Wattlebase

Legal

Privacy Policy

Last updated 8 October 2026

We operate Wattlebase, a browser-based quoting, invoicing and job management service for Australian small businesses. This policy explains how we collect, use, disclose and protect personal information when you visit or use the service.

Information we collect

The information handled by Wattlebase depends on how you use the service and may include:

• Account holder information: your name, email address, authentication identifiers and account status.
• Team member information: if a business invites staff, their name, email address, access level (Owner, Office or Field), the jobs assigned to them and a record of who created or changed key items.
• Business profile information: business name, ABN, logo, contact details, document preferences and account settings.
• Customer and contact information: names, business details, email addresses, phone numbers, addresses, ABNs and notes entered by an account holder.
• Quote, invoice and job information: document numbers, descriptions, prices, GST, dates, terms, status, delivery history, quote responses or signatures, job schedules, site addresses and photos added to quotes or jobs.
• Payment information: when a customer pays an invoice or deposit online, the amount, date, status, any refund and Stripe payment identifiers. Stripe processes card and payment details; Wattlebase does not store full card numbers.
• Billing information: subscription plan, billing status and payment-provider identifiers for your Wattlebase subscription.
• Technical and security information: IP address and request, path, error or security-event information needed to operate, protect and diagnose the service.
• Website usage information: page views, referring websites and general device, browser and country information, collected without cookies to understand how the website is used.
• Support and communications: information you provide when requesting help or otherwise contacting Wattlebase.

Information entered about your customers

Account holders may enter personal information about their own customers or contacts when creating customer records, quotes, invoices and jobs. This can include people at a customer’s job address, such as a tenant whose name, phone number, email and access notes a business records to arrange a visit. The account holder is responsible for having authority to provide and use that information and for complying with privacy obligations that apply to their business.

Wattlebase processes this information on the account holder’s behalf to host records, create and deliver documents, record responses and payments, send reminders and review requests the business has switched on, and otherwise provide the service. Wattlebase does not independently use customer information entered by an account holder for unrelated purposes.

If you received a quote or invoice through Wattlebase

If a business sent you a quote, invoice, receipt, appointment reminder, “on my way” message or review request through Wattlebase (including as a tenant at a property the business was sent to), that business decides what information about you is held and how it is used. Please contact the business first with questions or requests about your information. You can also email us and we will pass your request on or help where we can.

When you pay a business online, you pay the business directly through its own Stripe account. Stripe’s privacy policy applies to the card and payment details you enter on the Stripe payment page.

Teams and shared workspaces

A business can invite staff to its workspace. Everyone in a workspace can see business information according to the access the owner gives them; for example, Field access hides prices, invoices and reports. The workspace owner controls who is invited and can remove access at any time. Work done by a team member stays with the business after they leave.

How we use information

Wattlebase uses information where reasonably necessary to:

• operate, maintain and provide the service;
• authenticate users and manage accounts, workspaces and team access;
• create, display, download and deliver quotes, invoices, receipts, reminders and review requests (each review request email has a link to stop them);
• process and record online payments and refunds for businesses that use them;
• send information to connected services, such as Xero, when a business chooses to connect them;
• provide customer support and service communications;
• administer trials, subscriptions and billing;
• detect or prevent fraud, abuse, unlawful activity and security threats;
• diagnose faults and improve product reliability and usability; and
• meet applicable legal, regulatory and dispute-resolution obligations.

We do not sell personal information.

Service providers

Wattlebase relies on specialist providers to operate the service. Information is disclosed to them only as reasonably needed for their role:

• Clerk provides account authentication and identity services.
• Neon provides PostgreSQL database infrastructure.
• Vercel hosts and delivers the web application, stores uploaded files such as photos, and provides cookie-free website analytics and performance measurement.
• Resend delivers service emails, including quotes, invoices, receipts, reminders and account notices.
• Stripe provides subscription checkout and billing management for Wattlebase, and processes online invoice and deposit payments through each business’s own Stripe account.
• Sentry receives limited, filtered application-error information for reliability monitoring.
• Upstash briefly holds request counts, such as an IP address or account identifier with a counter, so rate limits can protect the service from abuse.
• Xero receives invoices, customer details and payments when a business connects its Xero account.
• Google provides address suggestions when someone searches for an address, and Google Ads conversion measurement so Wattlebase can understand whether advertising leads to visits and sign-ups. When someone signs up, their email address is scrambled (hashed) in their browser before it is sent to Google, which uses it only to match the sign-up to an ad click; Google does not receive the address itself.

These providers handle information under their own terms, privacy practices and security arrangements. Wattlebase may also disclose information where required by law, to protect legal rights or security, or as part of a business transaction subject to appropriate safeguards.

Overseas processing

Some service providers may process or store information outside Australia. The location may depend on the provider, service configuration and infrastructure used at the time. Wattlebase does not state a specific country unless that location has been verified.

Data security

Wattlebase uses reasonable technical and organisational safeguards appropriate to the service, including authenticated workspaces, role-based team access, encrypted connections, rate limits, restricted document and payment links, signed payment webhooks and monitoring designed to exclude unnecessary personal information.

No online service can guarantee absolute security. Account holders should use a strong password, protect their email account and devices, remove team members who no longer need access, and promptly contact Wattlebase if they suspect unauthorised access.

Data breaches and security incidents

If Wattlebase becomes aware of a suspected security incident, it will take reasonable steps to investigate, contain and respond to it. Wattlebase will assess whether notification is required and notify affected individuals and relevant authorities where required by applicable law.

Retention, cancellation and account deletion

Cancelling a paid subscription stops future renewal according to the billing arrangements shown in the billing portal; it does not by itself request immediate deletion of the account or its records.

Closing an account through the available account-deletion process removes the workspace and associated Wattlebase records and requests deletion of the authentication account. Before closing an account, users should export information they need to keep. Payment records held in a business’s Stripe account, and records already sent to Xero, are kept by those services under their own terms.

Some information may remain where reasonably necessary for legal, billing, fraud-prevention, dispute, security or backup purposes. Otherwise, Wattlebase retains information only for as long as reasonably necessary for the purpose for which it is held.

Access, correction and deletion requests

Account holders can update many business and customer details, export workspace data, and close their account from within Wattlebase. You may also contact Wattlebase to request access to, correction of, or deletion of personal information. Requests are subject to applicable legal requirements and reasonable identity, security and technical limitations.

Service and marketing communications

Transactional communications may include authentication, security, billing, account, team invitation, quote, invoice, receipt, trial and important service notices. Some of these communications are necessary to operate or administer the service.

If Wattlebase offers optional marketing communications, recipients may unsubscribe using the method provided in the message. Unsubscribing from marketing does not stop necessary transactional or service communications.

Cookies and browser storage

Authentication uses cookies or similar technologies needed to keep users signed in and secure their sessions. Wattlebase also stores interface preferences, such as appearance and notification state, and work saved for offline use in the browser. Wattlebase’s own website analytics do not use cookies. Google Ads measurement may use cookies or similar technologies to attribute visits and sign-ups to advertising campaigns. Stripe may use cookies on its payment pages to help prevent fraud.

Changes to this Privacy Policy

Wattlebase may update this policy as the service, providers or legal obligations change. The updated policy will be published on this page with a revised “Last updated” date. Reasonable notice of material changes will be provided where appropriate.

Contact and complaints

For privacy questions, access or correction requests, deletion requests or complaints, email support@wattlebase.com.au. Wattlebase will review the matter and respond within a reasonable period. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.