Privacy Policy

1. Who we are

Lempars Creations is a business name of Parsons Custom Carpentry Pty Ltd (ACN 688 982 578), a company incorporated in Australia ("Lempars Creations", "we", "us", "our").

We are the entity responsible for the personal information described in this policy. Under the EU and UK GDPR we are the "data controller" for that information.

Contact for privacy matters

• Email: lemparscreations@gmail.com
• Postal: 8 Koala Ave, Badger Creek VIC 3777
• Attention: The Privacy Officer

This policy covers:

• the website at lemparscreations.com.au;
• the BOB The Estimator app distributed through the Apple App Store and Google Play;
• the web version of BOB The Estimator; and
• the backend services that support them.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Where they apply to you, we also honour the EU General Data Protection Regulation (GDPR), the UK GDPR, and the California Consumer Privacy Act as amended by the CPRA.

2. The short version

3. Information we collect

3.1 Account information

When you create an account we collect:

• your email address;
• a password, which is stored only in hashed form by Firebase Authentication — we never see or store your password in plain text;
• your display name, if you provide one.

If you sign in with Google, we receive your name, email address and profile picture from your Google account. If you sign in with Sign in with Apple, we receive your name and email address; if you choose Apple's Hide My Email option we receive only the private relay address, and that is all we store.

3.2 Subscription and payment information

We never receive or store your full card number, CVV, or bank details. Payment is handled entirely by the relevant payment provider.

Depending on where you subscribe, we store:

• Web (Stripe): your Stripe customer ID, subscription ID, subscription status, plan tier, and the estimators you have selected.
• Android (Google Play Billing): the purchase token and subscription status returned by Google Play.
• iOS (Apple In-App Purchase): the transaction identifier and subscription status returned by the App Store.

We use this to work out what your account has access to, and to let you change, pause, resume or cancel a plan.

3.3 Business profile and branding

If you set them up, we store your business or trading name, whether you operate as a sole trader, your hourly and charge-out rates, your saved rate profiles / rate books, your operating hours and default break times, and any business logo you upload. Your logo is stored in Firebase Storage and is placed on the PDF quotes you generate.

You can also add your name, mobile number, email address, and licence number or ABN. These print on your PDF quotes and in the sign-off of emails you prepare for your clients in the app.

3.4 Job, estimate and project information

We store the working content you create in the app: job dimensions and options, saved estimates and quotes, projects and their status, expenses and income you record, manual prices you enter, estimate templates and saved Custom Estimate rows, calendar bookings and day notes, to-do items and the reminders you set on them, and your settings and preferences. This content is synced to your account so it is available on each device you sign in on.

3.5 Information about your clients

BOB The Estimator lets you record details about your own customers — typically a name or job name, site address, email address, phone number, and free-text notes. You enter this information; we store it so the app can show it back to you and print it on your quotes.

For that client information:

• You decide what to enter and why. In GDPR terms you are the controller of your clients' data and we act as your processor, handling it only to provide the app to you.
• You are responsible for having a proper basis to collect and store your clients' details, and for meeting your own privacy obligations to them.
• We do not contact your clients, market to them, or use their details for any purpose of our own.
• Please do not enter sensitive information (such as health information) about your clients into the app.

When you email a quote or message to a client, BOB prepares the email and opens it in your device's own email app. The email is sent from your own email account — we do not send it, and we do not receive a copy.

3.6 Pro+ team plan (team owners and crew)

On the Pro+ plan, a team owner can invite crew members by email. Each crew member signs in with their own BOB account, so section 3.1 applies to them too. For a team we store:

• team membership, each member's role, and invitation status (including the email address an invitation was sent to);
• details the team owner records about each crew member, such as name, role, employment type (for example casual or contractor), cost and charge-out rates, rostered bookings, hours worked, timesheets and wages;
• the jobs and tasks assigned to each crew member, work they mark as complete, and the site notes and photos they add.

Crew members can see the jobs and tasks assigned to them. The team owner can see the updates, notes and photos crew members add. If a crew member is removed from a team, they lose access to that team's jobs.

For the information a team owner records about their crew, the team owner decides what to enter and why, in the same way as for client information in section 3.5: the owner is responsible for meeting their own privacy and workplace record-keeping obligations to their workers, and we handle that information only to provide the app.

3.7 Location information (optional)

BOB The Estimator can show a local weather forecast on your dashboard, on each day of your calendar, and in your daily reminder. To do that, and only if you grant permission, the app reads your device's approximate or precise location while the app is in use.

