Last updated: 11 October 2026 · Effective: 11 October 2026
This Privacy Policy explains how neuralduct ("we", "us", "our") collects, uses, discloses and protects personal information when you use the neuralduct website, web application and related services (the "Service"). The Service is business software for heating, ventilation, air-conditioning and related trades: duct and system design, quotes and invoices, purchases and expenses, job scheduling, an app for technicians in the field, and pages a business shares with its own customers.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — where it applies — the EU/UK General Data Protection Regulation (GDPR). This policy should be read together with our Terms & Conditions.
Information a business keeps about other people. A business that uses the Service puts in information about its own customers, staff, subcontractors and suppliers. That business decides what is recorded and why, and is responsible for telling those people and for having the right to record it. We hold and process that information on the business's behalf, to provide the Service to it. If you are a customer or a worker of a business that uses neuralduct and you have a question about your information, please ask that business first; we will help it respond.
What we hold depends on which parts of the Service you use.
| Category | Examples |
|---|---|
| Account information | Name, email address, password (stored hashed), company name, role, profile photo, and your sign-in security settings. |
| Business records | What you and your team enter to run the business: your customers and their contacts and sites (names, addresses, phone numbers, email addresses), jobs and schedules, quotes, invoices and payments received, suppliers, purchase orders, bills, receipts and expenses, stock, price lists, equipment and service records, and your business and tax details. |
| Design content | Floor plans and images you upload, duct and system designs, room schedules, bills of materials, and saved revisions. |
| Team and technician information | Team members' names, contact details, roles and access, rosters and time off, time entries, vehicles and trip logs, safety documents they sign, incident reports, and messages between team members. |
| Photos, files and signatures | Job photos and documents, service reports, and signatures captured on a device. When someone accepts a quote, a contract or a payment arrangement online, we record that they did, when, and the IP address it came from. |
| Location | Job and site addresses. With permission on the device, a technician's location when they use a feature that needs it — for example the map of the day's jobs, a trip log, or signing on to a safety document on site. |
| Messages sent through the Service | Emails, text messages and notifications the Service sends for a business to its customers and team, and replies and requests that come back — for example a booking request or a message from a customer page. |
| Email sent to your inbox address | If you turn on the email inbox: the emails sent or forwarded to your neuralduct inbox address — the sender's name and email address, the subject, the message, and attachments such as receipts, supplier invoices and photos. |
| What you give an AI feature | The questions you ask the assistant, the documents and images you ask it to read, and what it produced — including whether you kept, changed or discarded the result. |
| Connected services | If you connect another service (such as an accounting, payments or job-management system): the access it grants us, and the records exchanged with it. |
| Billing information | Subscription plan, transaction history and billing contact. Card details are handled by our payment processor — we do not store full card numbers. Where a business stores a customer's card for later payments, the card is held by that business's payment provider; we keep only the card type, its last four digits and expiry, and a record of the customer's consent. |
| Usage & device data | Log data, pages and features used, approximate location (e.g. country, for localised pricing), browser type, device and IP address; a record of sign-ins and security events; and, if you turn on notifications, the address your browser gives us to deliver them. |
| Support & feedback | Support tickets, messages and feedback you submit. |
The Service is not designed to hold sensitive information (such as health or biometric data), and we do not ask for it. Some records a business may choose to keep — an incident report, for example — can include it. Enter only what you need.
Email sent to your inbox address can hold other people's personal information — a customer's name, phone number and address, or a supplier's bank details. Only forward email that you are entitled to share with us.
We use personal information to:
Where the GDPR applies, we rely on the following legal bases: performance of a contract (to provide the Service you sign up for); legitimate interests (to secure, improve and promote the Service in a way that is not overridden by your rights); consent (for certain cookies and marketing, which you can withdraw); and legal obligation (to comply with applicable laws).
We do not sell your personal information. We share it only:
We use reputable third parties to deliver the Service. These currently include:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage. |
| Cloudflare | Hosting, content delivery, edge functions and security, and receiving email sent to your inbox address. |
| AI providers (e.g. Google Gemini) | Floor-plan detection, layout generation and design review; reading receipts, supplier invoices and other documents; drafting, estimating and the assistant; and reading email and attachments sent to your inbox address. |
| Mapping and weather providers (e.g. Google Maps, OpenStreetMap services, Open-Meteo) | Address lookup, maps, routes, local weather and travel times. They receive the addresses or locations being looked up. |
| Message delivery providers (e.g. Resend for email; an SMS provider where text messages are switched on) | Delivering the emails and text messages the Service sends. |
| Subscription payment processor (Lemon Squeezy) | Billing and payment for your neuralduct subscription. |
| Services you connect (e.g. Xero, Stripe, Square, ServiceM8, Driversnote) | Only if you connect them: taking your customers' payments, and exchanging the records you choose to sync. Each handles information under its own terms with you. |
| Browser and device notification services | Delivering notifications you have turned on. |
| Content delivery networks (e.g. jsDelivr, cdnjs, Google Fonts) | Delivering code libraries and fonts to your browser. They receive your IP address, as any website you visit does. |
Each provider only receives the information needed to perform its function, and is required to protect it. This list may change as the Service evolves.
Our providers may store or process data on servers located outside your country, including outside Australia. Where we transfer personal information internationally, we take reasonable steps to ensure it is handled consistently with this policy and applicable law (including, where relevant, standard contractual clauses).
We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and understand how it is used. Essential cookies are required for the Service to function. You can control non-essential cookies through your browser settings; disabling some cookies may affect functionality.
We keep personal information for as long as your account is active or as needed to provide the Service, and thereafter only as required to comply with legal, accounting or reporting obligations, resolve disputes and enforce our agreements. When information is no longer needed, we delete or de-identify it. You can delete projects at any time, and request account deletion as described in section 12.
Email sent to your inbox address, and its attachments, are deleted about 90 days after they arrive — about 30 days for email that turned out to be neither a purchase nor an enquiry. An expense, bill or booking request you keep from an email is a record in your account like any other, and is kept as described above.
We use technical and organisational measures to protect personal information, including encryption in transit, access controls, and hosting with reputable providers. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Keep your password confidential and notify us promptly of any suspected compromise.
Subject to applicable law, you may have the right to:
To exercise any of these rights, contact us via our support page. We will verify your identity and respond within the time required by law.
If your information was put into the Service by a business that uses it — because you are its customer or work for it — that business is the right place to ask first. We will help it respond to you.
The Service is intended for professional use and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we will delete it.
We may update this Privacy Policy from time to time. We will post the updated version here and revise the "Last updated" date. If changes are material, we will take reasonable steps to notify you. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
Questions, requests or privacy complaints? Get in touch:
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or with your local data-protection authority.