Privacy Policy

Effective date: 1 November 2026 · Last updated: 1 November 2026

Pool Pre Cert (PoolPreCert) · ABN 22 916 588 904 · registered for GST · support@poolprecert.com

What changed on 1 November 2026: we described the button clicks and other events our analytics counts on public pages, that the page and button you started from are kept with your account, and the “Not now” choice on the bar shown on business pages (sections 2 and 25).

What changed on 31 October 2026: we now call the business scheduling tool the Schedule; we described repeating jobs (the repeat pattern we keep, the optional reminders and the single set-up email a business can choose to send, and the planned dates in a business's calendar link) in sections 2, 15 and 20; and we described the cookie notice on our public pages, your choice about Google Analytics cookies and how to change it, in section 25.

What changed on 22 October 2026: we added how gate videos can be recorded in the app (section 2), that our notes about phone calls we make to listed businesses and a “do not call” mark are kept with the listing (section 14), that researched listing details can come from any public page the business publishes (sections 3 and 14), that only Xero can be connected today (sections 10 and 15), and the retention row for call notes (section 20), and that some pool fence contractor and pool builder claims are now approved by a program against our nightly copy of QBCC's licensed contractors register file (sections 13 and 14). Later the same day we added two more automated tools to section 13 (the nightly register re-check that hides a contractor listing the file shows as suspended or cancelled, and the program that applies plan limits when a trial ends or a payment stays unpaid), our reply times when you ask a person to look again, and made section 1 clearer that PoolPreCert is the trading style of the registered business name Pool Pre Cert. We then added the “Ask a business to contact me” option for homeowners (sections 2, 7A, 13, 16 and 20): what we collect, how a waiting request is held and later shared with the business, and the 60-day deletion. We also added links, QR codes and buttons on a business's website (sections 2, 7B, 13 and 20). We also added the one email we send after a business agrees to it on the phone (sections 14 and 20).

Earlier changes: on 17 October 2026 we made this policy match what PoolPreCert actually does (the AI assistant and spreadsheet column matching, the emails we send for businesses, booking pages and private links, what businesses can store about their customers, what is kept on your device, error records, demo accounts, the Queensland open-data property lookup, retention periods, the automated tools we use, our email provider's region, backups, Google Analytics and the unsubscribe list). First published 8 October 2026.

1. Purpose and scope

This Privacy Policy explains how PoolPreCert (the trading style of Pool Pre Cert, a registered Australian business name operated under ABN 22 916 588 904) collects, holds, uses and discloses personal information when you use PoolPreCert. We aim to manage personal information openly and responsibly and, where the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs) apply to us, we will comply with those requirements.

PoolPreCert also aims to apply APP-aligned privacy practices more broadly, even where a particular Privacy Act obligation may not legally apply because of an exemption.

