CONNECTMASTER PTY LTD · ACN 681 371 184 · ABN 46 681 371 184
Version 1.0. In effect from 25 September 2026.
This policy is written from the actual database, not from a template. Every field listed below is a field the software really stores, and every supplier named below is a supplier we really use. If you find something here that does not match what the software does, tell us at support@connectmaster.au and we will correct one or the other.
Section 5.1 is the part most people will not expect. Please read it before you post a job.
CONNECTMASTER PTY LTD (ACN 681 371 184, ABN 46 681 371 184), of Unit 1, 6 Maunder Street, Slacks Creek QLD 4127, operates ConnectMaster, a platform that introduces construction contractors to trade subcontractors. ConnectMaster is available in Australia and in Nigeria, and in both countries it is currently operated by this company.
We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we will continue to do so regardless of whether the small business exemption in section 6D of that Act applies to us.
We say it that way deliberately. The exemption turns on our turnover and on whether we are treated as trading in personal information, and those are questions our size and our business model could take us in and out of from one year to the next. A privacy standard that switches off when a company shrinks is not a standard. So we commit to the Australian Privacy Principles as a matter of contract with you, and you can hold us to them here whether or not the Act does.
We also commit to notifying you and the Office of the Australian Information Commissioner of an eligible data breach on the terms of the Notifiable Data Breaches scheme, again regardless of whether that scheme binds us. See section 9.
| What | Why we need it | |---|---| | Name | To identify you to the other party | | Email address | Sign-in, verification, notifications | | Mobile number | Verification by SMS, and notifications | | Password | Stored only as a one-way hash. We never see it and cannot recover it | | Business name | Shown to other users | | ABN, in Australia | To confirm you are a real trading business, checked against the Australian Business Register | | Business registration number, in Nigeria | To confirm you are a real trading business | | Suburb, state or region, postcode | Matching jobs to tradies by location | | Approximate coordinates | Calculating travel distance. Derived from the suburb you type in, not tracked from your device | | Profile photograph | Optional. Shown to other users | | The date and time you accepted our terms, and which version | Evidence of agreement | | Records of what you did on the platform | Jobs posted, bids placed, awards, messages, reviews | | Whether you hold a current subscription, and the dates it covers | To decide what you can use |
| What | Why | |---|---| | The trades you work in | Matching you to jobs | | Travel radius | Matching you to jobs | | Years of experience, bio, indicative rate | Shown to contractors | | Trade licence details and a photograph of the licence | Checking against a public register. See section 4 | | Insurance certificates and policy details | Checking. See section 4 | | Certifications, such as a white card or working at heights | Checking | | Photographs of past work | Optional. Shown to contractors |
Job details: scope, location, site access notes, budget, timing, and any drawings or documents you upload. Some of this is published publicly. See section 5.1.
IP address, browser or device type, and pages viewed, for security and to find faults. Every action a staff member takes on a user's account is logged with that staff member's identity and the time.
- Card numbers, security codes or bank account details. The card is entered on a page hosted by our payment provider, never on ours. We receive a confirmation that a payment succeeded and the period it covers. See section 6.1 - Any record of money owed between users. We do not know what a contractor owes a tradie and the software has no field for it - Your device location. Location comes from the suburb you type in - Anything from your contacts, photo library or calendar, beyond files you choose to upload - Government identity documents. We do not ask for a passport, a driver licence as identity, or a national identity number
Our database and file storage are hosted in Sydney, Australia (region `ap-southeast-2`).
Some suppliers necessarily process data outside Australia: email delivery, SMS delivery, payment processing, and app store infrastructure. They are listed in section 6, with the country each one processes in.
If you are in Nigeria, your personal data leaves Nigeria. The database is in Sydney, the website is served from a global network, and email, SMS and payment processing happen outside Nigeria. We ask for your consent to that transfer at sign-up, separately from your acceptance of our terms, and you can withdraw it by closing your account. We do this because the Nigeria Data Protection Act 2023 restricts transfer to a country the Nigeria Data Protection Commission has not found adequate, and we have not found such a finding covering Australia. We would rather ask than assume.
