Privacy Policy
This policy explains what personal information Kept collects, why, and what we do — and don't do — with it. It covers both www.keptsoftware.com.au (this website) and app.keptsoftware.com.au (the app itself).
The short version: the jobs, clients and invoices you enter into the app are encrypted on your device before they ever reach our servers, using a key derived from your own login password. We physically cannot read that data — not to help with support, not if we wanted to, not under any circumstance where we still have the system working as designed. We can see your business name, your login email, and which parts of the app get used. We can't see your clients' details, your pricing, or anything you've typed into a job, quote or invoice.
1. Who we are
Kept is operated by Lawn Envy Australia (ABN 19 863 392 800), a Brisbane-based business. The app began as software we built to run our own work and is now available to other Australian service and trade businesses. For anything in this policy, contact us via the form on this site or at the email address you've been given directly.
2. What we collect
When you sign up or use the app:
- Your login email and password (the password itself is never stored anywhere — only a cryptographic check that a login attempt used the right one)
- Your business name and phone/address if you provide them at setup — these are stored in plain text, since we need them to run the admin side of the service
- Which features of the app you open (e.g. "Invoices", "Schedule") and when — used only to understand which parts of the product actually get used, never tied to what's inside those features
What you enter into the app — jobs, client names and contact details, quotes, invoices, expenses, staff records, documents — is encrypted on your device before it's sent anywhere. We store only the resulting ciphertext. We cannot decrypt it, read it, search it, or hand it over in a readable form, including in response to a support request or a legal request for data we don't have the technical ability to produce in plain text.
If you contact us — through the "get in touch" form on this site, by phone, or by email — we keep what you tell us (name, email, business name, phone if given, and the content of your message) so we can follow up.
3. What we don't do
- We don't use third-party analytics, advertising trackers, or marketing pixels on this website or in the app.
- We don't sell, rent, or share your information with third parties for their own marketing purposes.
- We don't read, scan, or process the encrypted content of your business data — technically, we can't.
4. Where your data is stored
Our primary database and login system run on Supabase, in Sydney, Australia. That is where your account details, your business contact details, your billing state and any marketplace job requests are held — so the bulk of the readable personal information we hold about you stays onshore.
Everything you enter into the app — jobs, clients, quotes, invoices — is encrypted on your device before it is sent, so what actually sits in that database is ciphertext we cannot decrypt.
Running the service also involves a small number of other companies. Rather than describe them vaguely here, every one of them is listed on a dedicated page, with what it does, what it can see, and where it operates:
Overseas disclosure. Australian Privacy Principle 8 requires us to tell you if your personal information may go overseas and, where practicable, to which countries. Some of the providers on that page operate outside Australia — Stripe and Google process information in the United States, Xero in New Zealand and Australia, and Open-Meteo in Germany. Vercel serves the site from whichever of its data centres is nearest you. Where the information involved is your encrypted business data, an overseas provider holds only unreadable ciphertext. Information that is not encrypted — your login email, business contact details, and anything you send us through the enquiry form — may be handled overseas in readable form. By using this site and the app you consent to that disclosure. We choose providers we consider reputable and rely on the privacy commitments each of them publishes.
If you connect your own email or SMS sending accounts (a Gmail app password, a ClickSend account) to send invoices or quotes, those credentials and the messages sent through them are handled by your own account with that provider, under their terms — not ours.
5. Other businesses using the app
Every business's data is fully isolated from every other business using the app, enforced both at the database level and by the encryption described above. No business using Kept can see another business's jobs, clients, invoices or numbers.
6. The request-a-quote marketplace
If you submit a job request through our marketplace, we collect what you tell us — the type of work, your suburb and postcode, a description, and your contact details — and pass it to businesses registered in that trade whose service area covers your address, so they can quote. That is the entire purpose of collecting it, and it is stored in Sydney with everything else.
We do not sell that information, and we do not share it outside matching your job to businesses that can do it. Businesses receiving it are required to use it only to quote on and carry out the job. Every alert we send carries an unsubscribe link, and you can ask us to withdraw a request or delete your details at any time.
Full details, including what we can and cannot undo once a request has gone out, are in the Marketplace Terms.
7. How long we keep data
- Live demo accounts (created via the "try the demo" link) are automatically and permanently deleted 24 hours after creation.
- Real business accounts are kept for as long as the account exists. If a business account is deleted, its data — including the encrypted content — is permanently removed and cannot be recovered.
- "Get in touch" enquiries are kept so we can follow up, and can be deleted on request.
- Marketplace job requests are kept while the request is live and for a reasonable period afterwards, so the businesses quoting can follow up and so we can deal with any complaint about it. They are deleted after that, or sooner on request.
8. Your rights
You can ask us to tell you what plain-text information we hold about your business (login email, business name, contact details, feature usage), correct it, or delete your account entirely. Because the content you enter into the app is encrypted with a key only you hold, we cannot selectively access or redact individual pieces of it on request — account deletion removes everything, encrypted or not.
If you're in Australia, you also have rights under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you have a concern we haven't resolved, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).
9. If something goes wrong
If a data breach occurs that's likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Because the content you enter into the app is encrypted on your device with a key we don't hold, a breach of our servers would expose ciphertext rather than readable client, job or invoice records — which substantially limits the harm such a breach could cause. Unencrypted information, such as login emails, business contact details and enquiries sent through this site, would be assessed case by case.
10. Changes to this policy
If we make a material change to how we handle personal information, we'll update the date at the top of this page. Continued use of the app after a change means you accept the updated policy.
11. Contact
Questions or requests about this policy or your data: support@keptsoftware.com.au. You can also reach us via the "get in touch" form on the main site.