• Your coordinates are sent to Open-Meteo (open-meteo.com), a weather API, to retrieve the forecast for your area.
• The forecast is cached on your device. We do not store your location on our servers, build a location history, or share your location with anyone else.
• We never collect location in the background. There is no background location tracking.
• You can refuse or later revoke location permission in your device settings. The rest of the app works normally; only the weather features stop working.

3.8 Camera and photos (optional)

The app asks for camera or photo library access only when you choose to:

• add a business logo — the image you pick is used on your profile and your PDF quotes; or
• attach photos to a site note or job — for example a crew member recording progress on site.

We only receive the photos you take or select in the app. We do not scan, index or upload your photo library. Photos are uploaded to Firebase Storage and are visible to you and, for team jobs, to the team owner and the crew assigned to that job. A photo may contain information your device stores with it (such as the date and the place it was taken), depending on your camera settings.

3.9 Notifications

BOB The Estimator uses two kinds of notifications, both optional:

• Reminders — morning and afternoon reminders and reminders on your to-do items are local notifications scheduled on your own device. Tapping one opens that day in your calendar. On Android the app re-schedules pending reminders after a device restart.
• Team notifications — on Pro+ teams, the app can send push notifications about team activity, such as a job or task assigned to you or an update from your crew. These are delivered through Firebase Cloud Messaging (and Apple Push Notification service on iOS). To do this we store a device push token linked to your account. We use it only to deliver BOB notifications.

You can turn notifications off at any time in your device settings.

3.10 Device, diagnostic and support information

• Network status: the app checks whether your device is online so it can show an offline banner. This is read on the device and is not transmitted or stored.
• Problem reports: if you use the in-app "report a problem" feature, we receive the description you write, together with your user ID, your account email address, the app version and build number, the platform (iOS, Android or web) and a timestamp. We use this only to investigate and respond.
• Signed-in devices: so you can see which phones and computers are signed in to your account and remove any you don't recognise, we record for each device a device identifier created by the app, the device type or model, the platform (iOS, Android or web), the app version, and when it signed in and was last active. This is used only for account security and is not used for advertising or tracking.
• Support emails: if you contact us, we keep your message and our reply.

3.11 Website visitors

Our web hosting provider processes standard server request information (such as IP address, browser type and pages requested) to serve the site securely and reliably. The website does not run advertising, analytics or third-party tracking scripts.

If you use the contact form on our website, the name, email address and message you enter are sent through Web3Forms, a form-delivery service, which forwards them to our inbox. We use them only to reply to you.

3.12 What we do not collect

For clarity, BOB The Estimator does not collect or use:

• advertising identifiers (including Apple's IDFA) or any advertising SDK;
• third-party analytics or behavioural profiling SDKs;
• your contacts, device calendar, microphone, call logs, SMS, or installed-app list;
• any photos other than the ones you choose to take or select in the app;
• background location;
• biometric data;
• any special-category or sensitive information as defined by the Privacy Act or GDPR.

We do not use your data to train machine-learning models, and we do not make automated decisions that produce legal or similarly significant effects about you.

4. Why we use your information

We use personal information to:

You can withdraw consent at any time by turning the relevant permission off in your device settings. Withdrawing consent does not affect processing that already took place.

5. Device permissions

We ask for each permission at the point the feature is used, and we explain why before the system prompt appears. You can change any of these later in your device settings.

6. Who we share information with

We do not sell your personal information. We disclose it only to the service providers that make the app work, and only as far as needed:

We may also disclose personal information:

• where you ask us to, or clearly consent;
• to professional advisers (such as our accountants or lawyers) under a duty of confidence;
• if we are required to by law, court order or a regulator;
• to protect our rights, safety, or property, or that of our users or the public; or
• to a buyer or successor in the event of a sale, merger or restructure of our business, in which case this policy will continue to apply to the information transferred.

We require our service providers to protect personal information and to use it only for the services they provide to us.

Their own privacy policies apply to their handling of your information:

• Google / Firebase: policies.google.com/privacy
• Stripe: stripe.com/privacy
• Apple: apple.com/legal/privacy
• Open-Meteo: open-meteo.com/en/terms
• Web3Forms: web3forms.com/privacy

7. Overseas disclosure

Our providers store and process data outside Australia, principally in the United States and the European Union (see the table in section 6).

By using BOB The Estimator you agree that we may disclose your personal information to these overseas recipients. We take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, and we rely on their contractual commitments and certifications. Note that in some cases APP 8.1 may not apply and we may not be accountable for a recipient's breach, and you may not be able to seek redress under the Privacy Act in that country.

For transfers of EU or UK personal data outside those regions, our providers rely on Standard Contractual Clauses or an equivalent approved transfer mechanism.