These are treated separately because they deserve it.
When a tradie uploads a photograph of a trade licence or an insurance certificate:
- It is visible to that tradie, and to ConnectMaster staff checking it. Nobody else - Contractors never see these documents. They see only the details listed in section 5, and whatever a public register returned - No document ever appears in the public listing. See section 5.1 - Access is enforced by the database, not only by the interface - We record the expiry date so that what is shown on the profile is removed automatically when the licence lapses - On account deletion the document files are deleted. See section 8
We do not ask you to upload anything showing your date of birth, and we do not need it. If a document you upload happens to show one, we do not extract it, index it, or use it.
| Information | Who sees it | |---|---| | Sixteen fields of an open or completed job | Anybody. No account needed. Indexable by search engines. See 5.1 | | Name, business name, suburb, trades, rating, reviews | Any signed-in user | | Bio, experience, portfolio photographs | Any signed-in user | | Licence and insurance *details*: type, issuer, number, cover amount, expiry, whether we sighted it, whether a register matched it | Any signed-in user | | Who posted a job | Signed-in users only. Never in the public listing | | Site access notes on a job | The contractor, and tradies matched to that job. Never in the public listing | | Documents and drawings attached to a job | The contractor, and tradies matched to that job. Never in the public listing | | Email address and mobile number | Only the other party, and only after a bid is awarded | | Your bid amount | Only you, the contractor who posted that job, and our staff. Never another tradie, and never in the public listing | | Licence and insurance *documents* | Only you and our staff | | Messages | Only the two parties, and our staff where a dispute is raised or a message is reported | | Whether you hold a subscription, and its dates | Only you and our staff. Another user cannot see whether you pay us | | An unpublished review | Only its author, until it publishes |
Contact details are deliberately withheld until a bid is awarded. It protects both sides from unsolicited approaches.
Jobs on ConnectMaster are public. A person with no account, who has never agreed to anything, can read them. So can a search engine.
Published, for every open or completed job: the job's identifier, its title, the trade, the first 240 characters of the description on a listing page and the full description on the job's own page, the suburb, the region or state, the country, the currency, whether the budget is open, the minimum and maximum budget, the preferred start date, the expected duration in days, when bidding closes, whether the job is open or completed, and when it was posted.
Never published: who posted the job, their name, business name or contact details, the site access notes, any attached document or drawing, any bid, any bid amount, and any message.
How that restriction is enforced. The published fields are listed one by one inside a database function. The function cannot read the jobs table generally; it can only return the columns it names. A private column added to the database next year cannot leak through it, because a person would have to edit the function to include it. This is deliberate. A broad permission on the table would have published every future column automatically, and it would have failed silently.
The 240-character limit on a listing page is a layout decision, not a privacy control. The full description is public on the job's own page. Write it accordingly.
Jobs that are deleted, cancelled, or whose account is suspended stop being published.
If you ask us to unpublish a job we will remove it from the public listing promptly, and we will ask search engines to remove their copies. We cannot control how quickly a search engine acts, and we cannot recall a copy somebody else has already taken. We will not promise you otherwise.
You are shown a plain-language version of this section on the posting form, before the job is submitted, and you must acknowledge it to post.
We do not sell your information. We have never sold it and we do not intend to.
We share it with suppliers who help us run the platform, and only what they need:
| Supplier | What they get | Where | |---|---|---| | Supabase | The database and uploaded files | Sydney, Australia (`ap-southeast-2`) | | Vercel | Serves the website | Global network | | Google, as our outgoing mail server | Your email address, to send sign-in and verification email | Outside Australia | | Twilio | Your mobile number, to send verification codes | Outside Australia | | Stripe | Your payment, taken on their page. They hold the card, we do not | Outside Australia | | Paystack, for Nigeria | Your payment, taken on their page. They hold the card, we do not | Nigeria | | Apple, Google | App distribution and push notifications | Outside Australia |
If we add a supplier who will receive your personal information, we will update this table before they receive any of it, and where the change materially affects you we will tell you first.
