1. About This Policy

ServHQ ("we", "us", "our") is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what information we collect, how we use it, and your rights regarding that information.

This policy applies to all users of the ServHQ platform, including businesses (Job Posters) and independent contractors (Workers).

2. Information We Collect

We collect information you provide when using ServHQ, including:

All users:

• Name, email address, and phone number
• Account credentials (passwords are hashed and never stored in plain text)
• Messages sent through the Platform

Businesses (Job Posters):

• Business name, ABN, and contact details
• Job postings (role type, location, dates, hourly rates)
• Membership subscription details
• Payment card details for membership (collected and stored securely by Stripe — ServHQ does not store card numbers)

Workers:

• Display name, ABN, and contact details
• White card number (if provided)
• Location and travel distance preferences
• Job acceptance history

Community (Smoko Room) users:

• Display name and email address
• Posts, comments, and messages in the Smoko Room and AI character rooms
• Conversations with AI characters (used to generate responses, not stored permanently)

Authentication via Google:

• If you sign up via Google OAuth, we receive your name, email address, and profile picture from Google. We do not access your Google contacts, files, or any other Google data.

We also collect limited technical data such as your IP address (used only for security and rate limiting), browser type, and device information.

3. How We Use Your Information

Your information is used to:

• Arrange and coordinate the services you request
• Facilitate job posting, acceptance, and matching between businesses and workers
• Process payments between Job Posters and Workers via Stripe
• Contact you regarding your bookings, jobs, and account
• Provide accurate quotes based on your property or job details
• Maintain your account, service history, and job history
• Track accountability (cancellation and no-show marks)
• Improve our platform and AI assistant
• Comply with legal obligations

We do not use your information for third-party marketing or sell your data to any third party.

4. Who We Share Information With

We may share your information with:

• Service providers and workers — Providers or Workers assigned to your job receive only the details needed to perform the service (e.g. name, location, job description). They do not receive your full profile, payment details, or account information.
• Job Posters — When a Worker applies to a job, the Job Poster can see the Worker's display name, rating, job completion count, location, and bio. They do not see the Worker's ABN, bank details, or personal contact information outside of in-platform messaging.
• Stripe — Our payment processor for membership subscriptions and acceptance fees. Stripe securely collects and stores payment card details under their own privacy policy. ServHQ does not store, access, or transmit card numbers. ServHQ does not process payments between Job Posters and Workers. Stripe's privacy policy is available at stripe.com/au/privacy.
• Supabase — Our database and authentication provider. All data is stored securely using Supabase infrastructure with encryption at rest and in transit.
• Anthropic (Claude AI) — Our AI characters and the ServHQ AI assistant use Anthropic's Claude API to generate responses. To personalise answers, we send Claude the content of each prompt — which can include your profile (goals, weight, preferences), calendar events, notes, contacts, shopping list, meal plan, message body, and Gmail subject + snippet when you've connected Gmail. Anthropic processes this data in the United States and retains it for up to 30 days for abuse monitoring before deleting. Anthropic does not use this data to train their models. If you want to use ServHQ AI without this processing, don't connect Gmail / Google Calendar and don't use the voice or chat features. Anthropic's privacy policy: anthropic.com/privacy.
• ElevenLabs — Text you send to the voice assistant is rendered to audio via ElevenLabs. Voice recordings (when you speak to the app) are transcribed via OpenAI Whisper and ElevenLabs Scribe. Audio blobs are not retained by us after transcription; retention at ElevenLabs / OpenAI follows their own policies.
• TikTok — We use TikTok's Pixel and Events API to measure ad performance. When you grant tracking consent, a hashed version of your email + a pseudonymous user ID is sent to TikTok. TikTok's privacy policy: tiktok.com/legal/privacy-policy.
• Meta (Facebook / Instagram) — We use Meta's Pixel for ad measurement. Gated behind consent; fires only after you accept tracking.
• Google (Analytics, Calendar, Gmail) — Google Analytics records aggregated usage (gated behind consent). If you opt in to Calendar / Gmail integration, we store a Google refresh token and fetch events / email summaries via the Google APIs; you can disconnect in the Account tab at any time.
• Microsoft (Clarity) — Session replay and heatmaps, gated behind consent. Clarity can capture keystrokes and on-screen content; we do not load the Clarity script at all unless you've accepted tracking.
• Telstra — We use Telstra's Messaging API to send SMS notifications and marketing messages. Your phone number is shared with Telstra for message delivery. Telstra's privacy statement is available at telstra.com.au/privacy.
• Email provider — We use a third-party email service to send booking confirmations, notifications, and account-related emails.