8. How we store and protect your information

• Login credentials are managed by Firebase Authentication; passwords are stored hashed, never in plain text.
• Data in transit is encrypted using TLS/HTTPS.
• Data at rest in Google Cloud is encrypted by the platform.
• Database security rules restrict each account's records so they can only be read and written by that signed-in account and, on Pro+ teams, by the team members given access to the relevant jobs.
• Access by us to production systems is limited to those who need it.
• Payment card details never reach our systems; they are handled by Stripe, Apple or Google.
• You can review the devices signed in to your account and remove any you don't recognise.

Some information (your settings, cached forecast and locally saved estimates) is stored on your own device. Protecting your device with a passcode or biometric lock is the best safeguard for that copy.

No method of transmission or storage is completely secure. While we take reasonable steps to protect your information, we cannot guarantee absolute security.

9. How long we keep information

• Account and subscription records: for as long as your account is active.
• Your estimates, projects, quotes and rate settings: until you delete them, or until you delete your account.
• Team and crew records, site notes and photos: until you delete them, or until the team owner deletes their account.
• Signed-in device records: until you remove the device from your account or delete your account.
• Problem reports and support correspondence: up to 24 months, so we can track recurring issues.
• Billing and transaction records: as long as required by Australian tax and corporations law, generally 7 years, even after your account is closed.
• Cached weather and local settings: on your device only, until you clear them or uninstall the app.

When information is no longer needed for any purpose set out in this policy, and we are not required to keep it by law, we delete it or de-identify it.

10. Deleting your account and your data

You can delete your account at any time.

In the app (iOS, Android and web):

1. Open Settings.
2. Tap Account Details.
3. Tap Delete Account, then confirm.

This cancels any active subscription, deletes your user record and associated data from our database, and signs you out.

By request: email lemparscreations@gmail.com from the address on your account with the subject "Delete my account". We will verify the request and action it within 30 days.

Please note:

• Data stored locally on your device stays there until you clear the app's data or uninstall the app.
• Records we must keep for legal or tax reasons (see section 9) are retained for the required period and then deleted.
• Deleting your account does not automatically cancel a subscription purchased through the App Store or Google Play if it is managed there. Manage or cancel those through your Apple ID subscription settings or your Google Play subscriptions.
• Deleting your account removes the client details, crew records, site notes and photos you stored in it. Export anything you need first.
• If you own a Pro+ team, deleting your account closes your team and your crew lose access to its jobs.

11. Your rights and choices

Subject to the law that applies to you, you may ask us to:

• access the personal information we hold about you;
• correct information that is inaccurate, out of date or incomplete;
• delete your information;
• restrict or object to how we process it;
• receive a portable copy of information you gave us, in a common machine-readable format;
• withdraw consent for anything you consented to, such as location, camera, photo or notification access.

To make a request, email lemparscreations@gmail.com. We may need to verify your identity first. We will respond within 30 days, and there is no fee for a reasonable request.

If you are in the EU or UK, you also have the right to lodge a complaint with your local supervisory authority.

If you are in California, we confirm that we have not sold or shared personal information for cross-context behavioural advertising in the preceding 12 months, and we do not do so now. You have the right to know, delete, correct and opt out, and we will not discriminate against you for exercising those rights.

12. Children's privacy

BOB The Estimator is a professional tool for people working in the building and construction trades. It is not directed at children, and it is not intended for anyone under 16.

We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at lemparscreations@gmail.com and we will delete it promptly.

13. Cookies and similar technologies

The web version of BOB The Estimator uses browser storage (such as local storage and Firebase Authentication session cookies) to keep you signed in and remember your settings. These are strictly necessary for the app to function — they are not used for advertising or cross-site tracking.

Our website does not use advertising or third-party tracking cookies. You can clear or block browser storage through your browser settings, but the app will not be able to keep you signed in if you do.

14. Data breaches

We maintain procedures to detect and respond to data breaches. If a breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme, and any other regulator where required.

15. Third-party links

Our website and app may link to third-party sites and services, including the App Store, Google Play and Stripe. We are not responsible for their content or privacy practices. We encourage you to read the privacy policy of any site you visit.

16. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top and post the new version at this address. If the changes are significant, we will give you additional notice in the app or by email before they take effect.

Continuing to use the website or the app after an update means you accept the revised policy.

17. Contact us and how to complain

For any question, request or complaint about privacy:

Parsons Custom Carpentry Pty Ltd, trading as Lempars Creations
Email: lemparscreations@gmail.com
Postal: 8 Koala Ave, Badger Creek VIC 3777

We will acknowledge your complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001