Skip to content

Privacy Policy

Last updated: 10 October 2026

1. Introduction

Stagetrac Pty Ltd (ABN 24 702 464 284) ("Stagetrac", "we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our job tracking platform and mobile applications.

2. Information We Collect

Account Information

When you register for Stagetrac, we collect:

  • Business email address
  • Company name
  • Password (encrypted)
  • Timezone preference

Usage Data

We automatically collect:

  • Job tracking and task completion data
  • Clock-in/clock-out times
  • Photos uploaded for job documentation
  • Device information and browser type
  • IP address and general location

Connected integrations

If your account owner connects a third-party service such as Xero or MYOB, we also process information needed to keep that connection working. That includes OAuth tokens (stored only on our servers, never shown to users), the names and identifiers of employees and pay rates we read from the connected service so you can match them to Stagetrac records, the timesheet hours you choose to send, and, for MYOB, the quotes you choose to import as jobs.

3. How We Use Your Information

We use the collected information to:

  • Provide and maintain our job tracking services
  • Send timesheet hours to a payroll or accounting service you have connected, when you choose to
  • Create jobs from quotes in an accounting service you have connected, when you choose to import them
  • Process and manage your account
  • Send service-related notifications
  • Improve our platform and develop new features
  • Ensure security and prevent fraud
  • Comply with legal obligations

4. Data Storage and Security

Your data is stored on Google Cloud / Firebase infrastructure in Australian data centres (Sydney region, australia-southeast1). This includes the primary database (Firestore), file storage (Cloud Storage), and most backend processing (Cloud Functions).

Database backups are also kept in Sydney: point-in-time recovery for 7 days, daily backups for 14 days, and weekly backups for 98 days. Uploaded files are stored in Sydney and are not kept in a separate file backup.

We implement industry-standard security measures including:

  • Encryption in transit (HTTPS/TLS) and at rest (Google-managed encryption)
  • Mandatory multi-factor authentication for all dashboard users
  • Role-based access controls enforced at the database and storage level
  • Logical tenant isolation so each company's data is separated
  • Rate-limited authentication and abuse protection
  • Strict Transport Security (HSTS) on all web traffic

Some supporting services operate outside Australia: payment processing (Stripe), transactional email delivery (Resend), Firebase Authentication (Google global identity service), and web hosting CDN (Firebase Hosting global edge). These services do not store your workshop records or files.

5. Data Sharing and Subprocessors

We do not sell your personal information. We use the following third-party service providers (subprocessors) to operate the platform:

  • Google Cloud / Firebase - hosting, database, storage, authentication, backend processing (Australia)
  • Stripe - payment processing
  • Resend - transactional email delivery (e.g. two-factor codes, notifications)
  • Google reCAPTCHA - signup abuse prevention

We may also share data with:

  • Legal authorities when required by law
  • A third-party service you have explicitly connected (see section 6)
  • Other parties with your explicit consent

6. Connected Integrations (Xero and MYOB)

Connecting Xero or MYOB (or a future accounting or payroll integration) is optional and is started only by your account owner. Stagetrac then acts on your instruction to access that organisation or company file. These services are not Stagetrac subprocessors for the core platform - they are services you already use, and you remain the controller of the data held in them.

When Xero or MYOB is connected, we:

  • Store access and refresh tokens on our Australian servers, in a location that no browser or worker session can read. Tokens are used only to call the connected service on your behalf.
  • Keep a server-only audit record of connect, disconnect, and timesheet-send events (who sent, which period, and the result), and record each quote import in your company's activity log.

With Xero, we:

  • Read employee names, earnings-rate names, and pay-calendar details so you can match them to Stagetrac workers and pay rates.
  • Send draft timesheet hours for a pay period only when an authorised user chooses to send them. We do not approve pay runs or change Xero payroll settings.

With MYOB, we:

  • Read the name of the company file you authorise.
  • Read quotes so an authorised user can pick which ones to import. For each quote they import, we copy the quote number, customer name, dates, work items, and any details written on the quote (such as vehicle registration or VIN) into a new Stagetrac job, and may read that quote again later to pick up added work.
  • Read employee and wage-category names, and send timesheet hours, only when an authorised user chooses to send them.
  • Do not change quotes, invoices, customer records, or payroll settings in MYOB, and do not process pay runs.

We do not store your Xero or MYOB password. Sign-in is handled by the provider. Disconnecting Xero revokes the tokens and stops further access. Disconnecting MYOB deletes the tokens we hold and stops further access; you can also remove Stagetrac from your my.MYOB account. Your mappings stay so you can reconnect without starting over, and jobs already imported from MYOB remain in Stagetrac. Use of these services is also subject to Xero's privacy policy and MYOB's privacy policy.

7. Your Rights

You have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of your data by contacting admin@stagetrac.com
  • Export your company data (available to account owners from Account Settings, secured by a second verification code)
  • Opt-out of marketing communications
  • Receive written confirmation of deletion on request. Confirmation covers production deletion. Copies already inside a database backup expire with that backup

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. Archived job attachments are automatically removed approximately 1 year after a job is archived. After account termination, we delete production database records, authentication accounts, and live files within 30 days. Copies already inside a database backup expire with that backup (14 days for a daily backup, 98 days for a weekly backup) and are used only to restore the platform. Written confirmation of deletion, on request, covers the production deletion and that backup expiry. Certain records may be retained for legal compliance purposes for up to 7 years where required by applicable law.

9. Security Incidents

In the event of a confirmed security incident affecting your data, we will notify affected customers within 72 hours of confirmation, consistent with Australian Privacy Principles. We will provide details of the incident, the data affected, and the steps being taken to address it.

If the incident involves Xero or MYOB data, credentials, or tokens, we will also notify that provider immediately (within 24 hours of discovery), as required by their developer terms.

10. Children's Privacy

Stagetrac is not intended for use by children under 16. We do not knowingly collect personal information from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email or through our platform.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Stagetrac Pty Ltd
ABN 24 702 464 284
Email: admin@stagetrac.com

← Back to Home