Privacy Policy

We collect the minimum information required to deliver the compliance workflow:

• Account information: name, email address, role, and the construction tenant or plant-owner organisation you belong to.
• Plant register data: make, model, serial number, plant type, compliance plate photos, service records, inspection certificates, and design registrations.
• Operator credentials: high-risk-work licences, statements of attainment, verifications of competency, and the photo evidence supporting them.
• Prestart and inspection records: the evidence captured each time plant is used or inspected.
• Risk assessment evidence: risk assessment templates, contractor responses, sign-off records, and nomination chains.
• Technical metadata: IP address, browser user-agent, and timestamps required for security, audit-log integrity, and rate-limit enforcement.

We use the information you provide solely to deliver and improve the PlantComp service. Specifically:

• To operate your tenant's compliance workflow: plant register, alerts, prestart evidence, risk assessment lifecycle.
• To verify operator credentials against state regulators' public licence check services (SafeWork NSW, and additional jurisdictions as they are connected): only credential identifiers are sent; we do not transmit personal identifying information to regulators beyond what their public verification endpoints require.
• To route compliance alerts to the safety personnel nominated within your tenant. Alerts stay within your tenant scope.
• To maintain audit trails required by Work Health and Safety legislation.
• To send essential service emails (account verification, password resets, compliance alerts). We do not send marketing emails to platform users without explicit consent.

Customer data at rest is stored in Australia. Application processing and background job queues transit infrastructure outside Australia. The components are:

• Database: Supabase (PostgreSQL), region ap-southeast-2 (Sydney, Australia). All customer data at rest is stored here.
• Application servers: Railway, Southeast Asia region. Stateless request processing only; no customer data is persistently stored on the application tier.
• Background job queue: Railway, Southeast Asia (Singapore).
• Static assets and marketing site: Vercel global edge network. No customer data; static HTML, CSS, JavaScript, and image assets only.
• Transactional email: Resend (United States). Used only for essential service emails (account verification, password resets, compliance alerts) sent to the addresses you have provided.
• Error monitoring: Sentry (United States). Personal information is removed before an error report is sent, IP addresses are not stored, and an approximate city is recorded for errors in the browser.

Customer data at rest is stored in Australia. Background job queues process in Southeast Asia (Singapore); job payloads may include operator identifiers and asset information. If our infrastructure providers change region configuration, this policy will be updated and affected customers notified before any migration takes effect.

Compliance records are permanent. This is a foundational architectural principle of PlantComp: compliance evidence (plant register entries, prestart records, defect reports, risk assessment sign-offs, operator credential verifications) is soft-deleted only, never hard-deleted. This prevents unscrupulous actors from covering their trail and preserves the audit chain required by WHS legislation.

Account information (name, email, role) is retained while your account is active. If you close your account, account information is retained for seven (7) years after closure for audit-trail integrity, then anonymised.

Technical metadata (IP address and browser details) recorded with signatures, risk assessment acknowledgements and the audit log forms part of the compliance record and is kept on the same permanent basis. The IP address and browser details recorded when you sign in to the plant owner portal are kept with that sign-in record.

We do not sell your data. We disclose data only in the following limited circumstances:

• To our infrastructure providers (Supabase, Railway, Vercel, Resend, Sentry) strictly as required to deliver the service. Each is bound by its own data-processing terms.
• To state regulators only the minimum credential identifiers needed to verify operator competency against public verification endpoints.
• To other tenants on the platform: under PlantComp's plant-above-tenant architecture, plant compliance history travels with the machine. Tenants who hire or acquire plant can see the plant's safety history with raising-tenant identifying details stripped (site names, project names, and staff names of other tenants are removed). Plant owners see the full deployment history of their fleet.
• To comply with law enforcement where we are legally compelled to do so by a valid Australian court order or warrant.

Under the Australian Privacy Principles you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct inaccurate or out-of-date personal information.
• Portability: request your data in a machine-readable format where technically feasible.
• Complaint: lodge a privacy complaint with us and, if unresolved, escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, contact us at the address below. We respond to verified requests within thirty (30) days.

The PlantComp marketing site (this site) does not use analytics and does not set cookies.

The PlantComp application uses cookies strictly for sign-in. They are Secure (sent only over encrypted connections) and SameSite=Lax. The plant owner portal's sign-in cookie is httpOnly, so code in the page cannot read it. The builder dashboard's sign-in cookie is read by the dashboard's own code to keep you signed in, so it is not httpOnly. We do not use third-party analytics, advertising, or tracking cookies inside the application.

We apply standard industry security controls:

• TLS encryption in transit for all platform endpoints.
• Database encryption at rest via Supabase.
• Organisations kept apart: the PlantComp application limits every request to the signed-in user's organisation, and browsers have no direct access to customer tables.
• An audit log of key actions, such as a defect being raised or resolved, recording who, what and when.

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme.

PlantComp is a business-to-business platform for the construction industry. The service is not directed at, and we do not knowingly collect information from, individuals under the age of 16.

We may update this policy from time to time. The version number and last-updated date at the top of this page reflect the current version. Material changes will be communicated to account holders by email before they take effect.

For any privacy enquiry, access request, correction request, or complaint: