Privacy policy

1. Who this policy covers

Three groups of people, and it says which parts apply to each:

• Account holders — the owners and staff of a joinery business who sign in to Joinr. Most of this policy is about you.
• Customers of those businesses — the people whose name and contact details a business types into a quote, and who receive that quote by email. Section 3 is written for you, and sections 6 and 12 also apply.
• Everyone else — visitors to www.joinr.com.au, people who have been invited to join a team, and people who email us.

2. What we collect

Your account. Your email address; your password, which is stored as a one-way hash by our sign-in provider and which we never see; the display name you choose; which organisation you belong to and your role in it (owner or estimator); the email address you were invited at, if a colleague invited you; and when you last signed in. Sign-up asks for an email address and a password and nothing else.

Your business. The business name and ABN; the phone number, email address, logo, letterhead image and terms document you choose to print on your quotes; and your rates. Rates are confidential business information rather than personal information, and we handle them with the same care.

Your quotes, and your customers' details. Each quote holds the customer's name, phone number and email address, the job address, your reference, and the quote itself. Joinr also keeps the quote's history: who created, edited, sent, won or lost it, and when.

Emails sent through Joinr. When you send a quote, we record the addresses it went to, the subject line, the covering message as you typed it, the names and sizes of the attachments, and what our email provider reports happened to it: delivered, bounced or opened. We do not keep the email itself: the quote PDF is regenerated from the quote when it is needed, and any other file attached is one you uploaded to the quote, kept as section 10 describes. Section 6 has the detail.

Billing. Payment is handled by Stripe. We keep your Stripe customer and subscription identifiers, your subscription status, plan and renewal date, and any discount applied to your account. We never see or store card numbers. Stripe holds the card and the billing name and address you give it.

Support. Whatever you send us when you email support@joinr.com.au, and our replies.

Messages from us. We may show you a message inside Joinr — about your account, a change to the product, or a change to this policy. For each one we record whether your organisation opened it, when, and which member of it opened it first, and nothing else. A message is plain text: it carries no tracking image and no link.

Technical information. We run no analytics and no advertising trackers on any Joinr site. Our hosting and sign-in providers keep standard server logs, which include IP addresses, for a short time for security and troubleshooting. We use your IP address, briefly and in memory only, to limit repeated sign-in attempts; we do not store it. When something goes wrong in the app, an error report goes to our error-monitoring service: the page you were on, your browser type, and the technical details of the fault. We have configured that service not to send names, email addresses or the contents of your quotes, but an error message can occasionally quote a fragment of the value that caused it.

What we do not collect. Your date of birth, gender, home address or government identifiers (an ABN identifies a business, not a person), your location, or anything from your device beyond what a web browser sends.

3. If you are a customer of a business that uses Joinr

A joinery business has typed your details into Joinr to prepare a quote for you and send it. We hold that information on the business's behalf and on its instructions. The business decides what is entered, what is sent to you, and when it is deleted; we do not.

The email you receive is sent by the business "via Joinr" from our sending domain. Replies go to the business, not to us, and we do not read them.

We use your details for one thing: storing that business's quote and delivering the email it asked us to send. We do not contact you ourselves, we do not send you marketing, we do not share your details with any other business, and we do not use them to build a profile of you.

If you want to see, correct or delete what a business holds about you, ask the business first: it has the controls. If you cannot reach it or are not satisfied with its answer, email support@joinr.com.au and we will help.

Section 6 explains exactly what the business can learn from the email it sent you.

4. How we collect it

Almost everything comes from you: signing up, filling in your settings, building quotes and emailing us. The rest comes from three places. When a colleague invites you to a team, we record the address they invited. When a business enters its customers' details, we hold them for that business (section 3). And our providers report back to us: Stripe tells us whether a subscription was paid, failed or cancelled, and our email provider tells us what happened to each email you sent.

We do not buy information about you, and we do not collect it from public sources, social networks or data brokers.

