do not send your name or email address to Google for this. The tags are not loaded for visitors in the European Economic Area, the United Kingdom or Switzerland, or when your location can't be determined. You can opt out using your browser's cookie controls, Google's Ad Settings or the Google Analytics opt-out add-on.

Service providers and overseas processing

The service uses Lovable Cloud and Supabase for hosting, authentication and database functions, Stripe for payments, and AI providers for the features described above. Information needed for those services may be processed by their infrastructure and subprocessors, including outside Australia. Processing by a connected third-party service is also subject to that provider's privacy terms. We do not promise that all processing takes place in Australia.

Storage, security and retention

Account and document records are stored to provide the service. Authentication and access checks restrict document tools to the connected account. The service uses HTTPS for its published connection and hashes its separate OAuth tokens. No system can guarantee absolute security.

Account, document, support and billing records may be retained while needed to provide the service, meet legal obligations or resolve disputes. Deletion requests may be subject to verification and lawful retention requirements; backup copies and payment-provider records may remain under the relevant retention processes. Browser storage may be used for authentication sessions and interface preferences.

Access, correction, deletion and complaints

You can review and edit account/business details and documents using the available app controls. Contact support to request access, correction, deletion or revocation, or to make a privacy complaint. We may ask you to verify your identity before disclosing or changing account records. If your complaint concerns Australian privacy rights, you can also contact the Office of the Australian Information Commissioner at oaic.gov.au.