Your data, handled with care

IWILLBUILD (ABN 89 791 350 823) is a construction and job-management software platform operated from Queensland, Australia (we, us or our). This Policy explains how we collect, hold, use and disclose personal information when you use the IWILLBUILD website, web portal, progressive web app, iOS or Android application, and related services (together, the Service).

We aim to follow the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, for New Zealand users where applicable, the information privacy principles in the Privacy Act 2020 (NZ).

The Terms of Use form the service contract. This Privacy Policy is a notice about information handling. Acknowledging this Policy does not waive privacy rights or create consent where the law requires a different lawful basis or express permission.

This Policy covers account holders, organisation administrators, invited workers, people whose details appear in customer records, website visitors and people who contact us.

Where you use IWILLBUILD through an employer, builder, principal or contractor, that organisation usually controls why business records are created and who may access them. IWILLBUILD processes those records to provide and secure the Service. The organisation's own privacy policy may also apply.

Third-party sites and applications linked from the Service have their own privacy practices.

• Account and organisation information — name, email, phone, role, permissions, login and security records, organisation name, ABN or NZBN, address, branding, subscription and billing records.
• Job and operations information — job names, site addresses, contacts, crew assignments, schedules, notes, forms, timesheets, estimates, invoices, SWMS, pre-starts, incident records, signatures and acknowledgements.
• Photos, videos, files and documents — camera captures, uploads, watermarks, plan documents, attachments and connected-drive files where an authorised user enables an integration.
• Fleet and location information — vehicle and plant records, maintenance, map positions, approximate location and precise GPS where a user enables a location-dependent feature.
• Technical and usage information — IP address, device and browser type, operating system, app version, cookies, session data, sign-in history, audit logs, actions, diagnostics and crash reports.
• Support and safeguard information — enquiries, support communications, scan-run metadata, approximate face-count signals, review status, reviewer identity and factual review notes.

IWILLBUILD is not a health service and does not seek sensitive information for unrelated purposes. Construction safety and incident records may nevertheless contain injury details, health information, signatures or images of people. Customers should enter such information only where reasonably necessary and lawfully authorised.

The Image Safeguard Protocol is not intended to perform biometric identification or verification and does not create face templates to identify a person. A photograph and the fact that a face may appear can still be personal information and are handled accordingly.

If you provide another person's information, including a worker, client, supplier or person shown in a photo, you must have a lawful reason and provide any notice or obtain any permission required by law.

• directly from you when you register, use a feature, upload content, enable a device permission or contact us;
• from the organisation or administrator that invites you or enters information about a job, worker, client or supplier;
• automatically from the website, apps, security systems and diagnostic tools;
• from integrations that an authorised user connects; and
• from service providers that process payments, deliver messages, host infrastructure or support the Service.

For New Zealand users, where information is collected from someone other than the individual, we and the relevant organisation will take reasonable steps to provide the notification required by IPP 3A unless an exception applies.

• create, administer and secure accounts and organisation workspaces;
• provide jobs, forms, safety records, photos, fleet, scheduling, estimating, invoicing and connected services;
• apply authorised watermarks and maintain audit histories;
• provide support, investigate faults and communicate about the Service;
• process subscriptions and maintain financial records;
• detect and respond to misuse, fraud, security incidents and privacy risks;
• operate AI-assisted features requested by authorised users;
• improve reliability and features using aggregated or de-identified information where practical; and
• comply with law and establish, exercise or defend legal rights.

We do not sell personal information or use customer job records for third-party advertising.

Job photos stored in the Service may be selected for a periodic, bounded safeguard review initiated manually by an authorised IWILLBUILD platform owner. The present safeguard may use software to detect the apparent presence of a face and record a neutral privacy signal for possible human review.

The purpose is to support privacy awareness, acceptable use and responsible investigation. It is not continuous surveillance and we do not promise that every image is assessed.

• The software does not identify a person or create an identity profile.
• It does not determine age, ethnicity, emotion, health, legality, appropriateness or criminal conduct.
• A signal may be wrong. Authorised support personnel must review context before taking any action.
• The scan does not automatically delete, quarantine or report an image, disable a user, or block ordinary capture.
• A separate acknowledgement may appear immediately before images are emailed or shared.

For a scan we may process the image temporarily, its internal asset reference, company and responsible-user identifiers where reliably known, timestamps, detector version, approximate face count, outcome and review record. Temporary working copies are deleted after processing. We retain safeguard records only as long as reasonably needed for security, accountability, dispute handling and legal obligations.

Where review identifies a credible concern, access is limited to authorised personnel. We may preserve records or disclose information where required or permitted by law, but the automated signal alone is not treated as proof and does not itself trigger a report to authorities.

Dazza AI and similar tools may help authorised users search, draft, extract, classify or summarise information. They operate within platform permissions and their output requires human review.

