Privacy Policy

We collect the minimum information required to deliver the compliance workflow:

• Account information — name, email address, role, and the construction tenant or plant-owner organisation you belong to.
• Plant register data — make, model, serial number, plant type, compliance plate photos, service records, inspection certificates, and design registrations.
• Operator credentials — high-risk-work licences, statements of attainment, verifications of competency, and the photo evidence supporting them.
• Prestart and inspection records — the evidence captured each time plant is used or inspected.
• Risk assessment evidence — risk assessment templates, contractor responses, sign-off records, and nomination chains.
• Technical metadata — IP address, browser user-agent, and timestamps required for security, audit-log integrity, and rate-limit enforcement.

We use the information you provide solely to deliver and improve the PlantComp service. Specifically:

• To operate your tenant's compliance workflow — plant register, alerts, prestart evidence, risk assessment lifecycle.
• To verify operator credentials against state regulator APIs (SafeWork NSW, and additional jurisdictions as they are connected) — only credential identifiers are sent; we do not transmit personal identifying information to regulators beyond what their public verification endpoints require.
• To route compliance alerts to the safety personnel nominated within your tenant — alerts stay within your tenant scope.
• To maintain audit trails required by Work Health and Safety legislation.
• To send essential service emails (account verification, password resets, compliance alert digests). We do not send marketing emails to platform users without explicit consent.

All customer data at rest is stored in Australia. Application processing transits broader Asia-Pacific infrastructure. The components are:

• Database — Supabase (PostgreSQL), region ap-southeast-2 (Sydney, Australia). All customer data at rest is stored here.
• Application servers — Railway, Southeast Asia region. Stateless request processing only; no customer data is persistently stored on the application tier.
• Static assets and marketing site — Vercel global edge network. No customer data; static HTML, CSS, JavaScript, and image assets only.
• Transactional email — Resend (United States). Used only for essential service emails (account verification, password resets, compliance alert digests) sent to the addresses you have provided.

We do not transfer or store customer data at rest outside Australia. If our infrastructure providers change region configuration, this policy will be updated and affected customers notified before any migration takes effect.

Compliance records are permanent. This is a foundational architectural principle of PlantComp: compliance evidence — plant register entries, prestart records, defect reports, risk assessment sign-offs, operator credential verifications — is soft-deleted only, never hard-deleted. This prevents unscrupulous actors from covering their trail and preserves the audit chain required by WHS legislation.

Account information (name, email, role) is retained while your account is active. If you close your account, account information is retained for seven (7) years after closure for audit-trail integrity, then anonymised.

Technical metadata (IP logs, security audit logs) is retained for ninety (90) days for security investigation purposes, then automatically purged.

We do not sell your data. We disclose data only in the following limited circumstances:

• To our infrastructure providers (Supabase, Railway, Vercel, Resend) strictly as required to deliver the service. Each is bound by its own data-processing terms.
• To state regulators only the minimum credential identifiers needed to verify operator competency against public verification endpoints.
• To other tenants on the platform — under PlantComp's plant-above-tenant architecture, plant compliance history travels with the machine. Tenants who hire or acquire plant can see the plant's safety history with raising-tenant identifying details stripped (site names, project names, and staff names of other tenants are removed). Plant owners see the full deployment history of their fleet.
• To comply with law enforcement where we are legally compelled to do so by a valid Australian court order or warrant.

Under the Australian Privacy Principles you have the right to:

• Access — request a copy of the personal information we hold about you.
• Correction — ask us to correct inaccurate or out-of-date personal information.
• Portability — request your data in a machine-readable format where technically feasible.
• Complaint — lodge a privacy complaint with us and, if unresolved, escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, contact us at the address below. We respond to verified requests within thirty (30) days.

The PlantComp marketing site (this site) uses Vercel Analytics, which collects anonymous, aggregated page-view data and does not set cookies, does not track users across sites, and does not transmit personal identifying information.

The PlantComp application uses session cookies strictly for authentication. These cookies are httpOnly, Secure, SameSite=Lax, and scoped to the .plantcomp.com.au domain. We do not use third-party analytics, advertising, or tracking cookies inside the application.

We apply standard industry security controls:

• TLS encryption in transit for all platform endpoints.
• Database encryption at rest via Supabase.
• Row-level security policies enforcing tenant isolation at the database layer.
• Audit-log integrity (audit rows are append-only by design).
• Single sign-on via Azure AD / Entra ID available on the enterprise tier.

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the OAIC in accordance with the Notifiable Data Breaches scheme.

PlantComp is a business-to-business platform for the construction industry. The service is not directed at, and we do not knowingly collect information from, individuals under the age of 16.

We may update this policy from time to time. The version number and last-updated date at the top of this page reflect the current version. Material changes will be communicated to account holders by email before they take effect.

For any privacy enquiry, access request, correction request, or complaint: