Vertex home

Vertex Service Manager: Privacy Policy

Version: [PLACEHOLDER: version number]. Last updated: [PLACEHOLDER: date].

This policy explains how AEGIS Systems (ABN 57 128 523 477), a sole trader business owned by John Gavin, New South Wales, Australia ("we", "us", "our") handles personal information in connection with Vertex Service Manager (the "Service") and our websites vertexservicemanager.com.au and vertexsm.com.au (the "Sites").

We follow the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who this policy covers

The Service is used by businesses (our "Customers"), such as HVAC, refrigeration and building services companies. This policy covers:

  • Customer contacts and account holders, such as business owners and Admins;
  • Users, such as staff, office staff and technicians who log in to the Service;
  • End Customers, meaning the customers of our Customers, whose details are stored in the Service;
  • visitors to our Sites and people who contact us.

2. Our role with End Customer data

Our Customers decide what End Customer information to put in the Service and how to use it. For that information, the Customer is in control (the "controller") and we handle it on their behalf (as a "processor" or service provider).

If you are an End Customer and have a question about your information, please contact the business you dealt with first. We will help that business respond. If you contact us directly, we may pass your request on to that business.

We do not use End Customer information for our own purposes, except as needed to run, secure and support the Service, or as the law requires.

3. What we collect

About Customers and Users:

  • name, business name, ABN, role, email, phone and business address;
  • login details and account settings;
  • billing details (once billing is live, card details are handled by Stripe and we do not store full card numbers);
  • how Users use the Service, such as log-in times, actions taken and device and browser details;
  • technician location or status, where a feature uses it [PLACEHOLDER: confirm whether GPS location is collected];
  • messages and feedback you send us.

About End Customers (entered by our Customers):

  • name, address, phone number and email;
  • job details, such as site address, equipment, notes, photos and appointment times;
  • quotes, invoices and payment status;
  • records of emails and texts sent to them through the Service.

About website visitors:

  • IP address, browser type, pages visited and cookie data (see section 10).

We do not intend to collect sensitive information (such as health information). Customers should not enter it into the Service unless it is needed and they have consent. [PLACEHOLDER: confirm, for example notes about access needs at a site.]

4. How we collect it

  • directly from you, when you sign up, use the Service or contact us;
  • from our Customers, who enter End Customer and User details;
  • from integrations a Customer connects, such as Xero;
  • automatically, through cookies, logs and error monitoring tools.

If you do not give us certain information, we may not be able to provide the Service.

5. Why we use it

  • to provide the Service, including jobs, quotes, invoices and dispatch;
  • to send emails and texts that Customers ask the Service to send;
  • to provide AI features, where the Customer has the AI Plus add-on;
  • to sync data with integrations the Customer has connected;
  • to manage accounts, billing and usage limits (such as AI and SMS allowances);
  • to provide support and answer questions;
  • to keep the Service secure, find and fix errors, and prevent misuse;
  • to improve the Service, using de-identified or aggregated data where we can;
  • to send Customers service notices, and product updates (Customers can opt out of updates that are not essential);
  • to meet our legal duties.

We do not sell personal information.

6. Who we share it with

We share personal information with service providers who help us run the Service, only as needed for that purpose:

  • Base44: app hosting and database;
  • Xero: accounting sync, when a Customer connects it (MYOB is planned);
  • Resend: sending emails, including quotes and invoices with PDF attachments and secure links;
  • Twilio: sending texts, when a Customer turns on the SMS add-on;
  • Stripe: payment processing (coming);
  • AI model providers, such as Anthropic and OpenAI: processing content for AI features;
  • Cloudflare: DNS and related network services;
  • Sentry: error monitoring (coming). Error reports may include limited personal information.

We may also share information:

  • with our professional advisers, such as lawyers and accountants;
  • if the law requires it, or to protect someone's safety;
  • with a buyer or successor if the business is sold or restructured.

Our partner, Josh, a licensed HVAC technician, may have access to information as needed to help run, test and support the Service. [PLACEHOLDER: confirm his role and access.]