We do not use automated tools alone to hire, fire, discipline, approve credit, determine legal rights or make another decision that could significantly affect a person's rights or interests.

From 10 December 2026, additional Australian privacy-policy disclosures apply where a computer program uses personal information to make, or do something substantially and directly related to making, a decision reasonably expected to significantly affect a person's rights or interests. If IWILLBUILD introduces such a use, we will update this Policy and provide the required information before relying on it.

We do not use customer job photos, SWMS or field records to train public foundation models. Where a third-party AI provider delivers a feature, we seek terms that prevent it from using customer content to train its general models unless the customer has clearly agreed otherwise.

We use cookies and similar technologies for login, preferences, security and service measurement. Blocking essential cookies may prevent login or other functions. We do not currently use customer records for advertising profiles.

We may send service, security, billing and outage messages while an account is active. Promotional messages are sent only where permitted and include an unsubscribe method.

We disclose personal information only as reasonably necessary to provide the Service, at an authorised user's direction, or as required or permitted by law. Recipients may include:

• authorised users and administrators within the relevant organisation;
• hosting, cloud-storage, email, notification, diagnostics, support and security providers;
• Stripe or another payment processor;
• Xero, QuickBooks, Microsoft, Google, mapping, telematics or other integrations enabled by an authorised user;
• AI subprocessors used to deliver a requested feature under appropriate restrictions;
• professional advisers, insurers, auditors and prospective business purchasers subject to confidentiality; and
• courts, regulators, police or other authorities where disclosure is required or permitted by law.

We do not disclose personal information to unrelated third parties for their advertising.

Some providers may store or access information outside Australia or New Zealand, including in the United States and other locations used by major cloud, accounting, mapping, app-store and AI providers. The exact locations can change with provider infrastructure and the features a customer enables.

For Australian information, we take reasonable steps required by APP 8 where it applies. For New Zealand information, we assess IPP 12 and seek comparable safeguards, use an eligible processing arrangement, or obtain informed authorisation where required. Measures may include provider due diligence, contractual protections, encryption, access restrictions and data minimisation.

• encrypted connections for web and app traffic;
• password and PIN hashing rather than plain-text storage;
• role-based and organisation-isolated access controls;
• restricted administrative and support access;
• session controls, rate limits, audit and sign-in records;
• upload validation and bounded handling of untrusted files;
• least-privilege access to cloud storage;
• security review, patching, testing and incident procedures; and
• backups and recovery measures appropriate to the Service and business risk.

No online service is completely secure. Users should use strong unique credentials, secure their devices and promptly report suspected unauthorised access to [email protected].

Users can generally update their own profile. Organisation records are managed by authorised organisation users. You may request access to or correction of personal information we hold by emailing [email protected]. We will verify identity and respond within a reasonable period and any applicable statutory timeframe.

Access may be limited where the law permits, including where disclosure would unreasonably affect another person's privacy. If we refuse a request, we will explain the reason unless prohibited from doing so.

We retain personal information for as long as reasonably needed to provide and secure the Service, meet contractual and legal obligations, resolve disputes and maintain appropriate audit records.

Construction, safety, financial and insurance records may need to be retained for years. Each subscribing organisation is responsible for selecting lawful retention periods for its records. After cancellation, we may provide a reasonable export or recovery period before deletion or de-identification, subject to legal holds, financial records, security evidence and backup cycles.

When information is no longer required, we take reasonable steps to delete or permanently de-identify it.

The Service is designed for construction organisations and is not directed to children. We do not knowingly allow a child under 16 to create an independent account. An organisation may hold lawful work, safety or contact records concerning a young worker or another child, but it must use appropriate authority, notice, permissions and safeguards.

If you believe information about a child has been included inappropriately, contact us promptly so the organisation and IWILLBUILD can assess and restrict or remove it where appropriate.

We maintain procedures for assessing and responding to suspected privacy and security incidents. Where a breach is likely to cause serious harm and notification is legally required, we will notify affected people and the relevant regulator, including the OAIC in Australia or the Office of the Privacy Commissioner in New Zealand. New Zealand notifications are made as soon as practicable; regulator guidance identifies 72 hours as the expected timeframe for serious breaches.

1. Contact [email protected] with the issue and the outcome you seek. We will investigate and respond within 30 days.
2. If you are in Australia and remain dissatisfied, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au or 1300 363 992.
3. If you are in New Zealand and remain dissatisfied, you may contact the Office of the Privacy Commissioner at www.privacy.org.nz or 0800 803 909.

We may update this Policy when the Service, law or providers change. We will identify the version and effective date at the top of this page. Material changes will be notified by email or in-product notice where appropriate, and renewed acknowledgement will be requested where the nature of the change makes that appropriate.

IWILLBUILD
Queensland, Australia
ABN 89 791 350 823
[email protected]
www.iwillbuild.com

We may need to verify identity before discussing or releasing personal information.