Privacy Policy

Tradies Bio® is a business platform for licensed Australian tradies, accessible at https://tradiesbio.au/. The platform includes a public-facing tradie Bio page, a personal tradie dashboard, a Progressive Web App (PWA) that tradies can install on their mobile device, and integrated features including Google Calendar, AI Co-Pilot, phone enquiries, and customer management tools.

One of our main priorities is the privacy of everyone who uses Tradies Bio®. This Privacy Policy explains what information is collected and recorded by Tradies Bio Pty Ltd across all parts of the platform, and how we use it.

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us at info@tradiesbio.au.

This Privacy Policy applies to all online activities conducted through the Tradies Bio® platform, including the public website at tradiesbio.au, the personal tradie dashboard, the Progressive Web App (PWA), and any integrated third-party services (such as Google Calendar) accessed through the platform. It covers information shared by or collected from tradies, customers, and visitors across all of these surfaces. This policy does not apply to information collected offline or through channels outside the Tradies Bio® platform.

Consent

By using the Tradies Bio® platform — including the public website, your personal tradie dashboard, the Progressive Web App (PWA), or any integrated feature such as Google Calendar — you hereby consent to this Privacy Policy and agree to its terms.

Information We Collect

The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

If you contact us directly, we may receive additional information about you such as your name, email address, phone number, the contents of the message and/or attachments you may send us, and any other information you may choose to provide.

When you register for an Account, we may ask for your contact information, including items such as name, company name, address, email address, and telephone number.

When you sign up to the Tradies Bio® system, you will also be asked to confirm public information — specifically your ABN and any licences that you hold in your business. You will also be asked to provide a Certificate of Currency, which is included in the formation of your Credentials profile for your clients.

How We Use Your Information

We use the information we collect in various ways, including to:

• Provide, operate, and maintain our website and platform
• Improve, personalise, and expand our website
• Understand and analyse how you use our website
• Develop new products, services, features, and functionality
• Communicate with you, either directly or through one of our partners, including for customer service, updates, and marketing and promotional purposes (Note: data obtained through Google APIs — including Google Calendar data — is never used for marketing or promotional purposes; see the Google Services & Calendar Data section below for the explicit statement)
• Send you emails relevant to your account and service
• Find and prevent fraud

Log Files

Tradies Bio® Pty Ltd follows a standard procedure of using log files. These files log visitors when they visit websites. All hosting companies do this as a part of hosting services analytics. The information collected by log files includes internet protocol (IP) addresses, browser type, Internet Service Provider (ISP), date and time stamp, referring/exit pages, and possibly the number of clicks. These are not linked to any personally identifiable information. The purpose of the information is for analysing trends, administering the site, tracking users' movement on the website, and gathering demographic information.

Cookies and Web Beacons

Like any other website, Tradies Bio® uses cookies. These cookies are used to store information including visitors' preferences and the pages on the website that the visitor accessed or visited. The information is used to optimise the users' experience by customising our web page content based on visitors' browser type and/or other information. For more general information on cookies, please refer to your browser's help documentation.

Third-Party Services

Tradies Bio® does not display advertising and does not use any advertising network, ad server, or tracking pixel. We do not use Google Ads, DoubleClick, or any third-party advertising cookie.

The following third-party services are integrated into the platform for operational purposes only:

• Google Calendar API — used to display a tradie's upcoming jobs, identify open schedule gaps, and create booking events. Covered in detail in the Google Services & Calendar Data section below.
• Stripe — used to process payments where applicable. Stripe's privacy policy is available at stripe.com/au/privacy.
• Twilio — used for phone enquiry routing and SMS messaging. Twilio's privacy policy is available at twilio.com/en-us/legal/privacy.
• OpenAI — used to power the AI Co-Pilot and Scout conversational features. Google Calendar data and calendar-derived availability values are not passed to OpenAI; Scout keeps its availability copy local. See Google Services & Calendar Data.

You can disable browser cookies through your browser's settings. This will not affect core platform functionality such as logging in, viewing your dashboard, or using the Co-Pilot.

Australian Privacy Act 1988 & APPs

As an Australian business, Tradies Bio® Pty Ltd is committed to complying with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). Under these rights, every user is entitled to the following:

• The right to access — You have the right to request copies of your personal data. We may charge a small fee for this service.
• The right to rectification — You have the right to request that we correct any information you believe is inaccurate, or complete information you believe is incomplete.
• The right to erasure — You have the right to request that we erase your personal data, under certain conditions.
• The right to restrict processing — You have the right to request that we restrict the processing of your personal data, under certain conditions.
• The right to object to processing — You have the right to object to our processing of your personal data, under certain conditions.
• The right to data portability — You have the right to request that we transfer the data we have collected to another organisation, or directly to you, under certain conditions.

If you make a request, we will endeavour to respond within one month. To exercise any of these rights, please contact us at info@tradiesbio.au.

Children's Information

Tradies Bio® Pty Ltd does not knowingly collect any personally identifiable information from children under the age of 13. If you believe that your child provided this kind of information on our website, we strongly encourage you to contact us immediately and we will do our best efforts to promptly remove such information from our records.

Google Services & Calendar Data

Tradies Bio® integrates with Google Calendar to help tradies view upcoming jobs, identify open diary gaps, and automatically log customer enquiries as calendar events. This integration is entirely optional. Tradies who choose to connect their Google account authorise access via OAuth 2.0. The Google API scope requested is:

• https://www.googleapis.com/auth/calendar.readonly — reads your calendar names during initial setup only, so you can choose the calendar you use for work. It is used once to display the picker, then never again.
• https://www.googleapis.com/auth/calendar.events — enables the Tradies Bio® jobs workflow to read and write events in your selected jobs calendar only. Read access displays upcoming jobs in My Jobs and lets Tradie Scout identify open schedule gaps (start and end times only — no event content). Write access creates or updates Tradies Bio® events for Bio-page enquiries and booking requests. We never delete or modify events you have created yourself.

What we read from Google Calendar

• My Jobs view — event title (summary), location, description, and start/end date and time are read from your selected Google jobs calendar and displayed inside your private Tradies Bio® dashboard. This data is fetched live and shown only to you — it is not stored in our database.
• Tradie Scout — the API request is limited to start and end date/time fields only (via a partial-response field selector: fields="items(start,end)"). Event titles, descriptions, locations, and all other event content are not requested or received by this feature. Scout runs when you open Co-Pilot and request its analysis — it does not access your calendar silently in the background.
• Calendar names during setup — names are read once to show the calendar picker, then are never read again or stored.
• Connected calendar ID — we store only the unique identifier of your selected Google jobs calendar in our database so we know which calendar to read from and write to on subsequent sessions. The calendar name is not stored.

What we do not use: Attendee names or email addresses, organiser details, conference/video call links, recurrence rules, or any other calendar metadata beyond those described above.

What we write to Google Calendar

When a tradie uses the CRM event feature, Tradies Bio® creates or updates an event in their connected Google Calendar. These events contain:

• A title summarising the enquiry status and customer name
• A description containing job type, job location, customer phone and email, job value, urgency, the customer's original message, any notes the tradie has added, and the Tradies Bio® enquiry reference
• Start and end date/time (set by the tradie)

This data originates from information customers and tradies have entered into Tradies Bio® directly — it is written back to Google Calendar for the tradie's own records. Tradies may disable this feature at any time by disconnecting their Google Calendar.

Token storage

Google OAuth access and refresh tokens are stored server-side in Tradies Bio®'s database, linked to the tradie's account. They are never stored in browser local storage or accessible to client-side scripts. Tokens are used solely to make Google Calendar API calls on behalf of the tradie. Disconnecting Google Calendar immediately deletes all stored tokens.