2. What we collect

From everyone who uses PoolPreCert

• Account information: name, email address, phone number, login identifiers and account preferences.
• Property information: property address, pool/barrier information, inspection-related details, notes, photographs, videos and reports.
• Certificate records you choose to enter: issue and expiry dates and, optionally, certificate number and inspector name.
• Professional information: where relevant, licence information, business details, service areas and profile information.
• Transaction information: subscription, invoice and payment-related information. Payment card details are handled by our payment provider (Stripe) rather than stored by PoolPreCert.
• Technical information: IP address, device/browser information, logs, identifiers, security events and usage information. When something goes wrong in the app or website we keep a technical error record: the page, the time, the app version, a short error message and the top of the error trace, with email addresses, phone numbers, tokens, street addresses and similar details removed before it is saved, and a reference to the account or business affected. We keep error records for 2 years. The removal of personal details is automatic, so it is a safeguard, not a guarantee.
• If you ask a business to contact you before it has joined: your name, contact details, suburb, the note you write, what you need and the agreement you ticked (section 7A).
• If you arrive through a link, QR code or button on a business's website, which business's link you used (section 7B). We do not record which website you came from beyond that, we do not put anything in a cookie for this, and we do not tell the business who you are unless you choose to send them your result.
• Communications: enquiries, support requests, feedback, reviews and correspondence.
• Website visits: on our public website pages and the sign-up page (never inside the signed-in app or on the sign-in page) we use Google Analytics to count visits and see which pages and campaigns bring in sign-ups. It receives the page you viewed (with private link codes removed), the page title, any campaign tags in the link, your device and browser type and your approximate location worked out from your IP address. If you have accepted analytics cookies it also receives events: which button you clicked (the page, the kind of button and its position, the audience the page is written for and the page it leads to), that you started or finished the certificate checker (never your answers), and how many results a search on a claim page returned. See section 25.
• Where you came from: if you arrive through a campaign link, the campaign tags in the link (source, medium, campaign name) are kept for your browser tab and stored with your account when you sign up, so we can see which links bring in sign-ups. The page and button you used to start signing up are kept with your account in the same way, and a new homeowner's first property form starts with a note saying where they came from, which they can delete. We use these only for our own counts of which pages lead to sign-ups, and we hide any count under five. We do not store the rest of the web address.
• AI inputs and outputs: images, text, measurements, property and customer details and results submitted to or generated by AI-assisted features (see section 8).
• Videos: inspectors can attach short gate videos (up to 60 seconds and 50 MB) to an inspection record, either by choosing a file or by recording in the app, which asks your browser for camera (and, if you allow it, microphone) access only while you record. Large files are made smaller on your device before upload. Videos are stored privately with the record. If an upload fails we keep a technical error record of the stage it failed at, never the file or its name. Please keep other people's faces and voices out of videos.
• “See it in your yard” pictures: if you use it, we keep the picture you upload and which fence, gate or pool it shows for 30 days. If you choose to send it with a quote request, the business can see it while that request is live. We remove location data from the picture. You can delete it at any time, and it is deleted with your account.
• “Missing from the directory?” form: if you ask to be added to our directory we keep your business name, licence number, suburb and email so we can check your licence on QBCC's search and reply. Only our administrators can see them. We delete these requests automatically 12 months after we receive them, and you can ask us to delete yours sooner at any time.
• Demo accounts: if you press “Try the demo” we create a temporary demo account filled with made-up example data. We don't ask for your name or email address. We keep a scrambled, one-way version of your internet address (it can't be turned back into the address) for up to 7 days so we can limit how many demos one visitor starts. The demo account and everything in it are deleted automatically, usually within 24 to 48 hours (about 7 to 8 days for a demo opened from a personal invitation). The demo uses the same sign-in cookie as the rest of the site and never sends email. If you use “Send feedback” in a demo opened from an invitation, we email the text you type, the type of demo and the page you were on to our support address, without your name or email address. An invitation stores only a one-way hash of its link and the short note an administrator typed (for example a first name), which we delete about a month after the invitation stops being needed.

From businesses that use PoolPreCert, about their own customers and others

A business account (an inspector, pool fence contractor, pool builder, or a real estate agency or property manager) can store information about other people. We hold it for the business as part of providing the service (see section 15):

• Customer records: name, email, phone, suburb, notes and tags, and the properties linked to them, including street addresses and any access notes the business types.
• Jobs and Schedule entries: customer, property, time, type, notes, costs and prices, job photos and checklists; repeat patterns (how often a job repeats and the dates skipped); staff working hours and days off.
• Inspection records: checklist answers, measurements, notes, photos, videos, a sketch of the barrier layout, persons present, a dated log of advice given, and generated reports.
• Quotes and invoices, a price list (item names, the business's own costs and markups), saved items, message templates and quote-approved records (see section 15).
• Smoke alarm test dates for properties, for agencies and property managers who use that feature.
• Agency uploads: property addresses, whether there is a pool, certificate dates, and the name and work email of the agency's own property manager. We ask agencies not to upload owner or tenant names, phone numbers or emails, and we ignore columns that look like them.
• Booking requests made through a business's booking page (see section 15).

3. Sensitive or unnecessary information

Please do not upload sensitive personal information unless it is genuinely necessary and the Platform specifically requests it. Avoid images containing children, unrelated people, identity documents, medical information, passwords, access credentials, security codes or vehicle registration plates.

4. How we collect information

• Directly from you when you create an account, complete a property record, upload content, request a report, contact us or purchase a service.
• Automatically through the Platform and security/technical systems.
• From a business that enters or imports details about its customers, tenants, owners, property managers or staff (see section 15).
• From professional profiles, reviews or information you choose to make public.
• From service providers that support authentication, payments, communications, hosting or other Platform functions.
• From public sources for the directory and for property lookups, as described in section 14 and section 10.
• From third parties where reasonably necessary to provide a requested service or comply with law.

5. Why we use personal information

• To create and administer accounts.
• To provide self-checks, reports, AI-assisted analysis, certificate reminders and requested features.
• To communicate with users and provide support, and to send emails for businesses as described in section 15.
• To process subscriptions and payments.
• To maintain security, detect fraud, prevent abuse and troubleshoot problems.
• To operate, maintain and improve the Platform.
• To administer professional directory profiles, inspection requests and reviews.
• To comply with legal obligations and respond to lawful requests.
• To send marketing where permitted and where required consent has been obtained.

6. APP 6: use and disclosure

Where the APPs apply, we will use and disclose personal information consistently with the purpose for which it was collected, your reasonable expectations and applicable exceptions. Where consent is required, we will seek it in an appropriate manner. Optional marketing consent will be kept distinct from acceptance of these Terms where practicable.

7. Inspection requests

• When you ask a licensed inspector for an inspection, we send your name, contact details and property suburb to that inspector only. We keep the exact consent wording you were shown with each request.
• Your self-check report is shared only if you tick the box to share it. The inspector can open it from their PoolPreCert account while your request is active; if you withdraw the request, they can no longer open it.
• Inspectors who receive requests through PoolPreCert pay us a monthly membership fee (there are no per-request fees). We don't sell your details to anyone.
• When the inspector marks your inspection as done (or, if that does not happen, 14 days after the inspection is booked), we send you one email inviting you to review the inspector. If you have not reviewed after 5 days we send one reminder, and then nothing more. The email is sent to the address on your request and used for nothing else. Reviews are optional (see section 17). Each of these emails says it was sent by PoolPreCert for the business and has a one-click unsubscribe link (see section 15).
• If the inspector uses “Save as customer”, your name, phone, email and suburb from the request are copied into the inspector's own customer records, which the inspector then holds as its own record (see section 15). Withdrawing a request removes it from the inspector, but does not remove a customer record the inspector has already saved.

7A. Asking a business to contact you before it has joined

• On a listing you can choose “Ask [business] to contact me” when the business has not claimed its listing, or has claimed it but its trial or plan does not yet include requests. You need a PoolPreCert account and must tick a box agreeing that we may pass your details to that business if it joins PoolPreCert within 60 days. You can withdraw that agreement at any time.
• We collect your name, a phone number or email address, your suburb (and postcode if you give one), the short note you write and, for a pool fence contractor or pool builder, what you need. We keep the exact wording you ticked.
• We do not send your request or your details to the business when you make it. It waits in our database, and only you and PoolPreCert administrators can open it. Before the business can see requests, it is told only how many homeowners are waiting near the councils it covers. It is not told your name, contact details, note or suburb. PoolPreCert administrators can see the number waiting for each business and the suburb and date of each request, to decide whether to phone the business, and cannot see your name or contact details on that screen. We do not email the business about waiting requests.
• If the business claims its listing and its trial or plan includes requests within 60 days, we share your name, contact details, suburb and note with that business only, as an ordinary request, and we email you to tell you. After that, section 7 applies to your request (including that the business may save you as a customer and then holds that record as its own, section 15).
• You can withdraw a waiting request at any time from Your requests; it is deleted at once. A request that has not been shared with the business is deleted automatically after 60 days. We do not use waiting requests for marketing.
• We do not promise that a business will join or reply.

7B. Links from a business's website

• A business that has a plan or trial that includes requests can show you a link, QR code or button to our self-check. When you use it we count the visit for that business (a number only) and, if you make an account, we link your account to that business so that, if you choose, you can send your result to it.
• The business can see counts of visits, accounts started, checks finished, results sent and bookings. It cannot see who you are unless you tick the box to send your result and press send, and then section 7 applies. You can ignore the business and choose another inspector at any time.
• The business's website may use code supplied by us. That code does not set cookies or collect anything from your visit to the business's page. When your browser loads it from our server, our server and our host can see your device's address and the page you were on, as with any file loaded from another server (see section 11 and the providers table).

8. AI processing

Some PoolPreCert features use a third-party AI service (Anthropic). The information sent depends on the feature you use. AI processing is used to provide the requested functionality and not as a substitute for a licensed professional inspection.

• AI photo check. When you ask for a photo check, we send the photo, the checklist question, the barrier type and the description you gave for the photo. We do not send your name or address. Results are stored with the inspection.
• AI assistant (paid business accounts). What you type, your earlier messages in that chat, and the customer and property details it looks up to answer you (such as a customer's name and suburb, whether an email exists, and a property's address) are sent to Anthropic. It cannot send, change or delete anything: a draft quote or invoice is created only when you press Confirm. We keep the messages it sends and receives, and any draft, for 30 days after the last message; only the person who sent them can see them, and they can delete them at any time. We also keep a record, without the message text, of when the assistant was used (who, when and how much), so we can apply fair-use limits. That usage record is kept while the account exists.
• Spreadsheet column matching (agencies). Only if an agency presses the button, we send the column headings and up to three sample rows to Anthropic to suggest which column holds the address, dates and so on. Before sending, we blank personal columns (such as names, owners, tenants, contacts, emails, phone numbers and notes) and remove any email address or phone number found in the remaining cells. The sample values that remain are property addresses and certificate dates. We keep only a note that an import used the AI help.
• “See it in your yard”. We do not send your yard photo to any AI provider. You make the illustration in the AI assistant you choose (such as ChatGPT, Gemini or Claude), under that provider's terms, and upload the result to us.

