Retention Track - Privacy Policy

The Retention Track websites and platform (collectively referred to as the Platform throughout this document) are owned and operated by Retention Track Pty Ltd ABN 28 682 975 373 of Unit 15 / 5 Murphy Street, O’Connor, Western Australia 6163 (Retention Track). In this document, ‘we,’ ‘us’ and ‘our’ refers to Retention Track.

The Platform is a workflow management tool intended to assist businesses in tracking and managing retention money withheld under construction contracts – both retention withheld from the business and, for head contractors, retention the business withholds from its subcontractors – and in claiming and paying that retention when it falls due. The Platform serves customers in Australia, New Zealand and the United Kingdom.

This Privacy Policy sets out our policy for protecting the privacy of your personal information provided to us, or otherwise collected by us, offline or online, in connection with the Platform.

By accessing or using the Platform you consent to us using your personal information as set out in this Privacy Policy. If you access the Platform under an account, you also agree to be bound by the Access Terms available at app.retentiontrack.com/access-terms.

The types of personal information we collect depend on how you interact with the Platform. They include:

• Account information: name, work email address, password (stored as a hash), profile image, and the workspace and companies you belong to and your role in them;
• Workspace content: information you or other users in your workspace enter about your business, your contracts and subcontracts, your contractors and counterparties and their contact people, retention money withheld and released, retention securities, claims and their history, and related notes and records;
• Documents you upload: contracts, claim documents and other files you attach to records in the Platform;
• Information about people who are not users: the names, email addresses and roles of the contact people at your counterparties (for example a head contractor’s or principal’s accounts department, or a subcontractor’s director), whether entered by a user in your workspace or read from a connected accounting or job management system. We hold this information on behalf of the customer whose workspace it belongs to, and we use it to address the correspondence described in section 4;
• Business identifiers and registry records: the ABN, ACN, NZBN or Companies House number you enter for a company, together with the registry record we retrieve when verifying it (see section 5). For sole traders, a registry record can include an individual’s name;
• Accounting and job management connection data: where a company in your workspace connects Xero, MYOB or Fergus, the access credentials for that connection and the records we read from it, as described in section 5. Contacts read from those systems can carry an individual’s name and email address;
• Payment method information: where your workspace adds a card, the card is entered directly with Stripe and we never receive or store the card number or security code. What we hold is a reference to the billing record in Stripe;
• Communications: emails you send to us, support conversations you have with us through the in-app messenger, invitations you send to other users, and your notification preferences;
• Customer contact information: where your organisation is our customer, or has been in touch with us about becoming one, the name, email address, phone number and country of the people we deal with there, which we keep in our customer relationship records (see section 5);
• Records of claim correspondence the Platform sends: for the statutory claim correspondence and the related reminders, statements and reports the Platform sends on your instruction, we keep the information needed to reproduce each email exactly as it was sent, so that you have an accurate record of what was sent on your behalf;
• Technical data: IP address, browser type and version, device identifiers, time-zone setting, operating system, and the pages and features accessed;
• Usage and analytics data: product analytics and, within the signed-in Platform at app.retentiontrack.com, session replay events captured by PostHog to help us understand how the Platform is used (see section 12);
• Advertising measurement data: on our marketing website only, the pages of it you visit, how you use them and whether you book a demonstration, reported to Google and Meta so we can measure our advertising (see sections 5 and 12); and
• Demo booking information: if you book a demonstration through our marketing website, the name, email address and any other details you enter on the booking page, and the time you choose. The booking is taken for us by Calendly (see section 5), which passes those details to us, and we record them, with the advertisement you arrived from, in our customer relationship records. You do not need an account to book one, and booking does not create one.

We do not knowingly collect special categories of personal information (such as health, biometric or political data) and we ask that you do not upload such information to the Platform.

We collect personal information:

• directly from you, when you create an account, complete forms, upload documents, configure your workspace, or contact us;
• from other users in your workspace, when they invite you or record information about counterparties, contacts or contracts you work on;
• from public business registries – the Australian Business Register, the New Zealand Business Number register and Companies House – when a user in your workspace looks up a business identifier;
• from a connected accounting or job management system (Xero, MYOB or Fergus), where a user in your workspace connects one to a company and authorises the connection – both when we read from it and, for Xero, when it notifies us that a record has changed;
• from Stripe, when a card is added or a payment is made, as described in sections 2 and 5;
• automatically from your device and browser when you use the Platform, including through cookies and similar technologies (see section 12); and
• from our service providers (such as our hosting, email, support and analytics providers) acting on our behalf.

