Privacy Policy

Last updated: 2 July 2026 · Effective immediately

1. Who We Are

Toolbelt is operated in Australia and is bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). For all privacy enquiries contact us at support@usetoolbelt.app.

2. What We Collect

Account information

• —Email address — for login, account recovery, and service notifications
• —Business name, ABN, and phone number — entered voluntarily in Settings
• —Subscription plan and billing status

Business data you create

• —Client names, email addresses, phone numbers, and addresses
• —Job descriptions, hours worked, and materials used
• —Invoice amounts, GST, payment status, due dates, and invoice numbers
• —Notes attached to clients or jobs

Voice, text, and AI processing data

• —Audio recordings — transmitted to OpenAI's Whisper API for transcription; not retained by Toolbelt after processing
• —Text transcripts and typed job descriptions — processed by OpenAI's GPT-4o language model to extract invoice details (client name, hours, materials, amounts); under OpenAI's API policy this data is not used to train their models. This applies to all users, including those who use the "type instead" mode — typed descriptions are sent to OpenAI even when no audio is recorded.
• —Parsed invoice data — retained in your account

Usage and technical data

• —Which screens you visit and actions you take — for debugging and improvement
• —Device type, browser, and OS — collected via the in-app feedback feature
• —Error logs submitted through the feedback tool
• —IP address — collected by hosting infrastructure via standard server logs

3. How We Use Your Data

We use your information to provide and operate the Service, generate invoices and GST summaries based on your input, send transactional emails on your behalf (invoices, payment reminders, BAS summaries), diagnose bugs, improve the app, send account notices, and process payments via Stripe.

We do not use your data for advertising, behavioural profiling, or any purpose unrelated to the Service.

4. Who We Share Data With

We share data with third-party service providers only as necessary to deliver the Service. We do not sell, rent, or trade your personal information.

Supabase

All account and business data is stored in a Supabase database in the Sydney (AWS ap-southeast-2) region. ISO 27001 certified. Row-level security ensures users can only access their own data.

OpenAI (Whisper + GPT-4o)

Audio recordings are transmitted to OpenAI's Whisper API for transcription. The resulting transcript — or typed job description if you use the "type instead" mode — is then sent to OpenAI's GPT-4o language model to extract structured invoice details. Under OpenAI's API data usage policy, data submitted via the API is not used to train OpenAI models. This applies to all users regardless of whether they use voice or text input.

Stripe

Payment transactions are processed directly by Stripe. Toolbelt does not see or store card details at any point. Stripe is PCI DSS Level 1 certified.

Vercel

The application is hosted on Vercel infrastructure in the Sydney region. Vercel processes standard web request logs including IP addresses.

Google (Gmail SMTP)

Transactional emails are sent via Gmail SMTP. Recipient addresses and email content are transmitted through Google's servers and are subject to Google's privacy policy.

5. Data Storage and Security

Your data is stored in Australia (Sydney region). We use HTTPS/TLS for all data in transit, AES-256 encryption at rest, row-level database security, and environment-variable storage for all API credentials. If you discover a security issue, contact support@usetoolbelt.app immediately.

6. Data Retention

• —Active accounts: data retained while your account is active
• —Voice recordings: not retained by Toolbelt after the transcription session completes
• —Deleted accounts: all personal data permanently deleted within 30 days of account closure
• —Legal holds: data may be retained longer where required by applicable law

7. Your Privacy Rights

Under the Australian Privacy Principles, you have the right to access, correct, and request deletion of your personal information. Email support@usetoolbelt.app — we respond within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

8. Cookies and Analytics

Toolbelt uses authentication session cookies managed by Supabase Auth to keep you logged in. We do not use third-party analytics services, advertising cookies, behavioural tracking cookies, or any cookies designed to profile you across sites. We collect first-party usage data (screens visited, actions taken — disclosed in Section 2) for internal debugging and improvement only. No cookie consent banner is required as we use only strictly necessary cookies.

9. Children's Privacy

Toolbelt is not intended for anyone under 18. We do not knowingly collect information from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

10. Cross-Border Data Transfers

Your data is primarily stored in Australia. Voice recordings and typed job descriptions are processed by OpenAI (US — for transcription and invoice parsing via GPT-4o), and emails are delivered via Google (US). By using these features, you consent to these transfers. Both providers implement adequate data protection measures and do not use API-submitted data to train their models.

11. Changes to This Policy

We will notify you by email at least 14 days before any material changes take effect. The current version of this policy is always accessible within the app.