Retention Track - Privacy Policy

The Retention Track websites and platform (collectively referred to as the Platform throughout this document) are owned and operated by Retention Track Pty Ltd ABN 28 682 975 373 of Unit 15 / 5 Murphy Street, O’Connor, Western Australia 6163 (Retention Track). In this document, ‘we,’ ‘us’ and ‘our’ refers to Retention Track.

The Platform is a workflow management tool intended to assist businesses in tracking and managing retention money withheld under construction contracts – both retention withheld from the business and, for head contractors, retention the business withholds from its subcontractors – and in claiming and paying that retention when it falls due. The Platform serves customers in Australia, New Zealand and the United Kingdom.

This Privacy Policy sets out our policy for protecting the privacy of your personal information provided to us, or otherwise collected by us, offline or online, in connection with the Platform.

By accessing or using the Platform you consent to us using your personal information as set out in this Privacy Policy. If you access the Platform under an account, you also agree to be bound by the Access Terms available at app.retentiontrack.com/access-terms.

The types of personal information we collect depend on how you interact with the Platform. They include:

• Account information: name, work email address, password (stored as a hash), profile image, and the workspace and companies you belong to and your role in them;
• Workspace content: information you or other users in your workspace enter about your business, your contracts and subcontracts, your contractors and counterparties and their contact people, retention money withheld and released, retention securities, claims and their history, and related notes and records;
• Documents you upload: contracts, claim documents and other files you attach to records in the Platform;
• Information about people who are not users: the names, email addresses and roles of the contact people at your counterparties (for example a head contractor’s or principal’s accounts department, or a subcontractor’s director), whether entered by a user in your workspace or read from a connected accounting or job management system. We hold this information on behalf of the customer whose workspace it belongs to, and we use it to address the correspondence described in section 4;
• Business identifiers and registry records: the ABN, ACN, NZBN or Companies House number you enter for a company, together with the registry record we retrieve when verifying it (see section 5). For sole traders, a registry record can include an individual’s name;
• Accounting and job management connection data: where a company in your workspace connects Xero, MYOB or Fergus, the access credentials for that connection and the records we read from it, as described in section 5. Contacts read from those systems can carry an individual’s name and email address;
• Payment method information: where your workspace adds a card, the card is entered directly with Stripe and we never receive or store the card number or security code. What we hold is a reference to the billing record in Stripe;
• Communications: emails you send to us, support conversations you have with us through the in-app messenger, invitations you send to other users, and your notification preferences;
• Records of claim correspondence the Platform sends: for the statutory claim correspondence and the related reminders, statements and reports the Platform sends on your instruction, we keep the information needed to reproduce each email exactly as it was sent, so that you have an accurate record of what was sent on your behalf;
• Technical data: IP address, browser type and version, device identifiers, time-zone setting, operating system, and the pages and features accessed; and
• Usage and analytics data: product analytics and, on the Platform at app.retentiontrack.com, session replay events captured by PostHog to help us understand how the Platform is used (see section 12).

We do not knowingly collect special categories of personal information (such as health, biometric or political data) and we ask that you do not upload such information to the Platform.

We collect personal information:

• directly from you, when you create an account, complete forms, upload documents, configure your workspace, or contact us;
• from other users in your workspace, when they invite you or record information about counterparties, contacts or contracts you work on;
• from public business registries – the Australian Business Register, the New Zealand Business Number register and Companies House – when a user in your workspace looks up a business identifier;
• from a connected accounting or job management system (Xero, MYOB or Fergus), where a user in your workspace connects one to a company and authorises the connection – both when we read from it and, for Xero, when it notifies us that a record has changed;
• from Stripe, when a card is added or a payment is made, as described in sections 2 and 5;
• automatically from your device and browser when you use the Platform, including through cookies and similar technologies (see section 12); and
• from our service providers (such as our hosting, email, support and analytics providers) acting on our behalf.

If you provide personal information to us about somebody else – for example the contact people at your counterparties – you represent and warrant that you are entitled to provide that information to us, based on this Privacy Policy.

We collect, hold, use and disclose personal information to provide, secure and improve the Platform. These purposes include:

• to create and administer your account, authenticate you, and manage workspace and company memberships;
• to deliver the core features of the Platform – tracking retention money across your contracts and subcontracts, preparing and sending claims and related correspondence, and keeping the resulting records;
• to send correspondence on your instruction: when a user in your workspace asks the Platform to send a payment claim, adjudication notice, reminder or statement, we send it by email to the contact people that user nominates, attributed to that user by name. The recipients are typically not users of the Platform. We keep the information needed to reproduce each such email exactly as sent, so the record remains available for audit and dispute purposes;
• to send you notifications about your own records – reminders about retention falling due, statements that are due to be issued, and a weekly summary. These are on by default because the Platform exists to keep you ahead of those dates; scheduled reminder and digest emails carry an unsubscribe link and can be turned off, and we do not use your email address for marketing. Operational emails (such as account verification, password resets and invitations) are part of providing the Platform and cannot be switched off while your account is open;
• to process payment of the per-contract fees described in our Access Terms, and keep records of your purchases;
• to respond to your enquiries and provide customer support, including by accessing your account where that is necessary to investigate a request or a fault (see below);
• to monitor performance, diagnose issues, detect and prevent fraud or abuse, and otherwise keep the Platform secure;
• to understand how the Platform is used and to improve it; and
• to comply with our legal obligations and resolve any disputes that we may have.

When our staff access your account. Personnel we authorise may access your account and workspace where that is reasonably necessary to investigate a request for support, to diagnose or correct a fault, to prevent or investigate misuse of the Platform, or to comply with a legal obligation. That access can include signing in to the Platform as one of your users; a staff member signed in that way sees what that user sees – which can include any of the categories described in section 2 – and we limit what they do to what the request requires. While such access is in progress, the Platform marks the session as belonging to the staff member using it. This is access by our own personnel and is not a disclosure of your information to anyone else; section 5 sets out who we do share it with.

We do not email you each time this happens, and we do not currently keep a permanent log of past staff access. If you have questions or concerns about staff access to your account, contact us at privacy@retentiontrack.com.

We share personal information only where necessary to operate the Platform or as permitted by law. Our sub-processors and the other recipients of personal information are:

• Supabase – managed database and file storage. The records and documents in your workspace are stored here;
• Vercel – application hosting and delivery;
• Inngest – background job processing (for example scheduled reminders and accounting-system synchronisation);
• Postmark – email delivery. Every email the Platform sends passes through Postmark, including correspondence to recipients who are not users;
• Stripe – payment processing. Cards are collected by Stripe directly; we never receive or store the card number or security code. Payments for contract activations are made on a checkout page hosted by Stripe, and each payment identifies the workspace and contract it is for so that your receipt says what you paid for;
• PostHog – product analytics and, on the Platform at app.retentiontrack.com, session replay (see section 12);
• Intercom – customer support messaging. When you use the in-app messenger, your identity and the messages you exchange with us are processed by Intercom;
• Google – address autocomplete (Google Places): as you type an address into the Platform, the partial text is sent to Google to return matching suggestions, and we store only the address you keep. Separately, our marketing website embeds Google’s appointment scheduler on its demo booking page; it loads only after you accept cookies or choose to load it, and it receives the name, email address and meeting details you type into it;
• Xero – accounting integration, for companies that choose to connect one. Where a company is connected we read that Xero organisation’s contacts, chart of accounts, tax rates, invoices (including their line items and payments), credit notes and manual journals, so the Platform can find and track the retention money recorded in them. On your instruction we also write to that organisation – invoices raised when retention is claimed or released, and manual journals recording retention movements;
• MYOB – accounting integration for Australia and New Zealand, for companies that choose to connect one. Where a company file is connected we read its accounts, invoices (including credit notes), general journals and customer contacts for the same purpose, and, where you ask the Platform to set up a retention account, we create that account in the company file;
• Fergus – job management integration, for companies that choose to connect one. Where a Fergus account is connected we read its business details, jobs (including customer names), customers and invoices so contracts and invoices can be brought into the Platform. We do not write to Fergus;
• business registries – when a user looks up a business identifier, we send the identifier or name entered to the relevant registry (the Australian Business Register, operated by the Australian Taxation Office; the New Zealand Business Number register, operated by the Ministry of Business, Innovation and Employment; or Companies House in the United Kingdom) and store the record returned; and
• the recipients of your correspondence – when a user in your workspace sends a claim, notice, reminder or statement through the Platform, we send it to the contact people that user nominates, together with any documents they attach.