If you provide personal information to us about somebody else – for example the contact people at your counterparties – you represent and warrant that you are entitled to provide that information to us, based on this Privacy Policy.

We collect, hold, use and disclose personal information to provide, secure and improve the Platform. These purposes include:

• to create and administer your account, authenticate you, and manage workspace and company memberships;
• to deliver the core features of the Platform – tracking retention money across your contracts and subcontracts, preparing and sending claims and related correspondence, and keeping the resulting records;
• to send correspondence on your instruction: when a user in your workspace asks the Platform to send a payment claim, adjudication notice, reminder or statement, we send it by email to the contact people that user nominates, attributed to that user by name. The recipients are typically not users of the Platform. We keep the information needed to reproduce each such email exactly as sent, so the record remains available for audit and dispute purposes;
• to send you notifications about your own records – reminders about retention falling due, statements that are due to be issued, and a weekly summary. These are on by default because the Platform exists to keep you ahead of those dates; scheduled reminder and digest emails carry an unsubscribe link and can be turned off, and we do not use your email address to send you marketing. Operational emails (such as account verification, password resets and invitations) are part of providing the Platform and cannot be switched off while your account is open;
• to process payment of the per-contract fees described in our Access Terms, and keep records of your purchases;
• to respond to your enquiries and provide customer support, including by accessing your account where that is necessary to investigate a request or a fault (see below);
• to monitor performance, diagnose issues, detect and prevent fraud or abuse, and otherwise keep the Platform secure;
• to measure the effectiveness of our advertising on our marketing website – how many people who saw an advertisement for Retention Track went on to visit the site, and what they read – so that we can decide what to keep paying for (see section 12). We do not do this inside the Platform;
• to decide who sees our advertisements on Meta’s services – chiefly so that our existing customers and people who have already booked a demonstration are not shown them, and so that people who use Retention Track can be shown our other product, paymentclaims.ai (see section 5);
• to understand how the Platform is used and to improve it; and
• to comply with our legal obligations and resolve any disputes that we may have.

When our staff access your account. Personnel we authorise may access your account and workspace where that is reasonably necessary to investigate a request for support, to diagnose or correct a fault, to prevent or investigate misuse of the Platform, or to comply with a legal obligation. That access can include signing in to the Platform as one of your users; a staff member signed in that way sees what that user sees – which can include any of the categories described in section 2 – and we limit what they do to what the request requires. While such access is in progress, the Platform marks the session as belonging to the staff member using it, no session replay recording is made of what our staff do in your account, and no product analytics event is recorded against you for what they do. Summary information about your account’s configuration – such as whether an accounting integration is connected – continues to update, because it describes your account rather than our staff’s activity. This is access by our own personnel and is not a disclosure of your information to anyone else; section 5 sets out who we do share it with.

We do not email you each time this happens, and we do not currently keep a permanent log of past staff access. If you have questions or concerns about staff access to your account, contact us at privacy@retentiontrack.com.

We share personal information only where necessary to operate the Platform or as permitted by law. Our sub-processors and the other recipients of personal information are:

• Supabase – managed database and file storage. The records and documents in your workspace are stored here;
• Vercel – application hosting and delivery;
• Inngest – background job processing (for example scheduled reminders and accounting-system synchronisation);
• Postmark – email delivery. Every email the Platform sends passes through Postmark, including correspondence to recipients who are not users;
• Stripe – payment processing. Cards are collected by Stripe directly; we never receive or store the card number or security code. Payments for contract activations are made on a checkout page hosted by Stripe, and each payment identifies the workspace and contract it is for so that your receipt says what you paid for;
• PostHog – product analytics and, within the signed-in Platform at app.retentiontrack.com, session replay (see section 12);
• Intercom – customer support messaging. When you use the in-app messenger, your identity and the messages you exchange with us are processed by Intercom;
• Google – address autocomplete (Google Places): as you type an address into the Platform, the partial text is sent to Google to return matching suggestions, and we store only the address you keep;
• Google Analytics – advertising and traffic measurement on our marketing website (see section 12). Google’s tag tells Google that a browser visited a page of our marketing website and, where you book a demonstration there, that a booking was completed. It is not told your name, your email address, the time you chose or any other detail of the booking. Where that browser is signed in to a Google account, Google can associate the visit with that account. It is not used on the Platform, and we do not send Google anything you enter into the Platform. This is separate from the address autocomplete described above, which is a Platform feature and reports nothing about your browsing;
• Attio – our customer relationship records. We keep there the name, email address, phone number and country of the people we deal with at our customers and at organisations that have been in touch with us about becoming one. If you book a demonstration, your name, email address, booking time and the advertisement you arrived from are recorded there;
• Meta Platforms – advertising measurement on our marketing website (see section 12), and matching for the audiences of our advertisements. Meta’s pixel tells Meta which pages of our marketing website a browser visited and how it used them — for example, how far down a page it read and which of our buttons it used — and, where you book a demonstration there, that the calendar was shown and that a booking was completed. For a booking, we also send Meta, from our own server, a one-way hashed form of your name and email address so Meta can match the booking to its own records; we never send the time you chose or anything else you entered, and we send nothing at all where we would not load the pixel for you (see section 12). We also send Meta a one-way hashed form of the name, email address, phone number and country of our customers and of people who have booked a demonstration or otherwise been in touch with us about becoming one, so that Meta can leave them out of, or include them in, the audiences for our advertisements. Meta uses the hashed data only to match it to its own users and deletes it once the match is done. You can ask us to leave you out by emailing privacy@retentiontrack.com. Where that browser is signed in to a Meta service, Meta can associate the visit with that account. It is not used on the Platform, and apart from the hashed customer details described above, we do not send Meta anything you enter into the Platform;
• Calendly – demo booking. Our marketing website embeds Calendly’s scheduling page on its demo booking page; where we ask for your consent, it loads only after you accept cookies or choose to load it (see section 12), and Calendly receives the name, email address and any meeting details you enter, together with the time you select, and passes them to us so that we can hold the meeting;
• Xero – accounting integration, for companies that choose to connect one. Where a company is connected we read that Xero organisation’s contacts, chart of accounts, tax rates, invoices (including their line items and payments), credit notes and manual journals, so the Platform can find and track the retention money recorded in them. On your instruction we also write to that organisation – invoices raised when retention is claimed or released, and manual journals recording retention movements;
• MYOB – accounting integration for Australia and New Zealand, for companies that choose to connect one. Where a company file is connected we read its accounts, invoices (including credit notes), general journals and customer contacts for the same purpose, and, where you ask the Platform to set up a retention account, we create that account in the company file;
• Fergus – job management integration, for companies that choose to connect one. Where a Fergus account is connected we read its business details, jobs (including customer names), customers and invoices so contracts and invoices can be brought into the Platform. We do not write to Fergus;
• business registries – when a user looks up a business identifier, we send the identifier or name entered to the relevant registry (the Australian Business Register, operated by the Australian Taxation Office; the New Zealand Business Number register, operated by the Ministry of Business, Innovation and Employment; or Companies House in the United Kingdom) and store the record returned; and
• the recipients of your correspondence – when a user in your workspace sends a claim, notice, reminder or statement through the Platform, we send it to the contact people that user nominates, together with any documents they attach.

We may also disclose personal information to our professional advisers, to related entities, to anyone to whom our business or assets (or any part of them) are, or may in good faith be, transferred, and to courts, tribunals, regulatory authorities and law enforcement officers in accordance with applicable law.

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes.

Several of our sub-processors are based, or process data, outside Australia. In particular, Supabase, Vercel, Inngest, Postmark, Stripe, PostHog, Intercom, Calendly, Google, Meta and Attio process data in the United States or the European Union. Xero is headquartered in New Zealand and runs its platform on infrastructure in Australia and other countries. MYOB processes data in Australia, and Fergus in New Zealand. If you are in New Zealand or the United Kingdom, your information will also be processed in Australia, where we are based.

Where we transfer personal information overseas, we take reasonable steps to ensure that the recipient handles it in accordance with applicable privacy laws, including (where relevant) by relying on contractual safeguards such as Standard Contractual Clauses or equivalent protections.

Subject to certain limitations and restrictions (e.g. depending on circumstances such as where you reside) you may have the right to exercise certain rights in relation to your personal information, including the following:

• The right of access to personal information we hold about you.
• The right to know what personal information we collect about you, and how it is used and shared.
• The right of rectification to update your personal information if it is inaccurate or incomplete.
• The right to erasure/deletion (‘right to be forgotten’) of your personal information.
• The right to object to our use and handling of your personal information.
• The right to restrict our handling of your personal information.
• The right of data portability for transfer of your personal information to another party.
• The right to withdraw consent you have previously provided to our handling of personal information.

