Create accountPrivacy Policy
Version 2026-09-16 · Effective 16 September 2026
This policy explains how J Gatis Enterprises Pty Ltd trading as TTAG AU (TTAG, we, us or our) collects, uses, stores and discloses personal information when people use the TTAG website, mobile application and related services.
1. Who we are
Legal entity: J Gatis Enterprises Pty Ltd
ABN: 12 702 182 723
Location: Queensland, Australia
Privacy contact: hello@t-tag.com.au
2. Information we collect
Depending on how TTAG is used, we may collect:
- account details, including name, email address, user identifier and sign-in status;
- contractor details, including business name and electrical contractor licence number;
- team information, including employee names, email addresses, roles, invitation status and recent activity;
- client and worksite information, including client names and email addresses, site names and addresses;
- test-and-tag records, including asset descriptions, item numbers, physical tag numbers, test dates, next-test dates, pass or fail results, tester initials, notes and optional electrical measurements;
- optional proof-of-tag photos and associated upload information;
- terms-acceptance records, including signup email, policy version, document fingerprints, submission time and account identifier where available;
- subscription and billing information, including Stripe customer and subscription identifiers, plan, payment status and billing events;
- reminder settings, recipient email addresses, message contents and delivery records;
- job and report information, including completed-job records, amendments and PDF reports;
- technical and security information needed to operate the service, such as browser information, timestamps, authentication data, error records and device-stored synchronisation journals; and
- communications sent to support, including attachments and troubleshooting details.
Please avoid entering sensitive personal information into free-text notes unless it is genuinely required for the electrical safety record.
3. How we collect information
We collect information:
- directly from account holders, administrators and testers;
- from other authorised members of the same contractor account;
- through the sign-in provider used to authenticate an account;
- automatically when TTAG operates, synchronises, records security events or diagnoses an error; and
- when a person contacts TTAG for support.
A contractor account administrator is responsible for ensuring they are authorised to enter client, site, employee and asset information into TTAG.
4. Why we use information
We use information to:
- create and secure accounts;
- provide shared jobs, asset registers, testing records and reports;
- identify the tester who recorded a result;
- synchronise work between authorised devices and team members;
- manage invitations, roles and access;
- process subscriptions and send account, trial-ending and payment-failure messages;
- send upcoming-test reminders to the nominated client and contractor based on the contractor’s selected interval;
- provide customer support and investigate faults;
- create backups, restore records and protect against data loss;
- detect misuse, maintain security and keep an activity history;
- comply with legal obligations and respond to lawful requests; and
- improve TTAG using aggregated or de-identified information where practical.
We will not sell personal information or use test-and-tag records for unrelated advertising.
5. When we disclose information
We may disclose information:
- to authorised members of the relevant contractor account;
- to a client or site representative when an authorised user downloads or shares a job report;
- to hosting, authentication, database, email, monitoring and support providers that help operate TTAG;
- to professional advisers and insurers where reasonably required;
- during a genuine business sale, restructure or acquisition, subject to appropriate protections; and
- where required or authorised by law, or where necessary to protect people, property or the security of the service.
Our current service arrangements include OpenAI Sites hosting with Cloudflare database and photo storage, Supabase authentication and private operational backups, Stripe subscription payments, Resend notification delivery and VentraIP email services. Information shared depends on each provider’s role. Payment card details are entered into Stripe’s hosted checkout rather than TTAG’s own forms; TTAG does not store full card numbers or card security codes in its application database.
Photos are optional and are accessed through the relevant contractor account. They are not embedded in TTAG’s PDF reports. Users should avoid capturing people, personal documents or unrelated private information.
Upcoming-test emails identify the client, site, contractor and suggested due date, and provide the contractor’s reply email. The contractor must have authority to supply the recipient’s details. Recipients can reply to the contractor to request corrections or changes to reminders, or contact hello@t-tag.com.au for assistance. These reminders do not confirm a booking.
