ShedSmart — Privacy Policy

BL Peck Construction Pty Ltd (ABN 50 651 461 504), trading as The Shed Guru

Last updated: 12 July 2026 Effective from: 12 July 2026

1. Who we are

BL Peck Construction Pty Ltd (ABN 50 651 461 504), trading as The Shed Guru ("we", "us", "our"), operates ShedSmart (the "Service"), a quoting and business management platform for trade businesses.

We are committed to protecting personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This policy explains what personal information we collect, why, how we use and disclose it, how we keep it secure, and how you can access, correct or complain about it.

2. Two kinds of information — an important distinction

This policy covers two different relationships.

(a) You — our customer. The trade business (and its people) who subscribe to and use ShedSmart. We are responsible for your information and this policy governs it directly.

(b) Your clients — the people you quote. When you enter your customers' names, addresses, contact details and job information into ShedSmart, you decide what to collect and why. We hold and process that information on your behalf and under your instructions, as your service provider.

You are responsible for your own privacy compliance in relation to your clients' information — including having a lawful basis to collect it, telling your clients how it will be handled, and honouring their access and correction requests. We will support you in doing so (see clause 11).

3. What we collect

3.1 Information you give us

• Account and identity: name, business name, ABN, email address, phone number, postal or business address.
• Authentication: email address and a securely hashed password. We never store your password in readable form.
• Billing: subscription plan, billing contact, transaction history. We do not store your full card details — payments are handled by Stripe (see clause 5.2).
• Business configuration: your items and rates, labour rates, margins, wastage settings, work types, benchmarks and pricing inputs. This is commercially sensitive to you and we treat it as confidential — see clause 7.
• Your clients' information, entered by you: names, contact details, site addresses, job notes, quote history, uploaded plans and documents.
• Support communications: anything you send us by email or through the Service.

3.2 Information collected automatically

• Usage and technical data: IP address, browser and device type, pages viewed, actions taken, timestamps, error and diagnostic logs.
• Cookies and similar technologies: see clause 9.

3.3 Sensitive information

We do not seek to collect sensitive information (as defined in the Privacy Act 1988 — such as health information, racial or ethnic origin, religious beliefs, or criminal record). Please do not enter it into the Service.

4. Why we collect it, and what we do with it

We collect and use personal information to:

• create and administer your account, and authenticate you;
• provide the Service — store your data, run calculations, generate quotes and documents;
• process payments and manage subscriptions, renewals and invoices;
• send transactional emails (password resets, email verification, billing notices, security alerts, important service changes) — you cannot opt out of these while you hold an account;
• provide customer support and respond to enquiries;
• maintain security, prevent fraud, enforce our Terms, and protect our legal rights;
• monitor, debug, maintain and improve the Service; and
• comply with our legal obligations.

Marketing. We may send you news, product updates and offers about ShedSmart. You can opt out at any time using the unsubscribe link in any message, or by emailing support@theshedguru.com.au. We comply with the Spam Act 2003 (Cth). We do not sell your personal information, and we do not sell or share your clients' information.

Aggregated and de-identified data. We may create aggregated, de-identified statistics and benchmarks from use of the Service. This data will not identify you, your business, your clients, or your individual pricing. We may use it to improve the Service and produce general industry insights.

5. Who we disclose it to

We do not sell personal information. We disclose it only as set out below.

5.1 Service providers

We use third-party providers to operate the Service. Each is bound to protect the information and use it only to provide services to us.

Your business data — your quotes, items and rates, pricing, clients and uploaded plans — is stored in Australia. Only limited operational information (such as billing details and email addresses for transactional mail) is handled by overseas providers, as set out above.

5.2 Payments

Card payments are processed by Stripe. We receive confirmation and limited transaction details, but not your full card number. Your relationship with Stripe is governed by its own terms and privacy policy.

5.3 Other disclosures

We may disclose personal information:

• where you authorise or direct it;
• to our professional advisers (lawyers, accountants, auditors) under confidentiality;
• where required or authorised by law, or to a court, regulator or law enforcement body;
• to protect our rights, safety, or property, or that of others; or
• to a purchaser or potential purchaser in connection with a sale or restructure of our business, subject to confidentiality, and with the information continuing to be handled in accordance with this policy.

6. Overseas disclosure

Your business data is stored in Australia. Our database, authentication and file storage are hosted in the Sydney region. Your quotes, items and rates, pricing, client records and uploaded documents remain in Australia.

