Privacy policy

1. Who we are and what this covers

Steddy is job management software for trade businesses. Steddy runs it. In this policy "we" and "us" mean Steddy.

This policy covers:

• steddyhq.com, this website
• app.steddyhq.com, the Steddy app, including the customer portal, the quote signing page and the review page a homeowner sees
• Steddy Crew, the phone app for technicians
• the calls, texts and emails that pass through Steddy

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, whether or not the Act requires us to. If we open to businesses in another country, that country's page will add what its laws require.

2. Two kinds of information, two answers

Steddy holds two kinds of personal information. Which kind you are asking about decides who answers.

Information about you as our customer or a visitor. The owner and staff accounts, billing, what you send us, and what you do on this site. We decide how that is handled and this policy is the whole answer.

Information a business puts into Steddy about its own customers. When a plumber books a job at your house, your name, address and phone number go into that plumber's Steddy account. The business decides why it collects your details and what it does with them. We store and process them on the business's instructions. If you are a homeowner, ask the business first. It is their record. If you cannot reach them, write to us and we will help you reach them, or handle the request ourselves where the law asks us to.

3. If you visit steddyhq.com

• This site sets no cookies. It runs no analytics today. We plan to switch on Microsoft Clarity, which records how pages are used, and the cookie policy lists every cookie it sets.
• Our host, Vercel, keeps the usual server logs: your IP address, browser, and the pages you asked for. Vercel holds them for its own security and operations.
• If you write to us, or book a demo through a link on our contact page, what you send goes to the provider that link uses, under its own terms, and to us. We keep it so we can reply and follow up.
• The customer voting page takes the code from the voting email we sent the business, and the business's choice. No name or email is typed.

4. If you run a business on Steddy, or work for one

Your account holds:

• Your name, email, phone number and role. Your password is stored hashed; we cannot read it.
• When you last signed in, and your sign-in sessions with the browser or device used, kept for 90 days.
• A log of actions taken in the account, so the business can see who changed what.
• For technicians, what the business records about you in Steddy: commission percentage, contract date, whether you supply your own tools or vehicle, and notes. Your employer controls these. We store them.
• The business's details: trading and legal name, ABN or ACN, address, logo, and the bank account printed on its invoices.
• The plan you are on and your billing history. TODO(decision: legal-terms): who holds your subscription payment details, once billing exists.
• The integrations you connect: Xero, Square and Google Ads. We hold the access token, encrypted, and the records the sync moves.
• What you tell us when you ask for help.
• Error reports. When the app hits an error, our error service, Sentry, receives the error, your account id and email, your company's id and name, and a replay of the screen with every word masked and every image blocked. We take a sample of page timings to find slow screens. Sentry stores this in the United States.

5. If a business you deal with uses Steddy

A business keeps its customer records in Steddy. If you are one of its customers, its account may hold, about you:

• Your name, company, email addresses, phone numbers and addresses. We turn an address into map coordinates so the office can see where the job is and plan the day.
• Leads, jobs and what was done: the issue you described, work notes, when the technician arrived, and photos of the work.
• Quotes you were sent, and when you approve one online: the signature you drew, the name you typed, your IP address, your browser or device, the time, and the exact terms and privacy links you ticked. A quote can also take a card deposit through the business's Square account. Square handles the card. We keep the amount, its status and Square's reference.
• Invoices, the signature and name if you signed one on the technician's phone, payments, and any disputes.
• If the business gives you a customer portal login, the email you sign in with and the messages you send through the portal.
• Tags, notes and a lifetime value figure the business assigns to your record.
• After an invoice is paid, a request to rate the business out of five, and the rating and comment you leave.
• The calls, texts and emails between you and the business. Section 6 says exactly what that includes.

If the business pays a referral partner for sending it work, we hold that partner's business name, contact details and the fee ledger.

6. Calls, texts and emails sent through Steddy

Calls

On the Steddy Loop and Steddy Fleet plans we provide phone numbers to the business through our call-tracking provider, CallTrackingMetrics, so the business can see which ad or channel made the phone ring. For each call to one of those numbers we keep the caller's number, the number called, the time, how long it lasted, who answered, a recording of the call and a written transcript of it. The recording is stored by the provider. The transcript is stored in the business's account.

Recording is switched on when we set up a number for a business. Australian states and territories each have their own law on recording a phone call. The business you are calling is responsible for telling you a call is recorded where its law requires it, and our terms require the business to do that. A business can ask us to switch recording off for its numbers. TODO(decision: legal-terms): whether recording stays on by default, and whether Steddy plays an announcement.

Texts

A business can text you from Steddy, through the same provider. Steddy can also send a text automatically after an invoice is paid, asking you to rate the business. We keep the number, the message and any attachment. To stop texts from a business, tell the business. It can mark your record so review requests stop. TODO(decision: legal-terms): a reply keyword that stops texts, once it is built.

