How Allsquare handles personal information.

This policy is from Allsquare, Perth, Western Australia (“Allsquare”, “we”, “us”). Allsquare is software that helps builders and head contractors collect and check their subcontractors’ insurance certificates and chase renewals, at useallsquare.com.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and with other privacy laws where they apply to you.

• Our customers’ team members: people who have an Allsquare login.
• Subcontractors and their contacts: people whose details our customers put into Allsquare, or who upload a certificate through an upload link a customer sent them.
• Website visitors and anyone who contacts us.

When a customer adds a subcontractor’s details, the customer decides what goes in and is responsible for having the right to share it with us and to contact that subcontractor. We handle that information on the customer’s behalf and only to provide Allsquare to them.

If you have an Allsquare login

• Your name, email address, the company you belong to and your role (admin, member or viewer).
• Your password, stored only as a one-way hash, never as the password itself.
• A record of important actions in your company’s account (for example, “certificate saved” or “reminder sent”), with who did them and when.
• For paid plans: your plan, billing status and the customer number our payment provider, Stripe, gives us. Stripe collects your card details directly. We never see or store full card numbers.

About subcontractors

• Business name, trade, contact name, email address, phone number and any notes the customer adds.
• Insurance certificates (for example, certificates of currency) and the details read from them: insurer, policy numbers, dates, limits, and whatever else is printed on the certificate, such as the insured’s name and address.
• The reminder emails sent to the subcontractor through Allsquare, and whether they were delivered.

From website visitors

• The country you’re in, worked out from your connection by our hosting provider, so we can show prices in your currency. We don’t store it against you.
• Technical information our hosting providers log automatically, such as IP address, browser type and the pages requested, used for security and to fix problems.
• The small settings described under “Cookies and similar storage” below.

We don’t use advertising cookies, tracking pixels or third-party analytics on Allsquare.

When you contact us

Your name, email address and whatever you choose to tell us.

We don’t ask for sensitive information (such as health information), and we ask customers not to put it into Allsquare. You can browse the website without telling us who you are, but we need a name and email address to create an account.

• To provide Allsquare: reading certificates, checking them against the requirements a customer sets, showing the results and sending the reminders the customer asks for.
• To run accounts: signing in, confirming email addresses, resetting passwords and inviting team members.
• To keep Allsquare secure: limiting sign-in attempts, preventing misuse and investigating problems.
• To bill paid plans and send billing notices.
• To answer questions and give support.
• To understand how Allsquare is used, from counts such as the number of sign-ups and certificates read, so we can improve it. We don’t look at a customer’s records for this unless they ask us to help.
• To meet legal obligations, such as keeping tax records.

We send emails about your account and the service. We won’t send you marketing emails without your agreement, and any we do send will have an unsubscribe link. We never send marketing to subcontractors.

We don’t sell personal information, and we don’t share it with anyone for their own marketing.

When AI reading is switched on, a certificate that is uploaded is sent to Anthropic (the maker of Claude) to read the details from it. Anthropic processes it under its commercial terms, which don’t allow it to use that data to train its models. Anthropic may process it outside Australia, including in the United States.

Nothing the AI reads is saved to a subcontractor’s record until a person on the customer’s team has checked it. We don’t use customers’ certificates or records to train any AI model.

We use these service providers to run Allsquare. Each only gets what it needs to do its job for us.

We also share personal information:

• Within a customer’s company: team members can see their own company’s records, depending on their role. People in one company can never see another company’s records.
• With subcontractors, on a customer’s instruction: reminder emails include the customer’s company name and what’s due or missing.
• When the law requires it, or to protect people or Allsquare from harm or fraud.
• If Allsquare is sold or transferred, to the new owner, who must handle it in line with this policy. We’ll tell account admins first.

The Security and privacy page lists our providers too, and we keep both lists up to date.

Allsquare’s app and database run in Australia, but some providers in the table above process information overseas, most likely in the United States and Japan. We choose established providers that commit to protecting the information and to using it only to provide their service to us.

• Every connection to Allsquare is encrypted (HTTPS).
• Passwords are stored as one-way hashes. Sign-in locks for a while after repeated wrong passwords.
• Each company’s records are kept separate, and roles control what each team member can do.
• Upload links for subcontractors only allow uploading, never viewing, and can be switched off at any time.
• Access to the live database is limited to the person who runs Allsquare.

No system is perfectly secure. If a data breach is likely to cause serious harm, we’ll tell the people affected, the customers concerned and, where required, the Office of the Australian Information Commissioner.

• We keep a company’s records while its account is open, so the customer can keep its history.
• Customers can edit or delete subcontractors in Allsquare at any time. When a company asks us to close its account, we delete its records from the live service within 30 days. Copies in backups are overwritten within a further 30 days.
• We keep billing records for as long as tax law requires (in Australia, generally five years), even after an account closes.
• Hosting providers keep technical logs for a short time, for security and troubleshooting.
• Support emails are kept while they’re useful for helping you, then deleted.

You can ask to see the personal information we hold about you, have it corrected, or have it deleted. Team members can update their own name and password in Allsquare, and admins can export their company’s records at any time. Otherwise, email hello@useallsquare.com. We’ll check it’s really you, then reply within 30 days. There’s no charge.

If you’re a subcontractor: the builder who added you controls your record. You can ask them directly, or email us and we’ll pass your request on and help.

If you’re in the United Kingdom, the European Union or New Zealand, you may have further rights under your local law, such as objecting to how we use your information. Email us and we’ll help.

Allsquare only uses cookies it needs to work. None of them track you across other websites.

We’ll update this policy when the way we handle information changes, and change the date at the top. If a change is significant, we’ll email account admins before it takes effect.

Email hello@useallsquare.com with any question or complaint about privacy. We’ll acknowledge it within a few business days and aim to resolve it within 30 days.

If you’re not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au, or to the privacy regulator where you live.

Allsquare, Perth, Western Australia.