5. How we use it

• To run Joinr. To keep your account, keep your business's data separate from every other business's, price and store your quotes, produce your PDFs, send the emails you ask us to send, and show your team what changed and who changed it.
• To bill you, through Stripe, and to keep the records that tax and company law require.
• To support you. To answer your questions, and to look at your data when you ask us to or when a fault needs diagnosing. Every time we look, it is logged (section 7).
• To keep Joinr secure. Sign-in limits, detecting misuse, backups and investigating incidents.
• To improve Joinr. We look at how the product is used overall: how many quotes are made, which features are used. We do not read your quotes to do it.
• To tell you about Joinr. Notices about your account, such as a price change, a security matter or a change to this policy, go to every account holder, by email or as a message inside Joinr. Product news goes only to people who have not opted out (section 12).
• To meet a legal obligation, such as a court order or a regulator's lawful request.

We do not sell personal information, share it with advertisers, or use it to train artificial-intelligence models. Joinr sends your data to no AI service.

We do not use your personal information in automated decisions that could significantly affect your rights or interests. Joinr's pricing arithmetic works on your rates and quantities, not on information about a person.

6. Email delivery tracking

When you send a quote from Joinr, our email provider reports back whether it was delivered or bounced, and if it bounced, why. We record that against the quote so you can see it.

Quote emails also carry a tiny, invisible image that tells our provider when the email is opened. We record that the email was opened and at what time, and nothing else. Our provider's report also carries the reader's IP address and device type; we discard both and never store them.

If you have received a quote from a business that uses Joinr, this is the whole of what the business can see: that its email was delivered, and that and when it was opened. Opening the email tells the business nothing about where you are or what device you used.

7. Who can see it

Your team. Everyone in your organisation can see all of its quotes. Owners can also change the settings, the rate card and the team.

Us. The people who run Joinr can look at an organisation's data through an administration console. Every view is written to a permanent log that records who looked, at what and when, and that log is not something an administrator can edit. We look only to support you, to investigate a fault or misuse, or when the law requires it. Today, one person holds that access.

Our providers. Each one sees only what it needs to do its job, is bound by contract to use it for nothing else, and is listed in section 8 together with where it keeps the data.

Nobody else, except where the law requires it (a court order, or a lawful request from a regulator or law-enforcement agency), where it is necessary to prevent serious harm to someone, or if Joinr's business is sold or restructured, in which case the new owner takes on this policy for the information it receives and we will tell you before it happens.

8. Where it is stored, and what goes overseas

In Australia. Your data lives in a database run by Supabase in Sydney (Amazon Web Services' ap-southeast-2 region). The app runs on Vercel, also in Sydney. Supabase keeps its own daily backup of the database for seven days, in Sydney.

Our own backups. Once a week we take an encrypted copy of the whole database and of the logo, letterhead and terms files, and keep it on a server at our own premises in Australia. The archive is encrypted with AES-256, its file names included, using a passphrase held only by us; we keep the sixteen most recent, so about four months' worth. Files uploaded to quotes are kept in a separate encrypted store beside those archives, which only ever gains files: a file stays there for as long as we keep our backups, and we delete it when you ask us to (section 10). A copy of every archive and of that store goes to storage equipment we own at a second location in Australia; no cloud storage provider holds any of it. If that ever changes, we will update this section first.

Overseas. Some of our providers are in the United States, and information reaches them as follows:

• Resend (United States) delivers the emails you send from Joinr and the sign-in emails we send you. The email's content, the recipient addresses and the delivery reports pass through Resend's servers, which keep a log for 30 days.
• Stripe (United States, operating in Australia through Stripe Payments Australia Pty Ltd) holds your billing details and processes payments.
• Sentry (United States) receives the error reports described in section 2 and keeps them for 30 days.
• Vercel (United States) keeps the app's request logs for no more than a day.

Before we use a provider outside Australia we review its security and privacy commitments and accept its terms, and we choose the Australian region wherever a provider offers one. Your customers' details go overseas only as part of delivering an email that you sent.

9. How we keep it safe

• Every connection to Joinr is encrypted (TLS), and our database provider encrypts all stored data at rest with AES-256 and is independently audited (SOC 2 Type 2 and ISO 27001). Our backup archives are encrypted end to end.
• Each business's data is isolated at the database layer. Every query is checked against your membership before a row is returned, so there is no setting that could accidentally show one business another's quotes.
• Passwords are hashed and never stored in a readable form. When you choose a password we check it against a public list of passwords known to have leaked, by a method that never sends the password itself. Sign-in attempts are rate-limited.
• Our administration console requires an authenticator-app second factor, re-verified every twelve hours, and logs every view.
• Our code is scanned for leaked credentials on every change, and its dependencies are audited for known vulnerabilities every week.

