Privacy Policy

This policy uses the following terms:

• “Customer Data” means personal information about a tradesperson user’s own clients or customers (e.g. a homeowner requesting a quote) that the tradesperson enters into or generates through the App.
• “Account Data” means information you provide to register and operate a Kepd account.
• “Personal information” has the meaning given in the Privacy Act 1988 (Cth) - broadly, information about an identified individual, or an individual who is reasonably identifiable.
• “Property Logbook” means the ongoing record of a property’s condition, inspection, service and compliance history that we maintain against the property itself, rather than against any one Account - see clause 2.8 and clause 9.

The information we collect depends on how you use the Services. It may include:

• Name, email address, mobile number, and password/authentication credentials.
• Business name, ABN/NZBN, trade licence or registration details, business address and logo.
• Role within a business (owner, admin, technician/field worker) and team member details you add to your account.
• Profile photo and any other information you choose to add to your profile.

• Names, addresses, phone numbers and email addresses of your customers or the properties you service.
• Job, quote, work order, invoice and payment history relating to those customers.
• Site notes, photos, videos, checklists and other documentation captured during a job.

Kepd acts as a service provider processing Customer Data on your behalf and at your direction. If you enter another individual’s personal information into the App (e.g. a client’s contact details), you are responsible for ensuring you have the right to provide that information to us and that the individual has been made aware of, or has consented to, that use - see clause 12.

• Approximate or precise device location (where you grant permission), used to support job scheduling, travel time estimates, site check-in/check-out, and route/crew allocation features.
• Property or job-site addresses entered by you or your organisation.
• Where our mapping and address-lookup provider (Mapbox) is used to support address autocomplete, maps, travel-time estimates and route/crew allocation, relevant address and location data is shared with that provider for these purposes.

• Invoicing, quoting and payment records processed through the App.
• Payment card or bank account details are collected and processed directly by our payment processors (Stripe and/or Square) - Kepd does not store full card numbers on its own servers.
• Where you connect accounting integrations (Xero, QuickBooks), relevant invoice, customer and financial data is shared with those platforms in accordance with your own settings and their respective privacy terms.

• SMS messages, notifications and call-related metadata sent via our messaging providers (Twilio, ClickSend) for job reminders, invoice chasing and customer communication features.
• Transactional emails such as quotes, invoices, receipts and account notifications, sent via our email delivery provider (Resend).
• Records of support enquiries, feedback and correspondence with us.

• Device type, operating system, unique device identifiers, IP address, mobile network information, app version and crash logs.
• In-app interactions, feature usage, session duration and diagnostic information, collected via analytics tools such as Firebase/Google Analytics and crash-reporting tools such as Firebase Crashlytics or Sentry.
• Push notification tokens, used to deliver job, quote and account notifications (you can disable these in your device settings).

The App includes AI-assisted features (“Kepd AI”) that draft quotes, extract structured fields from maintenance emails you choose to import, answer questions and suggest next steps using your job, quote and property data, and (where relevant) Customer Data. Inputs and outputs associated with these features may be processed by our AI infrastructure and model providers, acting as our service providers, solely to deliver this user-facing functionality. Personal information is not used by our third-party AI infrastructure or model providers to train their own general-purpose or foundational models. Google Workspace API user data (including Gmail content and data derived from it) is never used to create, train, fine-tune or otherwise improve generalised or non-personalised AI/ML models, whether operated by Kepd or by a third party. See clause 8 and clause 18.

We do not intentionally collect sensitive information - such as health information, racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, trade union or professional association membership, sexual orientation, genetic or biometric information, or criminal record information - through the Services. Please do not enter this type of information about your customers, staff or other individuals into the App unless it is directly relevant and necessary to the work you are providing.

Where you or your organisation use the App to record a property’s condition, inspection findings, compliance status or service history, that record (a “Property Logbook”) is kept against the property itself rather than solely against your Account. Because of this, a Property Logbook is not deleted when the Account that created it is closed (see clause 9), and if administration of the property is later transferred to a different Kepd organisation - for example, when a property changes property manager or trades provider - control of the Property Logbook, and the underlying condition and compliance data it contains, transfers with it. If you enter another individual’s personal information into a Property Logbook, the responsibilities in clause 12 apply to that information in the same way as any other Customer Data.

If an organisation administrator connects a mailbox under Settings → Integrations → Email, we collect only what is required to import maintenance and work-order emails the organisation has chosen to process:

• For Gmail, we request the single restricted scope https://www.googleapis.com/auth/gmail.readonly. We do not send, modify, label, or delete messages in the Google account.
• We list Gmail labels so the administrator can map selected labels (for example a Property Tree or PropertyMe label) to a Kepd pipeline stage (request, quote, job, or invoice).
• We register a Gmail push watch and read message history so newly labelled mail can be imported in near real time.
• We read the full content of messages that match a configured intake label, including document attachments, solely to create or update work items in Kepd. Mail that does not match an intake label is not imported.
• We store the connected mailbox address, OAuth tokens (encrypted), intake rules, and the imported message content needed to operate the work item.

Connecting Gmail is optional. You can disconnect at any time; we then revoke the token and stop watching the mailbox. See clause 18 for how Gmail data is used with AI providers and Google’s Limited Use requirements.

We collect personal information:

• directly from you, when you create an account, complete your profile, or use App features;
• automatically, through your use of the App and website (device data, usage data, location data, cookies and similar technologies);
• from third parties, such as payment processors, accounting platforms, messaging providers, mailbox providers (Gmail or Microsoft Outlook, if you connect them for email intake), or App/Play store platforms, where you connect or interact with those services through Kepd; and
• from other users of the Platform, such as when a property manager or customer’s details are entered by a tradesperson user.

We use personal information to:

• provide, operate, maintain and improve the Services, including account creation, job/quote/invoice management, scheduling and field operations;
• process payments and facilitate invoicing through integrated payment and accounting providers;
• send job-related, transactional and account notifications (including via SMS/push notification);
• provide customer support and respond to enquiries;
• power Kepd AI features such as quote drafting, email work-order extraction, and job suggestions;
• personalise and improve the App, including through analytics and diagnostics;
• detect, investigate and prevent fraud, misuse, security incidents and prohibited conduct;
• comply with our legal, regulatory and accounting obligations (e.g. tax and business records); and
• with your consent, or as otherwise permitted by law, send you marketing communications about Kepd products and features (you can opt out at any time - see clause 10).

We may disclose personal information to:

• Service providers who help us operate the Services, including cloud hosting and infrastructure providers, payment processors (Stripe, Square), accounting integration platforms (Xero, QuickBooks), communications providers (Twilio, ClickSend, Resend), mapping and address-lookup providers (Mapbox), analytics and crash-reporting providers (e.g. Firebase/Google Analytics, Crashlytics/Sentry), mailbox providers you choose to connect (Google Gmail API; Microsoft Graph), and AI infrastructure and model providers supporting Kepd AI (Anthropic, Voyage AI, and, for voice/dictation only, Google Gemini and optionally OpenAI or Deepgram);
• Other users of the Platform, to the extent necessary for the Services to function - for example, sharing job or quote details between a tradesperson and the property manager/owner they are working with, or transferring a Property Logbook and related property records to a receiving organisation when administration of a property changes (see clause 2.8);
• Apple Inc. and Google LLC, as the operators of the App Store and Google Play, to the extent required to distribute, operate or support the App;
• Professional advisers, insurers and regulators, where reasonably necessary;
• A purchaser or prospective purchaser, in connection with a corporate transaction such as a merger, acquisition or sale of assets; and
• Law enforcement, courts or government authorities, where required or authorised by law.

We do not sell personal information to third parties for their own independent marketing purposes.

Some of our service providers (including cloud hosting, analytics, communications and AI infrastructure providers) store or process personal information on servers located in Australia, New Zealand and the United States, and may in some cases process personal information in other countries in which those providers operate. We will update this list if we are notified by a service provider of a material change to the countries in which they process personal information. Where we disclose personal information overseas, we take reasonable steps, consistent with APP 8 (and, where applicable, the NZ Privacy Act 2020), to ensure recipients handle personal information in a manner consistent with the APPs/IPPs, including through contractual protections with our service providers. By using the Services, you acknowledge that personal information may be handled outside Australia and New Zealand as described in this policy.

We implement technical and organisational measures designed to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including encryption in transit, access controls, and secure hosting arrangements with reputable providers. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a data breach likely to result in serious harm, we will notify affected individuals and the relevant regulator in accordance with the Notifiable Data Breaches scheme (and applicable New Zealand requirements).

Kepd AI is designed to assist users - for example, by extracting structured work-order fields from maintenance emails you import, drafting quotes, or suggesting next steps - based on the job, property and Customer Data available in your account. Kepd AI outputs are suggestions only; they do not make decisions that produce legal or similarly significant effects about individuals without a human (you) reviewing and choosing whether to act on them. You remain responsible for reviewing AI-generated content (such as quotes or messages) before sending it to a customer or relying on it. The kinds of personal information Kepd AI may use include account and profile information (such as your name and business details), Customer Data (such as a customer’s name, address, contact details and job or property history), job, quote and pricing information you input into the App, and, where you have connected Gmail or Outlook for email intake, the content of matching maintenance emails and their document attachments. Kepd AI uses this information to support decisions and suggestions including pre-filling work items from those emails, drafting quotes and messages, recommending next steps or scheduling options, and answering queries about a job or account.

Gmail message content is sent to Anthropic’s commercial API only to extract structured work-order fields for the Email intake feature the administrator enabled. Derived work-item records may later be used by Kepd AI (Anthropic) when a user asks about their jobs, and short work-item summaries may be embedded via Voyage AI so the in-app assistant can retrieve the organisation’s own records. Google Gemini Live is used only as a voice input/output shell and is not given Gmail content or other organisation data. Speech transcription providers (OpenAI, Deepgram, or Google, depending on configuration) receive microphone audio, not Gmail mailbox data.

