Privacy Policy

This policy explains how CoatRoo (“we”, “us”) handles personal information when you visit coatroo.com or use CoatRoo, our workshop management software for powder-coating workshops (the “Service”). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. Who is responsible for what

CoatRoo is used by workshops. Each workshop is an account, and its owner and admins invite staff to it.

• For your own account, for visits to our website and for messages you send us, CoatRoo decides how personal information is handled, and this policy applies directly.
• Workshops also enter details about their own customers. For that information, the workshop decides what is collected and why, and CoatRoo stores and processes it on the workshop’s behalf to provide the Service. The workshop must have a lawful basis for it and give its customers any notices required. We use this information only to provide the Service to the workshop, such as showing it to the workshop’s staff and sending the emails the workshop asks CoatRoo to send, and we don’t contact a workshop’s customers for our own purposes.

If you are a customer of a workshop that uses CoatRoo, please contact the workshop first about information it holds about you.

2. What we collect

• Account details: your name, email address and role in the workshop, and your password, which we store only as a secure hash, never in readable form.
• Workshop business details that the workshop enters, such as its business name, ABN, address and logo.
• Workshop customers’ information that the workshop enters, such as names, email addresses, phone numbers, addresses, job photos and documents, quotes and invoices.
• Usage and security logs: IP addresses, device and browser details, sign-in times, and a record of the changes people make in a workshop (its audit log).
• Billing information: PayPal subscription and payment records, including the payer name, email address and PayPal ID that PayPal sends us. Payments are made through PayPal, and CoatRoo never receives or stores card numbers.
• Contact form messages: the name, email address, business name, topic and message you send through our Contact page.

We collect most of this directly from you or from your workshop (for example, when an owner invites a staff member by name and email address), and some of it automatically when you use the Service. You can browse coatroo.com without telling us who you are, but we need your name and email address to create an account or to reply to a message.

3. How we use it

We use personal information to:

• provide, operate and secure the Service, including signing you in and keeping each workshop’s data separate;
• send the emails the Service needs to send, such as email verification, invitations, password resets and billing notices, and the emails a workshop sends its customers through CoatRoo, such as quotes and invoices;
• keep an audit log, so a workshop can see who changed what and when;
• manage trials, subscriptions and billing;
• when staff choose Analyse photos or Analyse text, suggest intake details from the selected photos or pasted text (see AI-assisted intake below);
• answer messages and support requests;
• detect and prevent misuse, and meet our legal obligations.

We don’t sell personal information, and we don’t use it for advertising.

4. Who we share it with

• Service providers that help us run CoatRoo: Google Cloud (hosting and storage), Mailgun (email delivery), PayPal (payments), and OpenRouter and Anthropic (AI-assisted intake).
• Powder shops, when a workshop sends a powder request to a shop through the marketplace. The shop receives the requester’s name, business name, email address and phone number.
• People in your workshop, according to the roles the workshop gives them.
• Authorities, where the law requires it.

CoatRoo’s administrators access account data only when needed to support and operate the Service; in-app access uses audited tools protected by multi-factor authentication.

5. Where your information is stored

CoatRoo stores its data on Google Cloud in Melbourne (australia-southeast2), with disaster-recovery backups in Sydney (australia-southeast1).

Overseas disclosure

• Email is sent through Mailgun in the United States, so email addresses and the content of the emails CoatRoo sends are processed there.
• PayPal processes payments, and may do so outside Australia.
• AI-assisted intake sends the photos or text staff choose to analyse through OpenRouter (United States) to Anthropic’s Claude model, which runs on Google Cloud and may process them outside Australia, including in the United States.
• Colour-catalogue images are shown directly from supplier websites, so those websites may receive your IP address and browser details when an image loads.

AI-assisted intake

Staff can ask CoatRoo to suggest intake details from job photos or from a pasted customer email. Only the photos or text they choose are sent, photo location data is removed first, and email addresses, phone numbers, links, business numbers, known customer names and signatures are removed from pasted text. The provider is set not to keep the data or use it for training. Suggestions change nothing until staff review and apply them, and a workshop’s administrator can turn the feature off in Settings.

6. Cookies

CoatRoo uses one essential cookie: a secure sign-in session cookie that keeps you signed in. We don’t use advertising or analytics cookies, or any other trackers.

7. How we protect it

• Data is encrypted in transit with TLS, and encrypted at rest by Google Cloud.
• Each workshop’s data is kept separate from every other workshop’s.
• Access within a workshop is controlled by each person’s role.
• CoatRoo’s own administrators must use multi-factor authentication.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner as the Privacy Act requires.

8. How long we keep it

• We keep account and workshop data while the account exists.
• Workshop records aren’t deleted automatically at the moment, apart from temporary files such as unused intake photos. They are kept after an account is suspended or closed until deletion is requested through the Contact page, or until we publish a retention period.
• We delete data on request, except records we must keep for legal, tax or security reasons, such as billing and audit records; backup copies are removed as they expire.
• Database backups are kept for up to 365 days, then erased within a further 90 days. Backup copies of uploaded photos and documents are kept until we delete them.

9. Access, correction and complaints

You can ask to access or correct the personal information we hold about you, or make a privacy complaint, through the Contact page by choosing “Privacy request”. We will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If a workshop holds your information as one of its customers, please contact that workshop first.

10. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If a change significantly affects how we handle your information, we will tell workshop owners by email.

11. Contact us

For privacy questions and requests, contact us through the Contact page at https://coatroo.com/contact.