Privacy Policy

• Your account: your first and last name, your email address, and a securely hashed version of your password. We never store your password in a readable form. When a business invites you, it enters your email address, and for referrers your name, before you have accepted.
• Business details: business and trading name, industry, ABN and ACN, address, phone, contact email, website and logo, and the members of your team.
• Referral settings: the referral percentage a business sets, with a dated record of each change and who made it, and its project types and milestones.
• Referrals: the referred person's name, email address, phone number, suburb and any notes; which referrer sent them; the project value the business confirms; which milestones were approved, when and by whom; and a reason if the referral was marked lost.
• Referrer connections: which businesses a referrer works with, whether each connection is active, saved or suspended, and any note a business adds when suspending a referrer.
• Documents: files attached to a referral (PDF, JPEG or PNG), their names, and who uploaded each one and when.
• Consent records: when a referral is submitted, the time consent was given and which version of the consent wording was agreed to.
• Sign-in records: each time you sign in we record your IP address and your browser's description of itself, to manage your signed-in sessions.
• Server logs: our servers record each request, including your IP address and the page requested. We filter passwords, email addresses, links containing access codes, and referred people's details out of those logs, but they can still contain other things you enter, such as names and business details.
• Cookies: we use cookies to keep you signed in, to remember which business you are working in, and to protect forms from forgery.

• To pass a referral to the business it is for, and to track it through its milestones.
• To show each side of a referral what it needs to see, and nothing more.
• To send the emails the service needs: invitations, email address confirmation and password resets. We don't send marketing emails.
• To keep M8s Rates secure, prevent abuse and fix problems.
• To meet our legal obligations, including keeping records of referrals and rewards.

We don't sell or rent personal information, and we don't use it for advertising.

• A business sees the referrals sent to it, the details of the people referred, and the names and email addresses of its referrers and team members. It cannot see another business's referrals or referrers.
• A referrer sees their own referrals and rewards, and the contact details a business chooses to publish. One referrer never sees another's referrals, rewards or details.
• Documents on a referral are visible to the business and the referrer on that referral, and to nobody else.
• Our staff can access the database to run and support the service.

M8s Rates has no advertising, no analytics tools, no tracking pixels and no ad networks.

We use a small number of service providers to run M8s Rates.

Fly.io · Sydney, Australia

Hosts our servers, database and server logs.

Tigris · Global storage network, not limited to Australia

Business logos and documents attached to referrals, held in private storage.

Resend · United States

Your email address and the content of the emails we send you.

Resend is in the United States, and Tigris may store files outside Australia. When you use M8s Rates, your information is disclosed to these recipients as described above. We use each provider under its standard business terms.

• Referrals — including the referred person's details, milestones, approvals and consent records — are financial records that decide who gets paid. We keep them, and don't delete them on request.
• We don't yet delete old records on a schedule. A sign-in record, with its IP address and browser details, is removed when you sign out, but one from a session that simply expires can remain until that browser returns.
• Referrers can close their account from their Profile. Unless you are also on a business's team, you can no longer sign in. Connections with no referrals are removed. We keep your name and email address with the referrals you sent, and a business you referred work to still sees those referrals and that you have left.
• Team members removed by a business lose access to it. Their account and their name on records they created, such as milestone approvals, remain.
• Documents can be removed by whoever uploaded them, and the file is deleted from storage. A business can remove its logo at any time.
• Businesses can't yet close their account inside the app. Email [contact email to be confirmed] and we will work through it with you, keeping the referral records described above.

Everything between your browser and M8s Rates travels over HTTPS. Passwords are stored only as a secure hash. Invitation and share links are stored only in a scrambled form and expire, and password reset links expire after 15 minutes. Documents are held in private storage and opened through links that expire after a few minutes. We limit repeated attempts to sign in and to submit forms. No system is perfectly secure. If a breach of your information is likely to cause you serious harm, we will tell you as soon as we can.

Businesses can update their business details in Account. To ask for a copy of the information we hold about you, ask us to correct it — including your name or email address — or make a privacy complaint, email [contact email to be confirmed]. We aim to respond within 30 days. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au .

We will update this policy when M8s Rates changes, and the date at the top will show when. If a change significantly affects how we handle your information, we will tell account holders by email before it takes effect.