Privacy

This statement describes how the SubSure platform handles personal information. It is written to reflect what the system actually does. It is not legal advice, and it is being reviewed by an Australian privacy practitioner before SubSure operates at scale — where that review changes anything, this page will change with it.

Who this covers

Two groups of people, with different relationships to SubSure:

• Builder users — people at a construction business who hold an account and use SubSure to manage subcontractor compliance.
• Subcontractors — people and businesses who supply compliance documents through a secure link. They do not hold a SubSure account, and their information reaches us because a builder they work with added them.

What we collect

From builder users:

• Name, email address and organisation.
• Records of actions taken in the product, for the audit log.

From or about subcontractors:

• Name, mobile number, trade and state, as entered by the builder.
• The compliance documents supplied — typically certificates of currency, workers compensation policies and trade licences — and the values read from them, such as the insurer, policy number, cover amount and expiry date.
• Where a declaration is made instead of a certificate, the exact wording agreed to, the name typed, and the date.

We do not collect a subcontractor’s email address, and we do not ask them for anything that is not on the documents a builder requires.

Why we hold it

To answer whether a subcontractor meets the compliance requirements a builder has configured, to remind them when a document is expiring, and to preserve the evidence behind those answers so a past date can be reconstructed later.

Documents and AI processing

Documents supplied through SubSure are read by an artificial-intelligence service to extract the values printed on them. That service may process the document outside Australia. Subcontractors are told this at the point they supply a document, before they upload anything.

The extraction service reports what a document says. It does not decide whether a document satisfies a requirement — that is done by deterministic rules configured by the builder.

Where information is stored

The database and document storage are hosted in Australia, in the Sydney region. The AI processing described above is the exception, and is disclosed as such.

Who can see it

A builder organisation can see its own records and nothing else. Separation between organisations is enforced in the database rather than only in the application, so a request for another organisation’s records returns nothing.

SubSure staff may access records where necessary to operate or support the service. Support access to an organisation’s workspace is time-limited, requires a stated reason, and is logged.

How long we keep it

There is a genuine tension here and we would rather set it out than gloss it. General privacy guidance says to destroy or de-identify personal information once it is no longer needed. SubSure’s purpose — proving what was true on a past date — depends on retaining exactly those records.

Our working position is:

• Raw, unconfirmed extraction output is transient and is not kept indefinitely.
• Confirmed documents, their files, and the compliance decision history are retained for the life of the organisation’s account plus a defined period afterwards.

The exact retention period is one of the points under legal review, and we have not stated a number here rather than invent one.

Accessing or correcting your information

You can ask what personal information we hold about you and ask us to correct it. This applies to subcontractors as well as builder users, even though a subcontractor holds no account — contact us directly and we will handle the request.

Deletion is a formal, logged process rather than a self-service button, because deleting a record may interact with a builder’s need to retain evidence. We will tell you what we can and cannot do in your specific case.

Contact

Privacy questions and access or correction requests can be made through our contact page.

Changes

We will update this page when the service changes or when legal review requires it.