Some limited personal information is disclosed to service providers located overseas, principally in the United States, for the purposes set out in clause 5.1:

• Stripe — billing name, email and transaction details, for payment processing.
• Resend — your email address and message content, to deliver transactional emails such as password resets.
• Mailchimp — your email address, only if you have opted in to marketing.
• Anthropic — the text of the questions you type into the in-app help assistant. Your items and rates, pricing, quotes and client information are not sent to it.

By using the Service, you consent to these disclosures. We take reasonable steps to ensure overseas recipients handle personal information consistently with the Australian Privacy Principles, including by using established providers with recognised security and privacy standards, and contractual protections.

You acknowledge that overseas recipients may be subject to foreign laws, and that we may not be able to ensure they comply with the APPs in the same way an Australian entity would.

6A. Artificial intelligence

The Service includes an in-app help and onboarding assistant powered by a third-party AI provider (currently Anthropic).

• The assistant is designed to answer general questions about how to use ShedSmart — for example, how to set up an item and its rate, or what a wastage percentage means.
• Your commercial data is not sent to the AI provider. Your items and rates, margins, pricing, quotes, client details and uploaded documents are not shared with it.
• Anything you type into the assistant is sent to the AI provider in order to generate a response. Please do not enter client details, pricing, or other confidential information into the assistant.
• We do not permit the AI provider to use your inputs to train its models.
• The assistant may produce inaccurate or incomplete answers. It is a convenience feature, not advice. Do not rely on it for pricing, quoting, legal, financial or regulatory decisions — see our Terms of Service.

If we change this so that the assistant can access your business data, we will update this policy and notify you before that change takes effect.

7. Confidentiality of your commercial data

Your pricing, items and rates, margins, benchmarks, quotes and client lists are commercially sensitive. We treat them as your confidential information.

• We use tenant isolation so that one customer's data cannot be accessed by another customer.
• Our personnel access customer data only where necessary — to provide support you have requested, to investigate a fault, to maintain security, or where required by law.
• We do not disclose your pricing to other customers, and we do not use it in any way that identifies you or your business.

8. Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• encryption in transit (HTTPS/TLS) and at rest;
• hashed passwords, never stored in readable form;
• row-level access controls enforcing tenant isolation;
• access restricted to personnel who need it;
• regular backups; and
• monitoring, logging and prompt patching.

No system is completely secure. We cannot guarantee absolute security, and you provide information at your own risk. You are responsible for keeping your login credentials secure and for all activity under your account.

Data breaches. If we suffer a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme.

9. Cookies

We use cookies and similar technologies to:

• keep you logged in and maintain your session (essential — the Service will not work without these);
• remember your preferences; and
• understand how the Service is used, so we can improve it.

Most browsers let you block or delete cookies. Blocking essential cookies will prevent you from logging in.

10. How long we keep it

• While your account is active: we retain your information to provide the Service.
• After termination: we retain your data in recoverable form for 30 days so you can request an export, then permanently delete it (see our Terms of Service, clause 13).
• Billing and tax records: retained for at least 7 years, as required by Australian law.
• Backups: deleted data may persist in backups until those backups expire in the ordinary course.
• De-identified data: may be retained indefinitely.

11. Access, correction and complaints

11.1 Your rights

You may:

• access the personal information we hold about you;
• correct it if it is inaccurate, out of date, incomplete or misleading;
• export your data using the features in the Service;
• withdraw consent to marketing at any time; and
• request deletion of your account and data, subject to our legal retention obligations.

Contact support@theshedguru.com.au to make a request. We will respond within a reasonable time, usually 30 days. We may need to verify your identity. Access is generally free; we may charge a reasonable fee for substantial requests, and will tell you before doing so.

11.2 If you are a client of one of our customers

If your information was entered into ShedSmart by a trade business that uses our Service, that business — not us — controls it. Please contact them directly. If you contact us, we will refer you to them and assist them to respond.

11.3 Complaints

If you believe we have breached the Australian Privacy Principles, contact support@theshedguru.com.au with details. We will investigate and respond, usually within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

12. Children

The Service is for business use by persons aged 18 or over. We do not knowingly collect personal information from children.

13. Changes to this policy

We may update this policy from time to time. The current version is always available at https://shedsmart.theshedguru.com.au/privacy. Where a change is material, we will notify you by email or in-app notice before it takes effect.

14. Contact us

BL Peck Construction Pty Ltd (ABN 50 651 461 504) Trading as The Shed Guru Hobart TAS 7008, Australia

Privacy enquiries: support@theshedguru.com.au