We retain personal information for as long as reasonably necessary to provide the Services, meet legal, accounting, tax or regulatory obligations, resolve disputes, and enforce our agreements. Following closure of your Account, we will delete or de-identify your Account Data and Customer Data within 90 days, except where we are required or permitted by law to retain it for longer (for example, financial and invoicing records are commonly retained for at least seven years for tax purposes). More generally, when personal information is no longer required, we take reasonable steps to destroy or de-identify it, unless we are required by law to retain it for longer.

Property Logbook data is treated differently: because it is tied to the property rather than to any one Account, it is not deleted when the Account that created it closes, and administration of it (including the condition and compliance history it contains) may pass to a different Kepd organisation for as long as the property remains active on the Platform. See clause 2.8.

We may send you service-related notifications (e.g. job reminders, invoice alerts) which are necessary to the operation of the App and cannot be disabled while your account is active, other than through your device notification settings. Where we send marketing communications, you may opt out at any time using the unsubscribe mechanism in the communication or by contacting us using the details in clause 15.

Our website and App use cookies, SDKs and similar technologies for functionality, analytics, and to remember your preferences. You can manage cookie preferences through your browser settings, and control app-level tracking and notification permissions through your device settings.

Where you use the App to store or process personal information about your own customers, staff or contacts (Customer Data), you act as the party responsible for that information under privacy law, and Kepd processes it as your service provider and at your direction. You are responsible for:

• ensuring you have a lawful basis (including any necessary notice or consent) to collect and provide that information to us;
• the accuracy of the information you provide; and
• responding to access, correction or complaint requests from your own customers about their information, where Kepd is not the primary contact for that individual.

We will reasonably assist you to meet these obligations in relation to Customer Data stored in the App, including by providing tools to access, export or delete records.

The Services are business tools intended for use by tradespeople, trades businesses and property managers/owners, and are not directed at or intended for use by children. We do not knowingly collect personal information from individuals under 18. If you believe a child has provided us with personal information, please contact us using the details below so we can take appropriate action.

Subject to applicable exceptions under the Privacy Act 1988 (Cth) and, where relevant, the Privacy Act 2020 (NZ), you have the right to:

• request access to the personal information we hold about you;
• request correction of personal information that is inaccurate, out of date, incomplete, irrelevant or misleading;
• ask us to delete your account and associated personal information, subject to our legal and legitimate business retention requirements; and
• make a complaint about how we have handled your personal information.

You can exercise these rights, or make a complaint, by contacting us using the details in clause 15. We will respond within a reasonable period (and, in any event, in accordance with applicable law).

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or, for individuals in New Zealand, the Office of the Privacy Commissioner at privacy.org.nz.

For any questions, requests or complaints about this Privacy Policy or our handling of personal information, please contact us at:

• Eastmarket Investments Pty Ltd (trading as Kepd)
• ABN: 73 636 076 974
• Address: 10/100 Hay Street, Subiaco WA 6008, Australia
• Email: tech@kepd.com.au
• Website: https://kepd.com.au

We may update this Privacy Policy from time to time to reflect changes to our practices, the Services, or legal requirements. We will post the updated policy on our website and update the “Effective date” above, and, where changes are material, we will take reasonable steps to notify you (such as an in-app or email notice). Your continued use of the Services after an update constitutes acceptance of the revised policy.

The App may contain links to, or integrations with, third-party websites and services (such as Stripe, Square, Xero, QuickBooks, Twilio, ClickSend, Resend, Mapbox, Google (Gmail API), Microsoft, Anthropic, Voyage AI, OpenAI and Deepgram). This Privacy Policy does not apply to those third parties, and we encourage you to review their respective privacy policies before providing them with personal information or connecting them to your Kepd account.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Kepd’s Gmail integration is limited to the user-facing Email intake feature described in clause 2.9. In particular:

• We request only https://www.googleapis.com/auth/gmail.readonly. We do not send, modify, or delete Gmail data.
• Gmail data is used solely to provide and operate Email intake and related in-app work-item features the user has enabled. It is not used for advertising, sold to data brokers, or transferred except to subprocessors acting on our instructions to provide those features.
• We do not use, transfer, or sell Google user data (raw, aggregated, anonymised, or derived) to create, train, fine-tune, or improve foundational or generalised machine learning or artificial intelligence models.
• Anthropic is used under its Commercial Terms of Service, which prohibit Anthropic from training models on API customer content. For Voyage AI, we opt out of Voyage using customer content to train models, so content submitted after opt-out is processed with zero-day retention and is not used to train Voyage models. Google Gemini is not sent Gmail content.
• You may disconnect Gmail at any time from Settings → Integrations → Email. Disconnecting revokes our token and stops further access.