Privacy Policy

ACC · Australia Construction Consultants & Associates ("ACC") is an Australian construction consultancy operating the ACC platform. This Privacy Policy explains how we collect, use, disclose and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

When you register or use the platform we may collect:

• Identity & contact: full name, work email, mobile number, company, ABN, discipline or trade, website.
• Verification data: PIN codes sent by SMS to your mobile at registration, IP address and device fingerprint at each sign-in.
• Financial data: Stripe payment session identifiers, bank-transfer reference numbers and payment status (we do not store full card numbers).
• Project data you upload: drawings, photos, contracts, cost plans, defect lists, delay narratives and messages.
• Automated logs: portal-access logs (view/download), audit trails for AI runs and email-delivery records.

We use your information to (a) provide, operate and improve the platform; (b) verify your identity via SMS PIN and email; (c) issue and enforce the AS4000 engagement, invoices and payment receipts; (d) send transactional emails (welcome, password-reset, board reports, weekly snapshots, security alerts, membership renewal); (e) generate AI-assisted decision support (board summaries, forecasts, RFI drafts, PDF takeoffs); and (f) meet our legal obligations.

We rely on (a) your consent (ticked at registration and each time you re-consent for new features); (b) the performance of a contract (delivering the services you paid for); (c) our legitimate interests (fraud prevention, security and platform improvement); and (d) legal obligations (tax records, statutory retention).

We share the minimum information necessary with our processors: Stripe (payments), Emergent-managed Resend (email), Twilio (SMS PIN codes), Emergent-managed Google Sign-In (auth), Anthropic / Google (AI text and vision generation) and Emergent object storage (files). Each processor is bound by its own privacy commitments. We do not sell your personal information to third parties.

Some processors host data outside Australia (typically United States or European Union). Where this occurs we rely on the processor's contractual and technical safeguards. If you object to this transfer please contact us — we will do our best to offer an Australian-only alternative but some features may become unavailable.

We retain your account data for as long as your account is active and for a further seven (7) years after closure, to meet Australian tax and construction-record obligations. Portal-access logs are kept for two (2) years. AI-run audit records are kept for three (3) years. You may request earlier deletion — see clause 9.

We protect your information with encryption in transit (TLS), password hashing (bcrypt), device-fingerprinting suspicious-login alerts, one-tap emergency-revoke, JWT session tokens with server-side revocation, rate-limited login endpoints and role-based access controls. Despite our efforts, no system is 100% secure — please help us by keeping your password confidential and using the emergency-revoke link if a device you don't recognise appears in your Sessions panel.

Under the Australian Privacy Principles you have the right to (a) access the personal information we hold about you; (b) request correction of inaccurate information; (c) request deletion where legally permitted; (d) opt out of non-transactional communications; and (e) complain to us or to the Office of the Australian Information Commissioner (OAIC). Contact info@accassociate.com.au to exercise any right — we respond within 30 days.

Strictly-necessary storage: a JWT token in localStorage for authentication and a session identifier for CSRF-safe API calls.

Website analytics: the public pages of accassociate.com.au use Google Analytics 4 to measure page views and enquiry activity in aggregate (for example how many visitors read a service page or submit an enquiry). Google Analytics 4 sets first-party cookies (_ga, _ga_*); it does not log or store IP addresses, Google advertising features and ad personalisation are switched off, and no analytics runs inside the client portal or ACC Command Centre. We honour browser Do-Not-Track and Global Privacy Control signals, and you can switch analytics off for this browser at any time below. Advertising measurement: the public pages also use Meta Pixel (Facebook / Instagram) and Google Ads conversion tag to measure whether an enquiry or phone call followed one of our advertisements. These tags set third-party cookies, receive the page you visited and the fact that an enquiry was made (never the content of your enquiry), and are not loaded when Do-Not-Track / Global Privacy Control is on or when you switch them off below.

Privacy Officer, ACC · Australia Construction Consultants & Associates
215-219 George Street, Liverpool NSW 2170 · PO Box 46, Prestons NSW 2170
Email: info@accassociate.com.au · Phone: 02 7245 8907
OAIC: oaic.gov.au