Emails

Emails a business sends through Steddy go out through our email provider, Postmark, from the business's own domain or from mail.steddyhq.com. We record whether an email was opened, which links in it were clicked, and whether it bounced. Replies come back through reply.steddyhq.com and are stored with the job they belong to.

7. What we use information for

• To run Steddy for the business: booking, dispatch, quotes, invoices, payments, the reports on what the work made.
• To sign you in, keep your account secure and spot misuse.
• To send the emails and texts the business asks Steddy to send, and our own account emails: invites, sign-in links, bills, notices about our terms.
• To answer when you ask for help, and to find and fix errors.
• To send a business's paid jobs back to its Google Ads account as conversions, when the business connects Google Ads. Section 8 says what that sends.
• To improve Steddy, using figures that identify no business and no person.
• To meet the law, including tax and accounting record-keeping.

We do not sell personal information. We do not use the information in any account to train artificial intelligence models. We may use de-identified, aggregated figures, such as the average time from invoice to payment across all businesses on Steddy, to improve the product and to describe how it performs. We do not publish anything derived from a business's figures, aggregated or not, without that business's written consent.

We send owners emails about Steddy itself: changes, new features, what other businesses have found useful. Every one has an unsubscribe link. TODO(decision: legal-terms): the basis for those emails, the business relationship or an opt-in at signup. Account emails, such as a bill or a change to our terms, are not marketing and keep coming while you have an account.

8. Who we share it with

Steddy is built on services run by other companies. Each one holds only what it needs to do its job, under a contract that limits it to that job.

A business can also point Steddy at a web address of its own choosing, so that when a job closes, the job's details, including the customer's name, phone, email and postcode, are sent there. Where that goes is the business's decision and the business's responsibility.

Beyond those, we share personal information only with our professional advisers under confidentiality, with a buyer if Steddy is sold, after telling account owners, and when the law requires it, such as a court order. We do not hand information to the police or a regulator without a lawful request, and we tell the business unless the law says we cannot.

9. Where it is stored

Our database runs in the United States, in Ohio, and so do most of the services in section 8. If you are in Australia, your information leaves Australia. We choose providers that commit in writing to protect it, and we take the steps the Privacy Act asks of us before disclosing personal information overseas. A business that needs its records kept in Australia should tell us before it signs up, because today we cannot do that.

10. How we protect it

• Every connection to Steddy is encrypted in transit.
• Each business's records are isolated from every other business's at the database level, on every table.
• Accounts are invite-only. An invite link expires. Sign-in tokens expire after an hour and are rotated.
• The tokens that connect Xero, Square and Google Ads are encrypted at rest. Call-tracking credentials are held in a secrets vault.
• Photos and signatures are stored in private folders per business, reachable only through a link that expires.
• A log records who did what in each account. Our own staff's access to a business's account is logged. TODO(decision: legal-terms): the support-access rule, in plain words, once David sets it.
• In Steddy Crew, the sign-in session is encrypted on the phone. Job data is cached on the phone for up to seven days so the app works without signal. Keep the phone locked.

No system is perfect, and we will not tell you ours is. If you find a weakness, write to us at the address on this page. TODO(decision: legal-terms): a security address that is confirmed to deliver; the product's own docs name one, unconfirmed.

11. How long we keep it

• While an account is open, we keep its records for as long as the business keeps them, because they are the business's books. Australian tax law requires a business to keep invoices and payment records for five years.
• Housekeeping data is cleared on a schedule: sign-in sessions after 90 days, address-lookup logs after 30 days, integration event logs after 60 to 180 days, and a quote-signing attempt that was never completed after 24 hours.
• Error reports are kept by Sentry for 90 days.
• After an account closes: TODO(decision: legal-terms): the export window and the deletion date, once David sets them and the product can keep them.
• If you are a homeowner, the business decides how long it keeps your record. Ask the business.

12. Your rights

You can ask us what personal information we hold about you, and ask us to correct it. We answer within 30 days. If we refuse, we say why in writing.

If you are a homeowner, your first stop is the business you dealt with. It controls the record and can correct it or remove it. If you write to us instead, we pass the request to the business and help it respond. Where the law requires us to act ourselves, we do.

If you think we have mishandled your information, write to us first. We investigate and reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. If something goes wrong

If personal information in our care is lost, or accessed by someone who should not have it, and that is likely to cause serious harm, we tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We tell the business whose account is affected as soon as we have confirmed what happened, so it can tell its own customers. TODO(decision: legal-terms): the notice window to the business, proposed within 72 hours of confirming a breach.

14. Children

Steddy is for businesses and the adults who run and work in them. We do not knowingly collect personal information from anyone under 18, and a business should not enter a child's details as its customer.

15. Changes to this policy

When this policy changes, the new version is posted here with the date it takes effect. If a change affects what we collect or who we share it with, we email every account owner before it takes effect.