7. Overseas disclosure (APP 8)

Some of our service providers store or process personal information outside Australia. This may include:

  • Base44: [PLACEHOLDER: countries, for example United States];
  • Resend: [PLACEHOLDER: countries];
  • Twilio: [PLACEHOLDER: countries];
  • Stripe: [PLACEHOLDER: countries];
  • Anthropic, OpenAI and other AI model providers: [PLACEHOLDER: countries];
  • Cloudflare: global network [PLACEHOLDER: confirm];
  • Sentry: [PLACEHOLDER: countries];
  • Xero: [PLACEHOLDER: countries].

We take reasonable steps to make sure these providers handle personal information in a way consistent with the APPs, for example by choosing providers with strong privacy and security terms. [PLACEHOLDER: confirm contract terms with each provider.]

8. Security

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include:

  • encryption of data in transit (HTTPS) [PLACEHOLDER: confirm encryption at rest];
  • access controls, so each Customer can only see its own data and only Admins can authorise Users;
  • limiting our own staff access to what is needed;
  • secure links for quotes and invoices [PLACEHOLDER: confirm link expiry];
  • monitoring for errors and suspicious activity;
  • [PLACEHOLDER: backups, multi-factor authentication, security testing].

No system is completely secure, and we cannot guarantee security.

9. How long we keep it

We keep personal information only for as long as needed for the purposes above or as the law requires.

When a Customer closes its account, it has [PLACEHOLDER: 30] days to export its data. We then delete or de-identify it within [PLACEHOLDER: number] days, except where the law requires us to keep it. Backups are deleted on a rolling basis within [PLACEHOLDER: number] days.

10. Cookies and similar tools

Our Sites and the Service use cookies and similar tools to:

  • keep you logged in and remember your settings (essential cookies);
  • keep the Service secure;
  • understand how the Sites are used [PLACEHOLDER: name any analytics tool, or delete if none].

You can block or delete cookies in your browser settings. If you block essential cookies, the Service may not work.

We do not use cookies for advertising. [PLACEHOLDER: confirm.]

11. Access and correction

You can ask to access or correct personal information we hold about you. Contact us at [PLACEHOLDER: contact email].

We will respond within 30 days. We will not charge you to make a request. We may need to confirm your identity first.

If we refuse, we will tell you why in writing, unless that would be unreasonable, and explain how to complain.

If you are an End Customer, please contact the business you dealt with first (see section 2).

Users can update most of their own details in the Service. Admins can update Company and End Customer details.

12. Marketing

We may send Customers emails about the Service. You can unsubscribe at any time using the link in the email.

We do not send marketing to End Customers. Texts and emails that Customers send through the Service are sent on the Customer's behalf, and the Customer is responsible for meeting the Spam Act 2003 (Cth).

13. Data breaches

If we suspect a data breach, we will act quickly to contain it and assess it.

If a breach is likely to result in serious harm, we will notify affected people and the Office of the Australian Information Commissioner (OAIC), as required under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

If a breach affects End Customer data, we will tell the affected Customer without undue delay so they can meet their own obligations, and we will work with them on any notifications.

14. Complaints

If you have a concern about how we handle personal information, please contact us first at [PLACEHOLDER: contact email]. We will acknowledge your complaint within [PLACEHOLDER: 5] business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

15. Children

The Service is for businesses and is not directed at children. We do not knowingly collect information from children, except where a Customer enters details of an End Customer who is a minor. [PLACEHOLDER: confirm.]

16. Beta

The Service is in beta. While in beta, our providers, features and practices may change. We will update this policy when they do.

17. Changes to this policy

We may update this policy from time to time. We will post the new version on our Sites with a new "last updated" date. If changes are significant, we will tell Customers by email or in the Service.

18. Contact us

AEGIS Systems (ABN 57 128 523 477), a sole trader business owned by John Gavin, New South Wales, Australia.

Email: [PLACEHOLDER: contact email]. Postal address: [PLACEHOLDER: postal address].

Websites: vertexservicemanager.com.au and vertexsm.com.au.