Privacy Policy

3. Device permissions

The Clutch mobile app requests the permissions below. You may decline or later revoke any of them in your device settings. Where a permission is declined the related feature will not function, but the rest of the app will continue to work.

Photos you capture are uploaded to your Account Organisation’s Clutch workspace and are visible to other authorised users of that workspace. We do not access your camera roll in the background, and we do not scan images unrelated to the item you attach them to.

4. How we use personal information

We will not use your personal information for an unrelated purpose unless you would reasonably expect it, you have consented, or the use is otherwise permitted or required by law.

4.1 Automated processing

Clutch uses automated classification and data-extraction techniques on uploaded project documents. These processes operate on document content — bar marks, quantities, rates — rather than on individuals, and we do not use automated decision-making that produces legal or similarly significant effects on individuals.

4.2 Direct marketing

We may occasionally send you information about Clutch product updates, new features or related services. Every marketing message includes a clear unsubscribe function, consistent with APP 7 and the Spam Act 2003 (Cth). Operational and transactional messages about your projects are not marketing and cannot be unsubscribed from while your account remains active, though you can disable push notifications at any time.

5. When we disclose personal information

We disclose personal information only as described below. We do not sell, rent or trade personal information.

• Your Account Organisation and other authorised users. Entries you make in Clutch — including your name, the time of the action, and any photos or comments you attach — are visible to other authorised users of the same project workspace, including your employer, the principal contractor, and where relevant the reinforcement supplier.
• Service providers. Third parties that host, secure, process or support the Platform on our behalf, under contractual obligations of confidentiality and security. These are listed in section 6.
• Professional advisers. Our lawyers, accountants, auditors and insurers where reasonably required.
• Corporate transactions. A prospective purchaser or successor in the event of a sale, merger or restructure of our business, subject to confidentiality undertakings.
• Legal requirements. Courts, regulators, law enforcement or other authorities where required or authorised by Australian law, or where reasonably necessary to prevent a serious threat to life, health or safety.

6. Service providers and data location

6.1 Where your data is stored

Clutch data is hosted in Australian data centre regions. Our primary application, database and document storage are located in Australia.

6.2 Third-party service providers

We rely on the following providers. Each is engaged under terms that limit their use of the data to providing services to us.

6.3 Overseas disclosure (APP 8)

Although our hosting is located in Australia, several of the providers above are incorporated overseas — principally in the United States — and their support, security and engineering personnel may be able to access data from outside Australia in the course of maintaining their services. Some support and diagnostic functions may also be performed from other countries in which those providers operate.

Before disclosing personal information to an overseas recipient we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles, including through contractual data protection terms. By using Clutch you acknowledge that these overseas disclosures may occur.

A current list of our service providers and their locations is available on request.

7. Security

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, as required by APP 11. Our measures include:

• Encryption of data in transit using TLS, and encryption of stored documents and database contents at rest.
• Authentication and role-based access control, with administrative functions restricted to users holding administrator roles.
• Access to production systems limited to personnel who need it, on a least-privilege basis.
• Audit logging of significant actions within the Platform.
• Regular patching, backups and review of our security controls.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. You are responsible for keeping your login credentials confidential and for notifying us promptly if you suspect unauthorised use of your account.

7.1 Data breaches

We maintain a data breach response plan. If we suffer an eligible data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act, and we will notify the relevant Account Organisation.

8. Retention and deletion

We retain personal information for as long as it is needed for the purposes described in this policy, and for as long as the relevant Account Organisation maintains its Clutch subscription. Project records, delivery evidence and document data are commonly retained for the life of the project and for a further period to support progress claims, contract administration, warranty periods and dispute resolution.

After that, we will destroy or de-identify personal information, unless we are required to retain it by law — for example under taxation, corporations, or building and construction record-keeping obligations — or it is reasonably necessary to retain it in connection with an actual or anticipated legal claim.

8.1 Deleting your account

• In the app: open Settings → Account → Delete account and confirm.
• Online: submit a request at https://www.clutchtrack.ai/account-deletion — no need to reinstall the app.
• By email: contact info@clutchtrack.com.au with the subject “Account deletion request”.

Once a deletion request is verified, we will delete your account credentials, profile and personal usage data within 30 days, and from backups within a further 90 days.

Please note: project records created through your use of Clutch — delivery mark-offs, issue reports, uploaded documents and photographs — belong to your Account Organisation and form part of its project record. These may be retained by that organisation after your individual account is deleted. Where technically feasible and lawful, we will disassociate them from your personal identifiers, or refer your request to the Account Organisation as data controller. We will tell you which applies when we respond to your request.

9. Accessing and correcting your information

Under APP 12 and APP 13 you may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Much of this information is available directly in the app through your profile settings.

To make a request, contact our Privacy Officer using the details in section 13. We will need to verify your identity. We will respond within a reasonable period, ordinarily within 30 days. Access is provided free of charge, though we may charge a reasonable cost-recovery fee for a request requiring substantial effort; we will tell you before any fee is incurred.

In limited circumstances we may refuse access or correction — for example where it would unreasonably affect the privacy of others, where the information relates to a commercially sensitive decision-making process, or where refusal is required or authorised by law. If we refuse, we will give you written reasons and explain how to complain.