We may also disclose personal information to our professional advisers, to related entities, to anyone to whom our business or assets (or any part of them) are, or may in good faith be, transferred, and to courts, tribunals, regulatory authorities and law enforcement officers in accordance with applicable law.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Several of our sub-processors are based, or process data, outside Australia. In particular, Supabase, Vercel, Inngest, Postmark, Stripe, PostHog, Intercom and Google process data in the United States or the European Union. Xero is headquartered in New Zealand and runs its platform on infrastructure in Australia and other countries. MYOB processes data in Australia, and Fergus in New Zealand. If you are in New Zealand or the United Kingdom, your information will also be processed in Australia, where we are based.

Where we transfer personal information overseas, we take reasonable steps to ensure that the recipient handles it in accordance with applicable privacy laws, including (where relevant) by relying on contractual safeguards such as Standard Contractual Clauses or equivalent protections.

Subject to certain limitations and restrictions (e.g. depending on circumstances such as where you reside) you may have the right to exercise certain rights in relation to your personal information, including the following:

• The right of access to personal information we hold about you.
• The right to know what personal information we collect about you, and how it is used and shared.
• The right of rectification to update your personal information if it is inaccurate or incomplete.
• The right to erasure/deletion (‘right to be forgotten’) of your personal information.
• The right to object to our use and handling of your personal information.
• The right to restrict our handling of your personal information.
• The right of data portability for transfer of your personal information to another party.
• The right to withdraw consent you have previously provided to our handling of personal information.

Please note that in order to verify your request or the applicability of any of these rights to your circumstances, we may ask you for further information and to verify your identity before responding to such requests.

Where a request relating to any of the above rights has been made and information has been shared with third parties, we will take all reasonable steps to notify third parties of the request.

If you have any questions about these privacy rights, or how to exercise them, please contact us using the contact details at the bottom of this Privacy Policy. We will confirm receipt of your request and provide information on how we intend to respond. Further, we will respond to your request in accordance with permitted or required timeframes set out in applicable laws.

Please contact us as set out in clause 16 below if you wish to make any of these requests.

These provisions apply if our use of your personal information is subject to the European General Data Protection Regulation (Regulation (EU) 2016/679) or its UK equivalent (together the GDPR). In respect of your account information and analytics data we act as a controller; in respect of the workspace content you and other users enter on behalf of your organisation – including information about people who are not users – we act as a processor for that organisation. We rely on the following legal bases:

Where processing your personal information is necessary for us to provide the Platform or for our legitimate interests

• We may process certain personal information about you in order to provide you with the Platform and any services we agree to provide you.
• We may process your personal information for the purposes of our legitimate interests, for example, in order to: enforce the terms of our website, analyse log data/user statistics to improve the Platform for all users, communicate with you about your access to the Platform, ensure that the Platform runs smoothly and to respond to any of your questions, feedback, claims or disputes.

We do not think that any of our data processing activities prejudice individuals in any way. However, you do have the right to object to us processing your personal information on this basis. Please refer to clause 7 for more details about exercising your rights.

Where you give us your consent to process your personal information

We ask for your consent before setting analytics cookies (see section 12), and we will obtain your opt-in consent prior to carrying out any marketing activities. You have the right to withdraw your consent to these activities. Please refer to clause 7 for more details about exercising your rights.

Where processing your personal information is necessary for our compliance with a legal obligation

In certain circumstances, we may disclose your personal information for the purposes of compliance with a legal obligation (for example, to comply with a law, regulation or compulsory legal request).

International transfers

If you are based within the UK/EU we will only process and/or transfer data outside of the United Kingdom or the European Economic Area or EEA (i.e. the Member States of the European Union, together with Norway, Iceland and Liechtenstein) where it is compliant with the GDPR and the means of transfer provides adequate safeguards in relation to your personal information or where you have otherwise consented to the data transfer. Section 6 describes where our sub-processors process data.

If you are in New Zealand, the Privacy Act 2020 (NZ) and its Information Privacy Principles apply to our handling of your personal information. You have rights to access and correct the personal information we hold about you, which you can exercise as described in clause 7. Your information may be held and processed in Australia and in the other locations described in clause 6; we take reasonable steps to ensure comparable safeguards apply. If you have a privacy concern we cannot resolve, you may complain to the Office of the Privacy Commissioner as described in clause 15.

We do not knowingly collect personal information from children under 16 through the Platform. If we become aware that a child under 16 has provided us with personal information in connection with the Platform, we will take steps to delete such information. If you become aware that a child has provided us with personal information, please contact the Retention Track support team.

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encryption in transit and at rest, access controls, and contractual obligations on our sub-processors. Information is held in electronic form with the service providers described in section 5. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We use a small number of cookies and similar technologies:

• Strictly necessary cookies that keep you signed in and remember your preferences. These are always set and cannot be disabled.
• Analytics and session replay cookies set by PostHog, our analytics provider, on both our marketing website (retentiontrack.com) and the Platform itself. These are set only if you accept them.
• Support messenger cookies set by Intercom within the signed-in Platform, which keep your support conversation with us continuous.

A consent banner is shown on both the marketing website and the Platform. Your decision is stored in a cookie shared across both hostnames, so a choice made on one applies to the other. Until you decide, and if you decline, analytics runs without cookies and without any persistent identifier; if you accept, PostHog sets its cookies so that your visits can be connected.

Our analytics measure page views, feature usage and interactions (including automatically captured clicks and form interactions) and client-side errors. Analytics requests are sent via our own domain to PostHog. On the Platform at app.retentiontrack.com we also use session replay to diagnose issues and improve the Platform, whether or not you are signed in: what you type into the Platform is masked by default and does not form part of the recording, and surfaces the Platform marks as private are masked as well. Session replay is not used on the marketing website. We do not use advertising cookies.

Our marketing website’s demo booking page embeds Google’s appointment scheduler. The scheduler does not load when the page is opened: it loads only after you accept cookies or choose to load it, at which point Google sets its own cookies and receives what you type into it, as described in section 5.

The Platform may contain links to other websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Privacy Policy on the Platform. If we decide to change our Privacy Policy, we will update the Privacy Policy modification date below.

This policy was last modified on 22 August 2026.

We take your privacy concerns seriously. If you have a complaint regarding our handling of your personal information or concerning our privacy practices, you may file a complaint with us using the contact details set out at the bottom of this Privacy Policy. We will confirm receipt of your complaint and, where appropriate, open an investigation into your complaint.

We may need to contact you to request further details of your complaint. If an investigation has been opened following a complaint made by you, then we will contact you with the result of that complaint as soon as possible. In the unlikely circumstances we are unable to resolve your complaint to your satisfaction, you have the right to lodge a complaint with the relevant privacy data protection authority in your jurisdiction. For reference, we set out below the identity of some of the relevant authorities:

• If you reside in Australia, your data protection authority is the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/
• If you reside in New Zealand, your data protection authority is the Office of the Privacy Commissioner (OPC): https://www.privacy.org.nz/
• If you reside in the United Kingdom, your data protection authority is the Information Commissioner’s Office (ICO): https://ico.org.uk/
• If you reside in the EU and you are unsure of who the data protection authority is in your country, please refer to this link: https://edpb.europa.eu/about-edpb/board/members_en

For any questions or notices, please contact us at:

Email: privacy@retentiontrack.com

Mailing Address:
Retention Track Pty Ltd
Unit 15, 5 Murphy Street
O’Connor 6163
Western Australia