Privacy Policy

This Privacy Policy explains how Nexxt Nest Group Pty Ltd ("Nexxt Site Manager", "we", "us") collects, uses, stores, discloses and protects your personal information when you use the Nexxt Site Manager platform at nexxtsitemanager.com.au (the "Service"). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information we collect

We collect only what the Service needs to function:

• Account information — your email address, and the builder profile you choose to provide: company / trading name, authorised representative name, ABN, builder registration number, and phone number.
• Content you submit — the project details, descriptions, plan PDFs and files you enter into the AI tools to generate documents. The inputs you enter into each tool and the output it produces are kept in your document history so you can reopen them.
• Photos you upload — site, defect and instruction photos, which may include images of people.
• Subcontractor and other third-party details you record — names, trades, contact details, licence numbers, insurer and policy numbers, expiry dates, and the licence, insurance and White Card certificates you upload for them; inspector names and contact details on inspection records. You are responsible for telling those people that you have recorded their details with us.
• Usage data — records of which tools you use and when, including the IP address the request came from, for billing, quota and product-improvement purposes.
• Billing information — subscription and payment records. Card details are handled entirely by Stripe; we never receive or store your full card number.
• Technical data — server logs and our error and security records (e.g. IP address, timestamps, the page in use) used for security and reliability.

2. How we use your information

• To provide, operate and secure the Service and your account.
• To generate the documents you request through the AI tools. The AI drafts documents from what you enter; it does not make decisions about you. The only automated decisions in the Service are the plan limits on your account (how many AI documents a plan includes) and the subcontractor compliance flags, which are computed from the expiry dates you record and can be overridden by you.
• To process subscriptions, payments and entitlements.
• To send service and account communications (e.g. login links, receipts, important notices).
• To monitor reliability, prevent abuse, and improve the Service.

We do not sell your personal information, and we do not display third-party advertising.

3. How we store and protect it

Where your data is stored. Your account data, projects, documents, subcontractor records and uploaded files are stored in Seoul, South Korea, in a managed PostgreSQL database run by Supabase on Amazon Web Services (region ap-northeast-2). That is outside Australia; see section 5. We intend to move this data to Sydney, Australia, and will update this policy when we do. Access is restricted by row-level security so each user can access only their own records.

Data breaches. If we suspect a data breach that is likely to result in serious harm, we assess it within 30 days and notify affected users and the Office of the Australian Information Commissioner as soon as practicable, as the Notifiable Data Breaches scheme in the Privacy Act requires. Contact details are at the end of this policy. Data is encrypted in transit. Because this location is outside Australia, see section 5 (Overseas disclosure) for how we handle it under APP 8. Further detail is in our Security & Data Protection page.

4. Service providers and disclosure

We share information only with the service providers needed to run the platform, and only as far as required:

• Supabase — database, sign-in (authentication) and file storage for uploaded photos and certificates; hosted in Seoul, South Korea (Amazon Web Services ap-northeast-2).
• Vercel — application hosting and the serverless functions that run the Service (United States, with a global edge network).
• Stripe — payment processing.
• Anthropic (Claude AI) — AI processing of the text and plan images you submit to the AI tools, solely to generate your output. API inputs are not used to train AI models.
• Resend — sends our email (welcome and billing emails, the daily compliance briefing). Zoho Mail hosts our mailbox, so email you send us is stored there.
• Upstash — rate-limiting and abuse protection.
• Google Fonts — the fonts on our pages are loaded from Google's servers, which receive your IP address and browser details when a page loads.
• esm.sh and cdnjs (Cloudflare) — script libraries used by the app are served from these content delivery networks, which receive your IP address and browser details when they load.

We may also disclose information where required by law.

5. Overseas disclosure

Your account data — including builder profile details (company or trading name, authorised representative name, ABN, builder registration number and phone number), project information such as site addresses, and any files you upload such as defect photographs (which may include images of people) — is stored on our database provider's infrastructure located in Seoul, South Korea (Supabase, on Amazon Web Services region ap-northeast-2). Holding this data offshore is an overseas disclosure for the purposes of Australian Privacy Principle 8.

Some other providers also process limited data outside Australia, primarily in the United States — for example Anthropic (AI processing of content you submit), Stripe (payment processing), and our application-hosting, email and rate-limiting providers.

Where personal information is disclosed overseas we take reasonable steps under APP 8 to ensure it is handled consistently with the Australian Privacy Principles. These steps include selecting established providers that publish their own data-processing and security terms, encryption of data in transit, and row-level access controls that limit each record to its owner. We remain accountable under the Privacy Act 1988 (Cth) for the personal information we entrust to these providers.

6. Cookies and sessions

We use a secure browser session token to keep you signed in. We do not use third-party advertising or tracking cookies. The app also keeps a copy of your builder profile, your current project selection and any unsent work in your browser's local storage so it can work offline; that copy stays on your device.

7. Data retention

We retain your account and content data for as long as your account is active, and for a reasonable period afterwards as needed for legal, accounting and security purposes. You can request deletion at any time (see section 8).

8. Your rights

Under the Privacy Act you may request access to, or correction of, the personal information we hold about you. To make a request, contact us at the address below. If you have a privacy concern you may also contact the Office of the Australian Information Commissioner (OAIC).

Deleting your account and data. You can request deletion from the "Delete my account and data" section of your account page, or by emailing us from the address on your account. We log the request, send you a confirmation email, and complete the deletion within 30 days. You can cancel the request from your account page or by replying to the confirmation email at any time before it is completed. Deletion removes your account and the data you entered; we keep only the records we must keep by law (for example tax invoices and payment records), and delete those when the legal retention period ends. If you have a paid plan, cancel the subscription first — deleting your account does not stop billing.

9. Children

The Service is intended for businesses and is not directed at anyone under 18.

10. Changes to this policy

We may update this policy from time to time. Material changes will be notified through the Service or by email, and the "last updated" date above will change.

11. Contact

Privacy questions or requests: hello@nexxtsitemanager.com.au.