Please note that in order to verify your request or the applicability of any of these rights to your circumstances, we may ask you for further information and to verify your identity before responding to such requests.

Where a request relating to any of the above rights has been made and information has been shared with third parties, we will take all reasonable steps to notify third parties of the request.

If you have any questions about these privacy rights, or how to exercise them, please contact us using the contact details at the bottom of this Privacy Policy. We will confirm receipt of your request and provide information on how we intend to respond. Further, we will respond to your request in accordance with permitted or required timeframes set out in applicable laws.

Please contact us as set out in clause 16 below if you wish to make any of these requests.

These provisions apply if our use of your personal information is subject to the European General Data Protection Regulation (Regulation (EU) 2016/679) or its UK equivalent (together the GDPR). In respect of your account information, analytics data, customer contact information and demo booking information we act as a controller; in respect of the workspace content you and other users enter on behalf of your organisation – including information about people who are not users – we act as a processor for that organisation. We rely on the following legal bases:

Where processing your personal information is necessary for us to provide the Platform or for our legitimate interests

• We may process certain personal information about you in order to provide you with the Platform and any services we agree to provide you.
• We may process your personal information for the purposes of our legitimate interests, for example, in order to: enforce the terms of our website, analyse log data/user statistics to improve the Platform for all users, communicate with you about your access to the Platform, ensure that the Platform runs smoothly and to respond to any of your questions, feedback, claims or disputes.
• Where you are one of our customers, we may send Meta a one-way hashed form of your contact details so that you are left out of our advertisements on Meta’s services (see section 5). That is in your interest as well as ours, because it stops us showing you advertisements for a product you already use. If you are in the United Kingdom or the European Economic Area, we use your details only to leave you out of our advertisements, never to include you in the audience for one.

We do not think that any of our data processing activities prejudice individuals in any way. However, you do have the right to object to us processing your personal information on this basis. Please refer to clause 7 for more details about exercising your rights.

Where you give us your consent to process your personal information

We ask for your consent before setting analytics cookies (see section 12), and we will obtain your opt-in consent prior to carrying out any marketing activities. You have the right to withdraw your consent to these activities. Please refer to clause 7 for more details about exercising your rights.

Where processing your personal information is necessary for our compliance with a legal obligation

In certain circumstances, we may disclose your personal information for the purposes of compliance with a legal obligation (for example, to comply with a law, regulation or compulsory legal request).

International transfers

If you are based within the UK/EU we will only process and/or transfer data outside of the United Kingdom or the European Economic Area or EEA (i.e. the Member States of the European Union, together with Norway, Iceland and Liechtenstein) where it is compliant with the GDPR and the means of transfer provides adequate safeguards in relation to your personal information or where you have otherwise consented to the data transfer. Section 6 describes where our sub-processors process data.

If you are in New Zealand, the Privacy Act 2020 (NZ) and its Information Privacy Principles apply to our handling of your personal information. You have rights to access and correct the personal information we hold about you, which you can exercise as described in clause 7. Your information may be held and processed in Australia and in the other locations described in clause 6; we take reasonable steps to ensure comparable safeguards apply. If you have a privacy concern we cannot resolve, you may complain to the Office of the Privacy Commissioner as described in clause 15.

We do not knowingly collect personal information from children under 16 through the Platform. If we become aware that a child under 16 has provided us with personal information in connection with the Platform, we will take steps to delete such information. If you become aware that a child has provided us with personal information, please contact the Retention Track support team.

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure. These include encryption in transit and at rest, access controls, and contractual obligations on our sub-processors. Information is held in electronic form with the service providers described in section 5. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

We use a small number of cookies and similar technologies:

• Strictly necessary cookies that keep you signed in and remember your preferences. These are always set and cannot be disabled.
• Analytics and session replay cookies set by PostHog, our analytics provider, on both our marketing website (retentiontrack.com) and the Platform itself. Whether these are set with your consent or on the basis of this notice depends on where you are visiting from, as described below.
• Support messenger cookies set by Intercom within the signed-in Platform, which keep your support conversation with us continuous.
• Advertising and measurement cookies set by Google (Google Analytics) and by Meta on our marketing website only. We advertise Retention Track on Google’s and Meta’s services, and their tag and pixel tell us how many people who saw an advertisement went on to visit the site, which pages they read and how they used them, and how many went on to book a demonstration, so that we can stop paying for advertisements that do not work. Where your browser is signed in to a Google or Meta service, that company can associate the visit with your account there and use it to decide which of our advertisements to show you.