6. Overseas processing
TTAG uses Australian and overseas service providers. Our Supabase project, used for authentication and private operational backups, is configured in Tokyo, Japan (ap-northeast-1). Resend states that its primary processing operations take place in the United States. Stripe describes international processing, including in the United States and India, and service providers in the European Union. VentraIP describes its email hosting as Australian-hosted; this does not mean every recipient’s mail service or every related processing activity is located in Australia.
Our website, job database and photo storage use OpenAI Sites and Cloudflare infrastructure. Sites does not currently offer data-residency controls for deployed websites, databases, uploaded files or logs. We cannot guarantee that these records remain in Australia or any other particular country. The specific countries used to store TTAG’s hosted job records and photos have not been confirmed to us through the hosting information available to us.
We do not represent that all information stays in Australia. A primary storage region does not necessarily describe every location used for support, security or related processing. We will take reasonable steps required by applicable Australian privacy law for overseas disclosures and review this information when our service arrangements change.
7. Storage and security
TTAG uses authenticated access, contractor-level data separation, role-based permissions, encrypted network connections, browser security controls, server-side revision history and downloadable account backups. Authorised users may also keep device copies while work is waiting to synchronise.
TTAG uses browser cookies and device storage for sign-in and application operation, including offline work awaiting synchronisation. Copies of downloaded reports, backups and device-stored records may remain on devices controlled by users.
No system can guarantee absolute security. Account holders should protect their sign-in method, use trusted devices, remove access promptly when staff leave and notify us if they suspect unauthorised access.
8. Retention and deletion
Our current policy is not to automatically delete job and asset records when a subscription ends. We retain these records without a fixed expiry period to provide continuing read-only access and PDF downloads. This is not a promise of permanent storage. We review whether personal information remains needed for these purposes and applicable legal obligations. If this retention arrangement changes, we will give reasonable advance notice and an opportunity to export records.
Subscription cancellation is separate from an account closure or deletion request. Contact hello@t-tag.com.au to request deletion. Requests are reviewed manually. A request to delete an entire contractor account must come from its verified owner or another person with verified legal authority. Individuals may also contact us about their own personal information without being the contractor account owner. We will verify identity and authority, explain the scope and consequences, offer the authorised account owner an opportunity to export records, and seek explicit confirmation before irreversible removal. We will explain the expected timing, any information we need to retain and why, and any applicable backup limitations. Removing an employee’s access does not automatically erase the contractor’s historical test records or tester attribution; requests concerning personal information in those records are assessed separately. We do not currently offer automatic account erasure or a fixed deletion deadline. We will provide a case-specific timeframe after assessing the request and the systems involved. Our own scheduled operational backups in private Supabase storage include customer records, account links and asset photos. We retain 30 calendar days of these copies and remove older copies after a new backup succeeds; failures may delay cleanup. These copies exclude authentication passwords and payment card details. The hosting provider’s separate backup-retention and backup-erasure periods have not been confirmed to us. Backup copies may remain after active records are removed; we will explain any known limitations rather than represent that deletion from the app immediately erases every copy.
When information is no longer required, we will take reasonable steps to delete or de-identify it, subject to applicable legal obligations and justified retention needs. Application recovery snapshots are currently retained by revision count, rather than a fixed expiry date. Removing a record from the active register does not necessarily remove copies from recovery history, uploaded-photo storage, email delivery records or downloaded files. We assess these locations separately when handling deletion requests.
9. Access and correction
Users can correct some contractor, client, site and team information within TTAG. A person may request access to, or correction of, personal information we hold about them by contacting hello@t-tag.com.au. We may need to verify identity and authority before responding.
If we refuse a request, we will explain the reason where required and describe the available complaint process.
10. Privacy complaints
Send privacy questions or complaints to hello@t-tag.com.au with enough detail for us to investigate. We aim to acknowledge a complaint within 2 business days and provide an outcome or progress update within 30 days.
If a person is not satisfied with our response, they may contact the Office of the Australian Information Commissioner at oaic.gov.au.
11. Data breaches
We will contain, assess and respond to suspected data breaches. Where the Notifiable Data Breaches scheme applies and a breach is likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required.
12. Changes to this policy
We may update this policy when TTAG, its providers or applicable law changes. We will publish the current version with its effective date and give reasonable notice of material changes where appropriate.