Progressive Web App (PWA) and client-side data handling

Tradies Bio® is available as an installable Progressive Web App (PWA). The PWA is a thin client — it makes no direct calls to any Google API. All Google Calendar API requests are made exclusively by Tradies Bio®'s backend servers; the PWA communicates only with Tradies Bio®'s own servers, never with Google's API directly.

OAuth access tokens and refresh tokens are held server-side only and are never transmitted to the browser or the PWA client under any circumstances.

When a tradie views My Jobs, the server fetches calendar event data and returns it as server-rendered HTML — the same way any authenticated web page delivers user data to a browser. All responses that include Google Calendar event content are served with a Cache-Control: no-store header, which instructs the browser and any intermediate cache not to store the response. Tradies Bio® does not intentionally write Google Calendar event data to localStorage, sessionStorage, IndexedDB, service worker caches, or browser cookies.

Informed consent before connecting

Before a tradie authorises Google Calendar access, Tradies Bio® displays a clear explanation of why the connection is being requested, what it enables (job visibility, automatic booking creation, and follow-up tracking), and what data is and is not accessed. Tradies can choose "Not now" at any point before the Google authorisation screen appears, with no data collected and no redirect to Google.

Revoking access

Tradies can disconnect their Google Calendar at any time — no need to contact support. Disconnect from within Tradies Bio®:

• My Jobs → Calendar settings: Open My Jobs from your dashboard, tap Calendar settings, then tap Disconnect Google Calendar. This immediately removes all stored OAuth tokens from our database and stops all calendar reads and writes.

Disconnecting via either method is immediate and permanent until you choose to reconnect. All stored OAuth access tokens, refresh tokens, and your selected calendar ID are deleted from Tradies Bio®'s database at the moment of disconnection.

Access can also be revoked directly from Google's side at any time by visiting your Google Account permissions page, finding Tradies Bio®, and selecting Remove Access. Revoking from Google's side has the same effect — Tradies Bio® will detect the revocation on the next calendar request and display a prompt to reconnect or continue without Google Calendar.

Data retention and deletion of Google user data

• Event content (titles, descriptions, times): Tradies Bio® does not store Google Calendar event content in our database. All event data is fetched live from the Google Calendar API on demand and displayed only to you. No event content is retained after your session ends.
• OAuth tokens and Calendar ID: Your Google OAuth access token, refresh token, and selected Calendar ID are retained only for as long as your Google Calendar remains connected to your Tradies Bio® account. They are permanently deleted from our servers the moment you disconnect (via the in-app Disconnect button or via your Google Account permissions page).
• Account deletion: If you delete your Tradies Bio® account, all associated Google OAuth tokens and Calendar IDs are permanently erased from our servers immediately at the time of deletion — there is no retention period for Google user data once the account deletion is processed. No Google user data is retained after account deletion. To request complete account and data deletion, email info@tradiesbio.au. Deletion requests submitted by email are processed within 30 days of receipt; Google OAuth tokens and Calendar IDs are deleted immediately when that processing occurs, not at the end of the 30-day window.
• Derived data: Tradie Scout uses start and end times from your calendar to calculate available diary gaps. This calculation is performed in memory and is used only for local, deterministic Scout copy. No calendar-derived value is sent to an AI service or stored in our database.

Who we share or disclose Google Calendar data with

The table below sets out every party that receives or can access your Google Calendar data through Tradies Bio®. There are no other parties.

