Kookabase is a job and quote management tool for Australian trade businesses (electricians, HVAC, plumbers, and similar). This page explains what we collect, why we collect it, and what we will and won't do with it. In plain English.
Last updated 6 May 2026Effective 6 May 2026
This document is provided for transparency. It is not legal advice; if you need certainty on a specific clause, contact us and we'll talk it through.
01Who we are
Kookabase is operated by FFP Digital Pty Ltd (ABN 63 689 214 931), an Australian-owned and operated company based in Brisbane, Queensland. We are the data controller for the personal information described in this policy.
We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are an individual customer of one of our customers (a "tradie's customer"), the trade business who entered your details is the controller of your information — we process it on their behalf.
02What we collect
We collect only what we need to run the Service. In practice, that is:
Account information
Your name, email address, and password (managed by our authentication provider, Clerk).
The role you have inside your business (owner, admin, tradie on the tools).
Profile preferences and settings you choose.
Business information
Business name, ABN, address, logo, banking and tax settings used on quotes and invoices.
Staff list and team structure.
Pricing, products, services, and templates you set up.
Customer records you enter on behalf of your customers
When you use Kookabase to manage jobs, you give us information about your customers — their name, address, phone, email, the job site, what work was done, photos, notes, quotes, invoices, and payments.
You decide what goes in. We store it and make it available to your authorised staff. We do not contact your customers ourselves except where you ask us to (for example, to send a quote or invoice from the Service).
Billing information
Subscription plan, billing cycle, and invoice history.
Card and payment details — these are handled directly by Stripe. We never store your full card number.
Usage and telemetry
Pages and features you use, in aggregate, so we can fix bugs and improve the Service.
Device and browser information, IP address, approximate location, and timestamps.
Server and error logs (kept short-term for diagnostic purposes).
Support communications
Emails, chat messages, and call notes when you ask us for help.
Feedback you choose to send us through the app or by email.
03How we use it
We use your information to:
Run the Service for you — storing jobs, quotes, invoices, and customer records.
Authenticate you and keep your account secure.
Send transactional emails and SMS that the Service needs to do its job (quote sent, invoice paid, password reset).
Bill you for your subscription and any usage-based charges.
Provide support and respond to your questions.
Diagnose errors, prevent abuse, and improve the Service over time.
We do not sell your information. We do not use it to train AI models that benefit other businesses. AI features inside Kookabase only run when you actively use them, and the prompts we send are scoped to the task you triggered.
04Who we share it with
We share information only with the sub-processors we need to run the Service. Each one has a contract with us and is bound to use the data only for the purpose we engaged them for.
Core sub-processors (always in use)
Amazon Web Services — hosting and storage in the Sydney region (ap-southeast-2).
Clerk — authentication and user account management.
Stripe — subscription billing and payment processing.
Resend — transactional email delivery.
ClickSend — SMS delivery.
Anthropic — the Claude language model that powers our AI features.
Optional sub-processors (only if you turn them on)
If you connect Kookabase to another tool (for example, Xero, MYOB, Google Calendar, or a payment gateway), data flows to that tool under your instruction and under that provider's own terms and privacy policy. You can disconnect at any time from inside the app.
When else we might share
If we are required to by Australian law or a valid court order.
If we sell or restructure the business — in that case the buyer steps into our shoes under this policy.
To protect the safety of our customers, the public, or our staff.
05Where data is stored
Your primary data store is AWS in Sydney, Australia (ap-southeast-2). Backups stay in Australian regions.
Some of the sub-processors above operate in other countries:
Clerk, Stripe, Resend, and Anthropic are US-headquartered and may process limited data on infrastructure located outside Australia.
ClickSend operates globally with Australian datacentres for AU-routed messages.
Where data leaves Australia, we rely on the sub-processor's contractual commitments (typically standard contractual clauses or equivalent protections) to keep it safe. We have chosen each provider deliberately and we tell you when we change one.
06How long we keep it
While your subscription is active: we keep your business and customer records so the Service works.
After cancellation: we keep your data for 90 days so you can reactivate or export it. After that, we delete it from our active systems.
Backups: may retain your data for up to a further 30 days while older backup snapshots roll off.
Legal hold: if we are required by law to keep certain records (for example, tax records under Australian law), we will keep only what we must and only for as long as required.
Support and audit logs: retained for 12 months in case we need to investigate an incident.
07Your rights
Under the Australian Privacy Principles, you have the right to:
Access the personal information we hold about you.
Correct information that is inaccurate, out of date, or incomplete.
Request deletion of your information (subject to any legal-hold obligations).
Opt out of any non-essential communications — transactional emails about your account will continue while your subscription is active.
Complain to us about how we have handled your information. If we cannot resolve it, you can take the complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
To exercise any of these, email us using the link in the Contact section. We will respond within a reasonable time, typically inside 30 days.
If you are an end-customer of one of our customers (a tradie's customer), please contact the trade business directly first — they own the record. If you cannot reach them, contact us and we will help where we can.
08Cookies and tracking
We use the minimum necessary cookies to run the Service:
Session and authentication cookies — so you stay logged in and your requests reach the right organisation.
Preference cookies — remembering small choices like which view you prefer.
First-party analytics — aggregated counts only, used to understand which features are used.
We do not use third-party advertising trackers, retargeting pixels, or social-media tracking inside the Service. The marketing site (kookabase.com.au) is similarly minimal.
09Children
Kookabase is a B2B tool for businesses. It is not intended for use by anyone under 18. If you believe a child has provided personal information to us, contact us and we will remove it.
10Changes to this policy
We update this policy from time to time. The date at the top of the page reflects the most recent change. If we make a material change — for example, adding a new sub-processor that handles your data — we will let active customers know by email before it takes effect.
Earlier versions are kept on request.
11Contact
Questions, requests, or complaints about your privacy can come straight to us:
By post: FFP Digital Pty Ltd, Brisbane, Queensland, Australia (write to us first — we'll send the postal address).
The short version. We collect what we need to run the Service. We store it in Australia. We don't sell it. We don't use it to train models. We delete it when you ask us to. If something on this page isn't clear, ask us — that's the whole point.
BNE