Before you run an AI photo check, PoolPreCert shows a collection notice explaining that the photo is sent to an AI provider that may process it outside Australia, the purpose of the analysis, and a link to this policy, and asks you to leave out people, children, vehicle registration plates, documents and security information. The spreadsheet matching button shows a notice of what is sent, and the AI assistant tells you it can make mistakes and cannot decide whether a pool meets the standard.

Where an AI provider offers controls restricting the use of submitted content for general-purpose model training, PoolPreCert configures those controls in accordance with its stated privacy practices. Under the commercial terms we use, Anthropic does not use content sent through our integration to train its models. PoolPreCert does not intentionally enable general-purpose model training on information or content submitted through PoolPreCert. PoolPreCert keeps an internal record of the AI provider, product, applicable data-use terms and relevant configuration.

9. Overseas processing and APP 8

PoolPreCert uses third-party technology providers that may receive, access, store or otherwise process personal information outside Australia. Where the Privacy Act and APPs apply, PoolPreCert will take reasonable steps under APP 8 before disclosing personal information to an overseas recipient, unless an applicable APP 8 exception applies.

PoolPreCert does not intend to rely on overseas consent as its general method of satisfying APP 8. Instead, our intended compliance approach is to assess providers, use appropriate contractual protections, limit the information disclosed, apply technical and organisational safeguards, and monitor material provider/subprocessor changes.

Likely jurisdictions depend on the service, technical architecture, provider and subprocessors. Depending on the relevant feature, information may be processed in Australia, the United States, Japan, United Kingdom, Canada, Ireland, Switzerland, France, Germany, South Korea, and other jurisdictions in which our providers or their subprocessors operate.

10. Key technology providers

The above is a high-level disclosure and not a promise that every provider receives every category of information. PoolPreCert maintains an internal provider register identifying the actual data flow, purpose, provider, country, contractual safeguards and retention period, and updates this policy where material changes make the published information inaccurate.

11. APP 8 contractual and operational safeguards

Where APP 8 applies, PoolPreCert will take reasonable steps appropriate to the circumstances, including using appropriate data-processing or privacy terms, confidentiality obligations, security requirements, purpose limitation, restrictions on onward disclosure, subprocessor controls, incident notification requirements, deletion or return provisions, complaint cooperation and reasonable monitoring of compliance.

12. APP 1 transparency

We will maintain this policy in a clear and accessible form and review it when our information-handling practices materially change. We will identify likely overseas disclosures and relevant countries where practicable.

13. Automated tools we use

PoolPreCert uses a small number of computer programs. None of them issues a pool safety certificate or decides whether a pool complies with the pool safety standard. A licensed pool safety inspector decides that. From 10 December 2026 the Privacy Act (APP 1.7 to 1.9) requires us to describe programs that make, or do a thing substantially and directly related to making, decisions that could significantly affect someone's rights or interests using their personal information. We describe them here:

• AI photo check. When you ask for one, we send your photo and the checklist question to an AI service (Anthropic). It describes hazards it can see and how sure it is. The result is advice only: you, or the inspector using the tool, accept, change or dismiss each finding. Personal information used: the photo and the checklist context (no name or contact details).
• AI assistant and spreadsheet column matching. These suggest answers, draft quotes and invoices, or suggest column matches. They cannot create, send or change anything on their own; a person confirms every step. Personal information used: as described in section 8.
• Directory order. Inspectors in a suburb or council area are ordered by a score made up of distance (45%), verified PoolPreCert reviews (35%) and how complete the profile is (20%: whether the listing is claimed, whether the licence was checked recently, and whether it has a phone or website). Payment never changes this order. Sponsored listings, if any, are shown separately and labelled. Personal information used: the inspector's name, licence details, suburb or service area, and reviews. A listing can be corrected or hidden on request through our contact form.
• Claim checks (a decision made by a program). When a pool fence contractor or pool builder asks to claim its directory listing, a program decides whether to approve the claim without a person: it approves only if the licence number is in our nightly copy of QBCC's licensed contractors register file in a class that covers the trade and is not listed as suspended or cancelled this financial year, the business name matches the licensee name on the register, the claimant's email address is verified and the file copy is under 3 days old. Approval gives the business control of its public listing and lets it receive quote requests, so this is a decision that can significantly affect a licensee (many are sole traders). Personal information used: the licence number, licensee name, licence class and status from QBCC's public register file, and the claimant's verified email address and the business name they typed. If the program does not approve, nothing is refused: the claim waits for a person, who checks the licence on QBCC's public search. Pool safety inspector claims are always checked by a person. For a personal claim link, the signed-in email address must also match the email we hold for that listing. An administrator can reverse an automatic approval, and you can ask a person to look at any claim by emailing support@poolprecert.com.
• Register re-check (a decision made by a program). Every night a program compares each pool fence contractor and pool builder listing with our copy of QBCC's licensed contractors register file. If the file lists the licence as suspended or cancelled this financial year, the program hides the listing from public pages without a person, until an administrator re-checks the licence on QBCC's own search and shows it again. Nothing is deleted. Personal information used: the licence number, and the licensee name, class and status from QBCC's public file. If your listing has been hidden and you believe the register is wrong or the suspension has ended, email support@poolprecert.com and a person will check.
• Plan and payment status. When a 14-day trial ends without a subscription, or a payment has failed and is still unpaid after our reminders and the payment provider's retries, a program applies the plan's limits (paid features are restricted; your records are not deleted). A person does not review each case. Personal information used: your account, plan and billing status from our payment provider. Our Subscription, Cancellation & Refund Policy explains the notices we send first; contact us if you think a limit was applied in error.
• Website button controls. A program may pause a business's Website button link if it opens from websites the business did not list or is used in a way that looks like misuse, and a program limits the number of AI photo checks that people arriving through one business's link can use in a month. These decisions use the business's account details and the link's use counts, not your personal information as a homeowner, except that your AI photo checks count towards the limit for the link you arrived through. If the limit is reached you can still finish your checklist without the AI photo check. A person at PoolPreCert can look again at any case if you email support@poolprecert.com.
• Passing on waiting requests. When a business that you asked to contact you claims its listing and its trial or plan includes requests, a program moves your waiting request into that business's inbox and emails you to say so, without a person deciding each time. It uses the information you gave in the request. It does not decide anything about your rights beyond sharing your request as you agreed. You can withdraw the request at any time, and a person at PoolPreCert can look again at any case if you email support@poolprecert.com.
• Request limits and duplicate flags. To prevent abuse, we limit how many inspection requests one account can send in a day and flag a request that repeats an earlier one to the same inspector. A flagged request is still delivered with a note; contact us if something was blocked. Personal information used: your account, the property suburb and request time.
• Review rules. A review is published straight away. It is hidden only if it breaks the published review rules, and a person records the reason. Personal information used: the review text, first name and suburb.
• Bot protection. To protect the directory, sign-in and forms from automated copying and abuse, we may slow down or refuse requests that look automated, using a one-way scrambled version of the network address (see section 25).

You can ask a person at PoolPreCert to look again at any of these by emailing support@poolprecert.com; we acknowledge within 2 business days and reply within 7 days. Unless expressly stated otherwise, AI output is advisory. A human user or appropriately qualified professional remains responsible for the ultimate decision.

14. Directory profiles

Directory listings are built from QBCC's public pool safety inspector register (CC BY 4.0) and details inspectors add when they claim their listing. For some inspectors, contractors and builders who haven't claimed their listing, we add business contact details they publish themselves (business name, business phone, website, a short description and the areas they advertise), collected by hand from a public page the business publishes (its own website, the ABN register or its own business listing, never a search-engine page), and we record where and when we found them. These listings are labelled as not yet confirmed by the business, with the date we checked them, and we correct or remove them on request. A business email found this way is kept privately for contacting the business and is never published. The phone number of a listing that has not been claimed is shown only when a visitor presses “Show phone number”, up to a limited number of times a day.

Calls to listed businesses. PoolPreCert may phone a listed business about its listing. We keep a note with the listing of when we called, the outcome (for example no answer, interested, not interested, wrong number), a callback date and short notes, visible only to our administrators. If a business asks not to be called, we mark the listing “do not call”, stop calling, and add any email address we hold for it to our unsubscribe list (section 15) so we do not email it either. A business can ask for this at any time by phone or by emailing support@poolprecert.com.

One email after a call. If you agree on the phone, we send you one email with your claim link and keep a record of the call, the number we called, who agreed and when. The email says where your listing details came from (QBCC's public register file) and has an unsubscribe link; replying STOP also works. We send nothing more unless you agree again in a new call.

Private phone numbers. Sometimes we find a phone number for a business on a public web page but are not sure it belongs to that business (for a sole trader it may be a mobile number). We keep that number privately with the listing, with the page and date we found it, visible only to our administrators. We never show it on the website. We use it only to phone the business about its listing, and we check mobile numbers against the Do Not Call Register before ringing. A business can ask us to remove its number or mark it “do not call” by emailing support@poolprecert.com. The number is deleted when the listing is removed.

If you create or claim a professional directory profile, information intended for public display may be visible to other users or members of the public. Do not include personal information you do not want published. We never publish an inspector's email or street address unless they choose to show it. Inspectors who have claimed their listing can edit or hide it themselves; anyone can ask us to correct or hide a listing through our contact form.

To show inspectors how many homeowners are interested in them, we count profile views and contact taps per listing. We keep counts only, never who viewed; your IP address is used briefly to count each visitor once a day and to stop abuse. If you tap “Use my location” in the directory, your browser asks your permission and sends your approximate location (rounded to about 100 m) once, to find the nearest suburb page; we don't store it.

Pool fence contractors and pool builders. We also list QBCC-licensed pool fence contractors and pool builders, built from QBCC's open licensed contractors register on data.qld.gov.au (CC BY 4.0). From that register we keep the licence number, the licensee's name, the QBCC licence classes held, and only the suburb and postcode of the business address: we never store or publish the street address. Many licensees are sole traders, so a listing can be a person's name; we hide a listing on request. We copy that register file every night (licence number, licence class, licensee name and this financial year's suspended and cancelled lists; no addresses) to check contractor claims (section 13) and to keep each listing's licence status and its “checked against the register file dated” date current; listings the file shows as suspended or cancelled are hidden until re-checked. PoolPreCert is not affiliated with QBCC. Contractors who claim a listing add their own business details, and we count profile views and contact taps in the same way as for inspectors. Listings cost nothing.

Repair quote and quote requests. If you send a quote request to a contractor or builder, we send them your name, phone and/or email, your property's suburb, the project type, rough timing and your message, and nothing else, unless you tick the extra box. If you tick it, we also send the fence, gate and barrier items your self-check marked “Needs attention”, with your notes and the photos you took of those items (photos may show your property). If you choose to attach a “See it in your yard” picture, the business can see it while the request is live. The request goes only to the contractor you chose and no one else. We store the exact wording you agreed to. You can withdraw a request at any time from your Inspectors & quotes page: the contractor then loses access straight away, and the shared items and photo access are removed. Once a contractor has contacted you, what they do with information you give them directly is up to them and their own privacy policy. A contractor may save your details as a customer, as described in section 15. We email the contractor to say a request has arrived, without any of your details.

Suppliers. We keep a directory of fencing and glass suppliers, built from the suppliers' own websites, for signed-in contractors and builders to use. It holds business details only: name, suburb, state, postcode, phone, website, a general business email the supplier publishes itself, and where and when we found it. A supplier can ask us to correct or remove its listing through our contact form. When a contractor prepares a quote request to a supplier, the email is made on their device and sent from their own email account; we record only that a request was prepared for a supplier on a day.

15. Businesses and their customers

When a business (an inspector, pool fence contractor, pool builder, or a real estate agency or property manager) uses PoolPreCert, it is the business that has the relationship with its customers. We hold their details for the business to provide the service, and we do not use them to market to those customers or sell them. A business is responsible for having the right to give us its customers' details and for telling them how they are handled.

Emails we send for businesses. When a business uses PoolPreCert's booking, Schedule, reminder, quote, invoice or review tools, we send emails to that business's customers on its behalf, from PoolPreCert's address: booking received, confirmed, declined or changed, and a reminder the day before a booked job; reminders before each visit of a repeating job, only when the business turns them on for that repeat; a single confirmation when a business sets up a regular visit for a customer, only when the business chooses to send it; a reminder before a pool safety certificate expires; one follow-up about a quote that has had no answer (after about 5 days) and one about an unpaid invoice (after about 14 days), only if the business switches those on; and one invitation, and one reminder, to review the business after a booked job (see section 7). We also send reminder emails to a property manager named by an agency, 60, 14 and 0 days before a certificate expires, and an agency can send a one-off invitation to an inspector it already uses. These emails say “Sent by PoolPreCert for” the business, carry our business name, ABN and support address, and (apart from the reminders to an agency's property manager, which say which agency set them up and how to stop them) include a one-click unsubscribe link. They are sent only to an address the business or the customer gave us for that purpose, and we do not use it for anything else. If you unsubscribe, we keep only a scrambled, one-way version of your email address (it cannot be turned back into the address) so we never email you on behalf of any business again; we keep it for as long as it is needed to honour your request. You can also ask the business, or email support@poolprecert.com.

Booking pages. If you use a business's booking page, you give your name, phone, email, the job's street address, suburb and postcode and an optional note. We hold the request until the business decides it, then in the business's own customer, property and job records. We delete a decided booking request 12 months after the decision; the job and customer records the business has made from it stay with the business. We keep the wording you agreed to with each request, and send you service emails (received, confirmed, declined).

“Save as customer”. When a business saves a person who contacted it through PoolPreCert as a customer, that person's name, phone, email and suburb are copied into the business's own customer records. The business then holds that copy as its own record.

Private links. A business can create private links that work without signing in: a customer link (showing a customer's bookings, quotes, invoices and certificate dates), an accountant link (document numbers, dates, customer names and amounts), a calendar link (booked jobs, including customer names, phone numbers, street addresses and the business's notes, for use in the business's own calendar app; if the business has repeating jobs, the link also lists dates that are planned but not yet booked, marked as tentative), an agency calendar link (property names and suburbs only), a booking link and, for inspection reports, a report link. Anyone holding a link can see what it shows until it expires or the business switches it off, so a business should send each link only to the person it is meant for. We store only a one-way hash of most link codes, not the code itself.

Other records. A business can record that a quote for a property was approved, including the approver's name and the contractor's name; if the contractor uses PoolPreCert it can see that record and is told in the app, unless the business hides it. A business can store a price list that is visible only to that business; we do not use it to rank or promote anyone. When a business builds a quote or invoice, the customer's details it enters are sent to its own accounting software (Xero; QuickBooks cannot be connected yet) only if it has connected it. The business's own team can see its records, and our administrators can read them to give support.

Inspection records. Completed professional inspection records are protected from deletion inside an inspector's account for 5 years from completion, because QBCC asks inspectors to keep records for at least 5 years. They are kept in the account, and deleted with it if the account is closed, so an inspector should download their record packs before asking us to delete the account. Inspectors can record notes, a sketch of the barrier layout and a log of advice given; once an inspection is finished these records are read-only.

16. Disclosure to service providers and others

We may disclose personal information to hosting, database, authentication, payment, email, customer-support, security, AI and other technology providers where reasonably necessary to provide or secure the Platform. We may also disclose information to professional service providers, insurers, advisers, regulators, courts, law enforcement or other parties where required or authorised by law.

We disclose a waiting request to the business you asked only after that business has claimed its listing and its trial or plan includes requests, and only because you agreed to this when you made the request.

17. Reviews

Only homeowners who booked an inspector, contractor or builder through PoolPreCert can review them. A published review shows your first name, your property's suburb, your rating and what you wrote; the business can reply publicly. You can edit or delete your review at any time. We retain moderation records and correspondence concerning reviews to administer the review system and respond to complaints. See our Directory & Reviews Policy.

18. Marketing

We may send service communications necessary to operate your account, such as reminders you have set up. Tips and monthly summary emails carry a one-click unsubscribe link. Other marketing communications will be sent only where permitted by law and will include an appropriate unsubscribe mechanism.

19. Security (APP 11 aligned)

We use reasonable technical and organisational measures appropriate to the nature and sensitivity of the information, including access controls, authentication, encryption where appropriate (including encryption of stored data and of the access tokens for connected accounting software), logging, monitoring, provider controls and staff access restrictions. Our database provider (Supabase) keeps daily backups of the database for 7 days; it does not provide point-in-time recovery on our plan. Photographs and reports are stored privately and are only accessible to members of your account through short-lived links.

No internet service can guarantee absolute security. If a data incident occurs, we will assess it promptly and take steps required by applicable law, including the Notifiable Data Breaches scheme where applicable.

20. Retention and deletion

We do not intend to retain personal information indefinitely. We retain information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, meet legal/accounting obligations, resolve disputes, prevent fraud or maintain security.

Our current practice, by kind of information:

Where the APPs apply and personal information is no longer needed for a permitted purpose, we will take reasonable steps to destroy it or ensure it is de-identified, subject to legal retention requirements. This includes reasonable steps concerning copies and archived data. Deleted information can remain in database backups for up to 7 days until they expire.

21. Access and correction

You can update your details in Settings and download a copy of your data from the Privacy section of your account settings. You may also request access to personal information we hold about you and request correction of inaccurate or incomplete information, subject to applicable exceptions, by contacting support@poolprecert.com. If a business holds your details in its own customer records, you can ask the business, or us, and we will help the business act on it.

22. Deletion requests

You may request deletion of your account from the Privacy section of your account settings, or by contacting us. We process requests within 30 days, and deleting an account deletes the data in it, including records and photos. If an account holds completed professional inspection records, the request form asks you to tick that you have downloaded the records you need to keep (QBCC asks inspectors to keep records for 5 years); we store when you ticked it with your request and do not delete those records without it. We may need to keep some information to comply with law, resolve disputes, prevent fraud, enforce agreements or protect security: for example, payment records, and system records of changes that keep an internal identifier rather than your details. Deleted information may remain in backups for up to 7 days.

23. Complaints

If you believe PoolPreCert has mishandled your personal information, contact support@poolprecert.com with details of the issue. We will assess and respond within a reasonable period. If you are not satisfied, you may have the right to complain to the Office of the Australian Information Commissioner (OAIC).

24. Children

PoolPreCert is not designed to require children to create accounts. Parents and guardians should avoid uploading images or information identifying children unless genuinely necessary. If we become aware that a child has provided information inappropriately, contact us so we can assess the situation.

25. Cookies, device storage and analytics

We use cookies and local storage for authentication, security and preferences (for example, which account you're working in, or that you closed a site notice). We don't use advertising cookies. We do use one third-party analytics service, Google Analytics, described below. If that changes, we will update this policy and, where required, ask first.

• Google Analytics (website visits). On our public website pages and the sign-up page, but not inside the signed-in app or on the sign-in page, we use Google Analytics 4 (Google LLC, United States) to count visits and see which pages and campaigns bring in sign-ups. Google starts with every option switched off (“Consent Mode” denied) until you choose: no analytics cookies are set and no identifier is stored on your device, no advertising features, Google signals or ad personalisation are used, and we do not share the data with Google's advertising products. Google still receives each page view (the page path with private link codes replaced, the page title, any campaign tags from the link, but none of the other text in the address), your device and browser type, and your IP address, from which it works out your approximate location. We ask Google to keep this data for 2 months. We do not send names, email addresses or anything from inside your account. To opt out, you can block Google Analytics in your browser or install Google's opt-out browser add-on.
• Your choice about analytics cookies. The first time you visit our public website pages we ask whether you agree to Google Analytics saving analytics cookies on your device. If you choose “Accept analytics”, Google Analytics may set cookies (named _ga and _ga_ followed by our measurement code) to tell visits apart and count them, for up to 2 years. If you choose “No thanks”, or do not choose, it sets no analytics cookies (the setting with no analytics cookies described above applies). Either way the website works the same, and we never use Google Analytics for advertising. We remember your choice on your device, in the browser's local storage (the entries ppc-analytics-consent and ppc-analytics-consent-at: your answer and the time you gave it), for 12 months, and then ask again. You can change your mind at any time with “Cookie settings” in the footer of any public page: choosing “No thanks” there withdraws your consent, replaces your saved answer and removes the analytics cookies we can see on your device. If your browser blocks local storage, your choice lasts for that page only and we ask again on your next visit.
• Sign-in email. The sign-in box remembers the last email address used on your device (the address only, never a password). You can remove it with “Not you?”.
• Offline use. If you use PoolPreCert without a signal, the answers, notes and photos you add are kept on your phone until they upload, and a copy of each checklist you open (the questions, your answers so far, and the property and pool name) is kept on your phone for up to 14 days, or until you sign out, remove it, or the inspection is finished. Answers and photos that have not uploaded are kept through sign-out so nothing is lost. This stays on your device and is not encrypted beyond your browser's own protection; we do not receive it until it uploads. People who share a phone should sign out.
• Small preferences. Things like hiding a suggestion card, remembered usual prices and a campaign tag for the current browser tab are kept in your browser and are not sent to us until you sign up. Choosing “Not now” on the bar that appears on our business pages is kept in your browser's local storage for 30 days so the bar stays away; it is not sent to us.
• Bot protection. To stop automated copying of our directory and to protect sign-in and contact forms, we use a one-way scrambled version of your network address (it cannot be turned back into your address and changes every day). It is kept for less than 24 hours. We also keep daily totals of how many requests were slowed down; the totals identify nobody.

26. Changes

We may update this Privacy Policy when our practices or legal requirements change. The current version will be published through the Platform, with the date it was last updated at the top and a short note of what changed. Where required, we will provide additional notice of material changes.

27. Contact

Privacy enquiries: support@poolprecert.com. Pool Pre Cert, ABN 22 916 588 904, Queensland, Australia.

Updated 22 October 2026: in-app video recording, our notes about calls to listed businesses, where researched listing details come from, Xero only, the matching retention row, the automatic approval of some contractor claims, the nightly register re-check and plan limits as automated tools, and our reply times for a human review; the full note is at the top of this page. Corrected for accuracy 17 October 2026; first published 8 October 2026.