Google API Services User Data Policy — Limited Use

Tradies Bio®'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google Calendar data is used solely to provide the calendar features described above — displaying upcoming jobs, identifying diary gaps, and writing booking events. It is not used for any secondary purpose.
• Google Calendar data is not used for advertising, marketing, or to serve ads of any kind. Tradies Bio® runs no advertising platform.
• Google Calendar event content, dates, derived availability values, OAuth tokens, and calendar IDs are not passed to OpenAI or any other AI service. Scout keeps availability calculations local and uses them only for deterministic in-product copy.
• Google Calendar data is not transferred to third parties except as required to operate the calendar features (for example, server-side API calls made on behalf of the tradie who connected their account).
• Tradies Bio® does not use data obtained through Google Workspace APIs to develop, improve, or train generalised AI and/or ML models.
• Human access to your Google Calendar data is prohibited except under these four conditions only:
  1. You have given explicit consent for a support technician to view data to troubleshoot a specific technical problem you reported.
  2. It is necessary for security purposes, such as investigating abuse or a security incident.
  3. It is required to comply with applicable law.
  4. The data is aggregated and fully anonymised for internal operational purposes only (such as monitoring API error rates) — in which case no individual's data can be identified.

Artificial Intelligence Services

Tradies Bio® uses artificial intelligence (AI) to power the Co-Pilot and Tradie Scout features. The following third-party AI provider is used:

• OpenAI — model: gpt-4o, tier: Paid API (not a free or consumer tier). OpenAI's paid API service does not use API inputs to train or improve its models. See OpenAI's API Data Usage Policy.

No aggregators, gateways, or model hubs are used. Tradies Bio® calls the OpenAI API directly.

Google user data and AI: Google Calendar event content, dates, derived availability values, OAuth tokens, and calendar IDs are never sent to OpenAI or any other AI service. Tradie Scout reads calendar timing only to calculate availability locally and uses that result in deterministic in-product copy. Event titles, descriptions, locations, customer details from calendar events, and all other Google user data are never included in AI prompts.

Co-Pilot and voice features operate exclusively on business information the tradie has directly entered into Tradies Bio® — such as customer names, job descriptions, and quote amounts entered by the tradie.

Data Protection

Tradies Bio® Pty Ltd takes the security of personal information seriously and applies the following protections across all data, with specific mechanisms for sensitive credentials such as Google OAuth tokens:

General protections

• Encryption in transit — all data between your browser and our servers is encrypted via HTTPS/TLS 1.2+. Plain HTTP connections are rejected.
• Access controls — tradies can only access their own calendar data and business information. No tradie can view another tradie's data. Administrative access is role-restricted to authorised Tradies Bio® staff and is audited.
• Optional integration — Google Calendar access is entirely optional. Tradies who do not connect Google Calendar are not affected by any of the Google data practices described in this policy.
• AI data isolation — raw Google user data is never transmitted to third-party AI services, as described above.

Sensitive data — Google OAuth tokens

Google OAuth access tokens and refresh tokens are treated as sensitive credentials and are subject to the following specific protections:

• Encryption at rest — OAuth tokens are stored encrypted in our database. The encryption key is held separately from the token store and is never written to application logs.
• Server-side only — tokens are never returned to the browser, written to cookies, or stored in browser local storage or session storage. All calendar API calls are made server-side using the stored token; the token itself is never exposed to client-side JavaScript.
• Minimum retention — tokens are held only for as long as the Google Calendar integration remains active. Disconnecting immediately triggers permanent deletion of all tokens from the database with no backup retention.
• Scope limitation — the OAuth token is scoped to calendar.events for the selected jobs calendar and calendar.readonly to read calendar names during setup only. Tradies Bio® requests no other Google API permissions.
• Revocation detection — if Google revokes a token (e.g. the tradie removes access from their Google Account settings), Tradies Bio® detects the 401 response on the next API call and immediately purges the stored token and flags the integration as disconnected.
• No logging of token values — token strings are never written to application logs, error reports, or monitoring dashboards.

Google API Services — Limited Use Compliance

This statement is hosted at https://tradiesbio.au/privacy#limited-use and can be provided to Google as the required Limited Use compliance disclosure URL. The Google Calendar data section of this policy is also directly accessible at https://tradiesbio.au/privacy#google-data.

Contact Us

If you have any questions about this Privacy Policy, please contact us: