Cosflow — Privacy Policy
Last updated: 10 July 2026
This Privacy Policy explains how Cosflow — the partnership W.J Hooper & O.W Sirimanne, trading as Cosflow (ABN 61 185 905 375) ("we", "us", "our") — handles personal information when you use our website (getcosflow.com), our application (app.getcosflow.com), and related services (the "Service").
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service, you agree to this Policy.
1. Who this Policy is about
There are two groups of people whose personal information is involved in the Service:
- Our customers and their team — the people who sign up for and log in to Cosflow (business owners, admins, and technicians). We collect this information directly to run your account.
- Your customers — the individuals whose details you enter into Cosflow to manage your jobs (for example, names, addresses, phone numbers, and job notes). We handle this information on your behalf so we can provide the Service to you. You are responsible for making sure you're entitled to collect and load that information, and for meeting your own privacy obligations to those individuals.
2. What personal information we collect
Depending on how you use the Service, we may collect:
- Account and contact details — name, business name, email address, phone number, and login credentials.
- Billing information — your subscription plan and payment records. Card details are collected and stored by our payment provider (Stripe), not by us.
- Business and job data you enter — customers, addresses, jobs, quotes, invoices, schedules, site notes, and photos. This may include personal information about your own customers and staff.
- Usage and technical data — log data, device and browser information, IP address, and error diagnostics, collected to keep the Service secure and working.
We do not intentionally collect sensitive information (such as health information). Please don't enter sensitive information into free-text fields unless it's necessary and you're entitled to.
3. How we collect it
We collect personal information:
- directly from you when you sign up, subscribe, contact us, or use the Service;
- automatically as you use the Service (usage and technical data); and
- from you when you enter your own customers' details into the Service.
4. Why we use personal information
We use personal information to:
- create and manage your account and provide the Service;
- process subscriptions and payments;
- provide AI-assisted scheduling and quoting features;
- provide support, send service-related messages, and respond to enquiries;
- keep the Service secure, diagnose problems, and prevent misuse; and
- meet our legal obligations.
5. Who we share it with (our service providers)
We use trusted third-party providers to run the Service. They may access personal information only to perform services for us, and are bound to protect it. Our main providers are:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication, and file storage | Overseas (incl. USA) |
| Stripe | Payment processing | Overseas (incl. USA) |
| Railway | Application hosting | Overseas (incl. USA) |
| Anthropic (Claude) | AI scheduling and quoting features | Overseas (incl. USA) |
| Resend | Sending transactional email | Overseas (incl. USA) |
| Twilio | Sending SMS notifications | Overseas (incl. USA) |
| Xero | Accounting/invoice sync (where you enable it) | Overseas (incl. NZ/USA) |
| Sentry | Error monitoring and diagnostics | Overseas (incl. USA) |
We don't sell your personal information, and we don't share it for third-party advertising.
6. AI features
Some features send job and quote information to our AI provider, Anthropic, to generate scheduling suggestions and quote assistance. Only the data needed for the feature is sent. We choose providers that commit not to use data submitted through their business services to train their models. If you'd rather not use AI features, avoid entering information you don't want processed this way, or contact us.
7. Overseas disclosure
Several of our providers store and process data outside Australia, including in the United States (and, for Xero, potentially New Zealand). By using the Service, you acknowledge that your information — and your customers' information that you enter — may be stored and processed overseas. We take reasonable steps to use providers with appropriate security and data-protection practices.
8. How we protect your information
We take reasonable steps to protect personal information, including encryption in transit, access controls, tenant isolation so each business's data is kept separate, and use of reputable infrastructure providers. No system is completely secure, so we can't guarantee absolute security, but we work to reduce risk and will act promptly if a problem arises.
9. Data breaches
If a data breach occurs that is likely to result in serious harm, we will assess it and, where the Notifiable Data Breaches scheme applies, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required.
10. How long we keep it
We keep personal information for as long as needed to provide the Service and to meet legal, tax, and record-keeping obligations. After you close your account, we may delete or de-identify Your Data after a reasonable period. Contact us before closing your account if you need an export.
11. Access and correction
You can access and correct much of your information directly in the Service. You may also ask us to access or correct personal information we hold about you by emailing [email protected]. We'll respond within a reasonable time and may need to verify your identity first. If we can't give access or make a correction, we'll explain why.
If your request relates to your customers' information that another Cosflow business entered, we may direct you to that business, since they control that data.
12. Cookies
We use essential cookies and similar technologies to keep you logged in and to keep the Service secure. We may use limited analytics to understand and improve how the Service is used. You can control cookies through your browser settings, though disabling essential cookies may stop parts of the Service from working.
13. Complaints
If you have a privacy concern or complaint, please contact us first at [email protected] and we'll try to resolve it. If you're not satisfied, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
14. Changes to this Policy
We may update this Policy from time to time. If we make a material change, we'll notify you (for example, by email or in-app) and update the "Last updated" date above.
15. Contact us
Cosflow (W.J Hooper & O.W Sirimanne, ABN 61 185 905 375)
New South Wales, Australia
Email: [email protected]