Where the law requires your consent before analytics cookies are set, we ask for it with a consent banner. We show that banner to visitors in the United Kingdom, the Channel Islands, the Isle of Man, Gibraltar and the European Economic Area. We do not show it to visitors from anywhere else, including Australia, New Zealand and the United States, where analytics cookies may be set on the basis of this notice rather than your consent. If we cannot tell which country you are visiting from, we show the banner. Your decision is stored in a cookie shared across the marketing website and the Platform, so a choice made on one applies to the other. Where we do not ask, the same record is shared in the same way: if you visit our marketing website from a country where we do not ask and then create an account, the Platform treats analytics as accepted and does not ask you again. This includes the session replay described below, which begins once you are signed in.

If you are shown the banner, nothing is captured until you answer. If you decline, analytics runs without cookies and without any persistent identifier. If you accept, or if you are visiting from a country where we do not ask, PostHog sets its cookies so that your visits can be connected.

Our analytics measure page views, feature usage and interactions (including automatically captured clicks and form interactions) and client-side errors. Analytics requests are sent via our own domain to PostHog. Within the signed-in Platform at app.retentiontrack.com we also use session replay to diagnose issues and improve the Platform: what you type into the Platform is masked by default and does not form part of the recording, and surfaces the Platform marks as private are masked as well. Session replay begins only once you are signed in, so it does not run on the marketing website, and it does not run on the Platform’s signed-out pages – sign-in, sign-up, invitation acceptance, and this policy. It is also switched off while our personnel are signed in to your account, as described in section 4.

Google’s tag and Meta’s pixel load on our marketing website only, and only on the same terms as the analytics cookies above: once you accept the banner, or once we have established that you are visiting from a country where we do not ask. They do not load while you are deciding, they do not load if you decline, and they do not load at all where your browser sends a Global Privacy Control signal, whatever your answer to the banner. The copy of a demonstration booking we send Meta from our own server (see section 5) is sent only where these same conditions would let Meta’s pixel load for you: never while you are deciding, never if you decline, and never where your browser sends a Global Privacy Control signal. We do not use advertising cookies within the Platform at app.retentiontrack.com: signing in, the work you do in the Platform and the documents you upload are not reported to any advertising network. If you are one of our customers, a hashed form of your contact details is sent to Meta as described in section 5, and nothing else about your use of the Platform.

Our marketing website’s demo booking page embeds Calendly’s scheduling page, and Calendly sets its own cookies and receives what you type into it, as described in section 5. Where we ask for your consent, the scheduler does not load when the page is opened: it loads only after you accept cookies or choose to load it. Where we do not ask, it loads with the page.

The Platform may contain links to other websites. We do not have any control over those websites and we are not responsible for the protection and privacy of any personal information which you provide whilst visiting those websites. Those websites are not governed by this Privacy Policy.

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended Privacy Policy on the Platform. If we decide to change our Privacy Policy, we will update the Privacy Policy modification date below.

This policy was last modified on 7 October 2026.

We take your privacy concerns seriously. If you have a complaint regarding our handling of your personal information or concerning our privacy practices, you may file a complaint with us using the contact details set out at the bottom of this Privacy Policy. We will confirm receipt of your complaint and, where appropriate, open an investigation into your complaint.

We may need to contact you to request further details of your complaint. If an investigation has been opened following a complaint made by you, then we will contact you with the result of that complaint as soon as possible. In the unlikely circumstances we are unable to resolve your complaint to your satisfaction, you have the right to lodge a complaint with the relevant privacy data protection authority in your jurisdiction. For reference, we set out below the identity of some of the relevant authorities:

• If you reside in Australia, your data protection authority is the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/
• If you reside in New Zealand, your data protection authority is the Office of the Privacy Commissioner (OPC): https://www.privacy.org.nz/
• If you reside in the United Kingdom, your data protection authority is the Information Commissioner’s Office (ICO): https://ico.org.uk/
• If you reside in the EU and you are unsure of who the data protection authority is in your country, please refer to this link: https://edpb.europa.eu/about-edpb/board/members_en

For any questions or notices, please contact us at:

Email: privacy@retentiontrack.com

Mailing Address:
Retention Track Pty Ltd
Unit 15, 5 Murphy Street
O’Connor 6163
Western Australia