Privacy Policy

HavenOne is operated by Peter Allan, a sole trader, ABN 24 149 935 361(“HavenOne”, “we”, “us”).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, where it is stored, and how to reach us about it.

HavenOne holds personal information in two distinct capacities, and your rights differ depending on which one applies:

A. Information about you, our subscriber. You sign up, we bill you, we support you. We decide what happens to this information, and this policy governs it.

B. Information you enter about your own customers. When you record a customer, raise a booking or issue an invoice, that information belongs to your business. We hold and process it on your instructions so the software works. We do not decide what it is used for, we do not use it for our own purposes, and we never sell it or use it to train machine-learning models.

If you are a customer of a business that uses HavenOne and you want to see, correct or delete your information, that business is the right place to ask. We will help them action it, but the decision is theirs.

Your name, business name, ABN, email address, phone number and business address; login credentials (passwords are hashed — we never see them); your subscription plan and billing history; and records of your use of the service, including error diagnostics.

We use this to provide and support the software, authenticate you, take payment, contact you about your account, and keep the service reliable and secure.

Depending on how you use HavenOne, this may include your customers’ names, contact details, delivery and billing addresses; booking, quote and invoice records; payment records and security deposit details; signed contracts and signatures; delivery photographs and site notes; and copies of emails and text messages sent through the platform.

We process this only to run the software for you — storing it, displaying it back to you, generating documents from it, and sending the messages you ask us to send. You are responsible for having the right to collect it, and for telling your own customers how you handle it.

Some information arrives without anyone typing it in, and it is worth being specific rather than vague about it.

Your IP address, as a one-way hash. Public forms — booking requests, quote requests — are rate limited to stop abuse. To count requests per caller we store a SHA-256 hash of the address rather than the address itself, so the record cannot be turned back into an IP.

Server logs held by our hosting provider for a short period, covering requests, response codes and timings.

Error diagnostics when something breaks, stripped as described above.

We do not currently run any third-party website analytics — no Google Analytics, no advertising or cross-site tracking. If that changes we will update this page and tell you before it takes effect.

Card payments are processed by Stripe. We never receive or store card numbers. HavenOne stores only the outcome of a payment — amount, date, status, and a reference that lets us reconcile it. Stripe handles the card details under its own terms and security certifications.

The database and uploaded files are hosted in Sydney, Australia (Supabase, on AWS ap-southeast-2). Your operational data — customers, bookings, invoices, documents and photographs — stays in Australia at rest.

Some supporting services necessarily operate overseas, and under Australian Privacy Principle 8 we tell you which and where:

Vercel (application hosting, United States and global edge network) · Stripe (payments, United States and Australia) · Resend (outbound email, Japan) · Sentry (error diagnostics, United States) · Twilio (text messages, where you enable it) · Google (calendar and email integrations, where you enable them).

Error diagnostics are deliberately stripped before they leave our servers: request bodies, cookies, headers, query strings and user identifiers are removed, so a crash report tells us which page broke without telling us whose record was open.

You may ask us for a copy of the personal information we hold about you, and ask us to correct it if it is wrong. Email hello@havenone.com.au. We will respond within 30 days. There is no charge for a reasonable request.

If you are unhappy with how we have handled your information, tell us first at that address and we will work through it with you. If you are still not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

If a breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Where the breach affects information you entered about your own customers, we will notify you promptly so you can meet your own obligations to them.

While your subscription is active, and for 90 days after it ends, so an account can be recovered if it is closed by mistake. After that, your workspace data is deleted from live systems. Backups roll off within a further 90 days.

Some records are kept longer where the law requires it — invoices and payment records are retained for seven years to meet Australian tax and record-keeping obligations. You can ask us to delete your data sooner, and we will, except where we are legally required to keep it.

HavenOne sets only the cookies needed to keep you signed in and to remember interface preferences such as your saved list columns. We do not use advertising cookies and we do not track you across other websites.

We will post any changes on this page and update the date above. If a change materially affects how we handle your information, we will tell you by email before it takes effect.