We do not sell your personal information to any third party.

5. Payment Data

ServHQ uses Stripe to process membership subscriptions and acceptance fees. This means:

• Credit and debit card details are collected directly by Stripe and never touch ServHQ servers.
• ServHQ does not process payments between Job Posters and Workers. Payment for work is arranged directly between the parties.
• ServHQ stores only Stripe reference IDs (e.g. customer IDs) for subscription tracking. These IDs cannot be used to retrieve card numbers.
• Stripe is PCI DSS Level 1 compliant, the highest level of payment security certification.

6. Data Storage and Security

Your data is stored securely using Supabase infrastructure with servers in Australia. We implement industry-standard security measures including encrypted connections (HTTPS), JWT-based authentication, row-level security policies, and role-based access controls. While we take every reasonable precaution, no system is 100% secure and we cannot guarantee absolute security.

7. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your account and associated data
• Opt out of any non-essential communications
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at info@servhq.com.au. We will respond to your request within 30 days.

8. Data Retention

We retain your personal information for as long as your account is active or as needed to provide services. If you request account deletion, we will delete your personal data within 30 days, except where we are required by law to retain certain records (e.g. payment transaction records for tax purposes, which are retained for 7 years as required by Australian tax law).

9. Cookies, Tracking and Analytics

We use session storage and local storage to remember your preferences and chat history within the Platform. We also use the following analytics and tracking services:

• Google Analytics — Collects anonymous usage data such as pages viewed, time on site, and traffic sources. Google's privacy policy applies.
• Microsoft Clarity — Records anonymous session replays and heatmaps to help us understand how users interact with the Platform. Clarity does not collect personal information. Microsoft's privacy statement applies.
• Meta Pixel — Tracks page visits and events for advertising measurement. If you have a Facebook account, Meta may associate this data with your profile. Meta's privacy policy applies.

We use UTM parameters in URLs to track which marketing campaigns drive signups. This data is stored with your account for internal analytics only.

10. SMS and Marketing Communications

ServHQ may send SMS messages to your mobile phone number for the following purposes:

• Notifications about jobs, applications, and group activity
• Marketing and promotional messages about the ServHQ platform
• AI character interactions and community updates

Every marketing SMS includes an unsubscribe link. You can opt out at any time by visiting servhq.com.au/unsubscribe and entering your phone number. Once unsubscribed, you will not receive further marketing messages from us. Transactional messages related to your account (e.g. job acceptance confirmations) may still be sent.

SMS messages are delivered via Telstra's Messaging API. Your phone number is shared with Telstra solely for message delivery purposes.

11. AI-Generated Content

ServHQ features AI characters (including Smoko Bot, Einstein, Murray, Robbie, and Headline Heather) powered by Anthropic's Claude AI. When you interact with these characters:

• Your messages are sent to Anthropic's API for processing to generate responses
• AI responses are generated content and should not be relied upon as professional advice (medical, legal, financial, or otherwise)
• Conversations with AI characters are not stored permanently by Anthropic
• 1-on-1 chat history is stored locally in your browser and is not accessible to other users
• Posts and comments in public rooms are visible to all users

12. Data Breach Notification

In the event of a data breach that is likely to result in serious harm to affected individuals, we will notify the Office of the Australian Information Commissioner (OAIC) and affected users as soon as practicable, in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988. Notification will include the nature of the breach, the types of information involved, and recommended steps you can take to protect yourself.

13. Complaints

If you believe we have breached the Australian Privacy Principles, please contact us first at info@servhq.com.au. If we cannot resolve your complaint, you may contact the Office of the Australian Information Commissioner (OAIC).

14. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of ServHQ after changes constitutes acceptance of the updated policy.

15. Contact Us

For any privacy-related questions, contact us at:
info@servhq.com.au
ServHQ — servhq.com.au