We may also disclose information where the law requires it, where it is needed to investigate suspected fraud or a serious breach of our terms, or to establish, exercise or defend a legal claim.
- The card is entered on a page hosted by Stripe, and by Paystack in Nigeria. Not on ours - We never receive, see or store a card number, a security code, or a bank account - We receive a confirmation that a payment succeeded, and the period it covers. That is the entire extent of what we hold about your payment - Our payment provider handles your card details under its own privacy policy and its own obligations, not ours. We are not able to answer a question about data we never receive, and we will tell you where to ask instead
- Account, security, dispute, billing and legal notices cannot be switched off. You need to receive them, so the software does not allow disabling them. This includes a reminder before your subscription expires, which exists so that access does not stop without warning - Everything else can be turned off individually, per channel, in Settings - We will not add you to a marketing list without asking you first, and every marketing message carries a working unsubscribe link
| Data | Kept | |---|---| | Your account and profile | While your account is open | | Licence and insurance document files | Deleted when your account is deleted | | Jobs, bids and awards | Kept after deletion, because they are also the other party's record. Your name is removed from them | | A job's public listing | Removed from the public listing immediately on deletion, cancellation or suspension. A search engine's copy is outside our control. See 5.1 | | Published reviews | Kept. Removing them would rewrite the other party's history. The author's name is removed | | Messages | Kept while the other party's account exists | | Subscription and payment records | Kept for seven years, because tax law requires us to keep records of what we were paid | | Staff action log | Kept. It cannot be edited or deleted by anybody, including us | | Technical logs | Kept for 12 months, then deleted |
When you delete your account: your profile stops being visible, your documents are deleted, your name is removed from public listings and from the other party's record, your jobs stop being published, and your jobs and bids are anonymised on the other party's record.
We are being deliberately plain that deletion is not total, because the alternative is promising something the software cannot do. A tradie cannot erase themselves from a contractor's record of who did the work on their building, and a contractor should not be able to erase a bad review by closing an account and opening another.
If you want something deleted that this section says we keep, ask us. We will do it where we can, and where we cannot we will tell you why.
If a breach of our systems is likely to result in serious harm to you, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires, and we will do that whether or not the scheme binds us. In Nigeria we will also notify the Nigeria Data Protection Commission.
We will tell you what happened, what information was involved, and what you should do about it. We will not wait until we have a complete picture before warning you, if waiting would leave you exposed.
You can:
- See what we hold about you. Most of it is visible in the app. For anything else, ask us - Correct it. Most fields are editable directly. For the rest, ask us - Ask us to delete your account, from Settings, subject to section 8 - Ask for a copy of your own data in a portable form. Tell us and we will send it to you - Withdraw consent to the transfer out of Nigeria, if you gave it under section 3, by closing your account - Complain. To us first, at support@connectmaster.au. If we do not resolve it, to the Office of the Australian Information Commissioner, or, in Nigeria, to the Nigeria Data Protection Commission
We will acknowledge a request within 5 business days and answer it within 30 days. We do not charge for an access request.
- Data is encrypted in transit and at rest - Passwords are hashed one way and are never recoverable - Access rules are enforced in the database, so a mistake in the app cannot expose data that the database itself refuses to hand over - The public listing is a database function that names its columns one by one, so a private column cannot be published by accident - Every staff action on a user's account is written to a log that nobody can edit - Uploads are validated for type and size on the server, not only in the browser
We cannot promise perfect security. Anybody who does is not being straight with you. What we can promise is that we will tell you quickly when something goes wrong. See section 9.
ConnectMaster is for businesses. It is not for anybody under 18, and we do not knowingly collect information about children.
We may change this policy, and we will publish the new version with a new version number and a date. If a change materially affects you, we will tell you at least 30 days before it takes effect, by email and in the app.
Privacy enquiries: support@connectmaster.au
CONNECTMASTER PTY LTD ACN 681 371 184 · ABN 46 681 371 184 Unit 1, 6 Maunder Street, Slacks Creek QLD 4127, Australia
Privacy enquiries are handled by the director. If that changes, this section changes with it.