No system is perfectly secure. If we discover a data breach, we will contain it, preserve the evidence, and tell the affected businesses the facts promptly. Where a breach is likely to result in serious harm to anyone, we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.

10. How long we keep it

• Your quotes and their history: for as long as your organisation has a Joinr account, so you can go back to them.
• Quotes you delete: hidden immediately, restorable by us on request for 90 days, then removed permanently. The one exception is a quote that later revisions were made from: while any of those revisions still exists, the deleted original stays in our database — hidden from everyone, and only so that the revision history it holds together stays intact. It is removed once the last quote made from it has gone.
• When an organisation closes its account, or asks us to, we delete its quotes, rate card, uploaded files and history within 30 days and confirm by email. Your own sign-in account is separate, because it may belong to more than one organisation; email us to have it deleted.
• Backups age out on their own schedule: the provider's daily backup within seven days, our weekly archives within about four months. Files uploaded to quotes are the exception: they stay in our encrypted file store for as long as we keep our backups, including after the quote or the organisation is deleted, until you ask us to delete them. We do not reach into a backup to delete a single record, and nothing is restored from a backup except to recover from a failure.
• Billing records: for as long as tax and company law require, up to seven years.
• Email delivery logs at our email provider, and error reports at our error-monitoring service: 30 days each.
• Support emails: two years after the matter is closed.
• The log of our own staff's access to customer data: kept indefinitely. It is a control on us, not a record about you.

11. Cookies and browser storage

The website (www.joinr.com.au) sets no cookies and runs no analytics.

The app (app.joinr.com.au) sets a sign-in cookie that keeps you signed in, is refreshed as you use Joinr and is cleared when you sign out, and a second cookie, kept for seven days, that remembers where to send you after you click a sign-in link. Our administration console sets its own sign-in cookie in our staff's browsers, and our support tool sets a one-hour cookie there as well. None of these is used to track you across other websites.

Storage on your device. Joinr keeps an unsaved quote draft, an unsaved template draft, your text-colour preference and the timber calculator's scratch list in your browser's local storage. They stay on your device and are not sent to us; a draft reaches us only when you save it.

There are no advertising or analytics cookies on any Joinr site, and nothing is set by a third party. If you block cookies you will not be able to sign in.

12. Your rights

Access. Most of what we hold about you is on screen in Joinr. For anything else, email support@joinr.com.au. We will confirm who you are, and respond within 30 days; there is no charge unless a request is unusually large, in which case we will tell you the cost first.

Correction. You can change your display name, email address and business details yourself in Joinr. For anything you cannot edit, email us and we will correct it.

Export. An owner can download the organisation's entire data set at any time from Settings › Backup & import, in a file Joinr can import again.

Deletion. Section 10 says what we delete and when. To close an organisation's account or delete your own, email us.

Marketing. You can opt out of product news at any time by using the link in any such email or by replying to it. Notices about your account, such as a price change, a security matter or a change to this policy, continue while you hold an account. We do not send marketing to your customers, ever.

Anonymity. You can read www.joinr.com.au without telling us who you are. You cannot use the app anonymously: a quote has to have an author.

Your customers' rights are set out in section 3.

13. Complaints

If you think we have handled your personal information badly, email support@joinr.com.au with "Privacy complaint" in the subject line. We will acknowledge it within five business days, look into it, and give you a written answer within 30 days. If it takes longer, we will tell you why and when to expect it.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, telephone 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.

14. Children

Joinr is a tool for businesses and is not directed at anyone under 18. If we learn that we hold personal information about a child that was not entered by a business in the ordinary course of quoting for a job, we will delete it.

15. Changes to this policy

We will change this policy when what we do changes. Every version carries the date it took effect, and the current version is always at www.joinr.com.au/privacy. Where a change matters to you, such as a new kind of information, a new purpose or a new overseas provider, we will email every organisation owner at least 14 days before it takes effect. Earlier versions are available on request.

16. Contact

• Entity: Tenon Holdings Pty Ltd (ABN 44 698 736 873), trading as Joinr.
• Email: support@joinr.com.au
• Post: PO Box 217, Strathdale VIC 3550
• Privacy contact: the Joinr Privacy Officer, at the email or postal address above.