Privacy Policy

1. Who we are

Henshall Flow is an online tool that helps Australian tradespeople receive and keep track of job enquiries. It’s run by Luka Henshall, a sole trader based in New South Wales (ABN 29 930 815 716). In this policy, “we”, “us” and “our” means Luka Henshall trading as Henshall Flow.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). This policy covers:

• Account holders — tradies, and anyone they give access to, who use Henshall Flow.
• Customers — people who send an enquiry through a Henshall Flow form.
• Visitors to henshallflow.com.

2. If you sent an enquiry to a tradie

When you fill in a tradie’s enquiry form, your details go to that tradie. They decide how to use them and whether to get back to you, and they’re responsible for doing that properly. If the tradie has their own privacy policy, it’s linked on their form.

We store and process your enquiry for the tradie, as their service provider. We only use your details to:

• deliver your enquiry to the tradie and let them manage it;
• email you a receipt with your reference number, if you gave an email address and the tradie has receipts switched on;
• keep the service secure and stop spam; and
• meet our legal obligations.

We don’t sell your details, use them for our own marketing, or contact you about anything else. To change or delete an enquiry, contact the tradie you sent it to. If you can’t reach them, email us and we’ll help.

3. What we collect

From account holders

• Your name, email address and password. Passwords are stored scrambled (hashed) by our login provider — we can’t see them.
• Your business details: name, trade, phone, email, website, base suburb, service areas, services, working hours, logo and privacy policy link.
• Your settings, the notes you add, and a history of changes to each enquiry (like status changes).
• Billing details, such as your plan and payment records. Card payments are handled by our payment provider — we don’t see or store full card numbers.
• Anything you send us when you ask for help.

From customers, through an enquiry form

• Your name, and your phone number and/or email address.
• The job address, suburb and postcode, if the form asks for them.
• What the job is, how urgent it is, when suits you, and any description and photos you add.
• When you sent it, and that you agreed to the tradie receiving your details.

Photos are stored as you send them. Phone photos can include details saved by the camera, such as where the photo was taken.

We don’t ask for sensitive information (like health information). Please don’t include it in an enquiry unless the job needs it.

From everyone

• To stop spam, we keep a scrambled code made from your internet (IP) address for 2 days. We never store the IP address itself in our database.
• Our hosting provider keeps standard server logs (such as IP address, browser type and the pages requested) for a limited time, for security and fixing problems.

4. How we use it

We use account holders’ information to:

• provide Henshall Flow — showing your enquiries, sending your new-enquiry alerts and your customers’ receipts;
• run your account — logins, confirmation and password-reset emails, billing and support;
• tell you about important changes to the service, your account or these documents;
• keep the service secure, prevent spam and misuse, and fix problems; and
• meet our legal obligations, such as tax record-keeping.

We’ll only send you marketing emails if you’ve agreed to them, and every one will have a way to unsubscribe. How we use customers’ information is set out in section 2.

5. Who we share it with

• The tradie a customer sent an enquiry to.
• Service providers that help us run Henshall Flow, only as much as they need to do their job:
  • Supabase — our database, logins and photo storage (stored in Sydney, Australia);
  • Hostinger — runs the Henshall Flow website and app;
  • Resend — sends our emails, such as enquiry alerts, receipts and account emails;
  • Cloudflare — if a form has the “I’m not a robot” check switched on;
  • our payment provider (such as Stripe) — processes subscription payments; and
  • Google — hosts our email inbox, so it holds messages you send us.
• Our professional advisers, such as an accountant or lawyer, when we need their advice.
• Government agencies or police, when the law requires or allows it.
• A new owner, if Henshall Flow is ever sold. They’d have to keep protecting the information under this policy, and we’d tell account holders first.

We never sell personal information.

6. Information sent overseas

Our database, logins and photos are stored in Sydney, Australia. Some of our other providers handle information outside Australia — for example, our email-sending provider is in the United States, and our hosting, payment and spam-check providers run servers in several countries, which can include the United States, Europe and Asia. We use established providers with strong security, and take reasonable steps to make sure they handle personal information in a way that’s consistent with the Australian Privacy Principles.

7. How we keep it secure

• All connections are encrypted (HTTPS).
• Each business can only see its own enquiries. This is enforced by the database itself, not just the app.
• Photos are stored privately and shown only to logged-in users of that business, through links that expire.
• Passwords are stored hashed, and new accounts must confirm their email address.
• Forms have spam protection.
• Only Luka Henshall has administrator access, and only uses it to run and support the service — for example, when you ask for help.

No system is completely secure. If a data breach is likely to cause serious harm, we’ll tell the people affected as soon as we can, and the Office of the Australian Information Commissioner (OAIC) where required.

8. How long we keep it

• Enquiries, photos and notes: until the tradie deletes them or closes their account.
• Closed accounts: deleted within 30 days of closing, or sooner if you ask. Copies in our backups are overwritten within about a week after that.
• Scrambled IP codes for spam checks: 2 days.
• Billing records: as long as Australian tax law requires (generally 5 years).

9. Cookies

We only use the cookies needed to keep you logged in and keep the service secure. We don’t use advertising or analytics cookies, and we don’t track you across other websites. If a form has the “I’m not a robot” check switched on, Cloudflare may use its own cookies or similar data for that check.

10. Automated spam checks

We use automatic rules to block spam and abuse — for example, a limit on how many enquiries one connection can send in a short time, and blocking duplicate or robot submissions. If one of these stops a genuine enquiry, the person sees a message and can try again later or phone the tradie. We don’t use automated decision-making for anything else.

11. Seeing and correcting your information

Account holders can see and update most of their details in Settings at any time. For anything else — a copy of your information, or a correction you can’t make yourself — email us. Customers can ask the tradie they contacted, or us.

We’ll reply within 30 days. We may need to check who you are first. There’s no charge.

12. Complaints

If you’re unhappy with how we’ve handled your information, email us with the details and we’ll reply within 30 days. If you’re not satisfied with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Changes to this policy

We’ll update this policy when Henshall Flow changes; the date at the top shows the latest version. If we make a significant change, we’ll email account holders before it takes effect.

Contact: Luka Henshall, Henshall Flow — lhenshall414@gmail.com. See also our Terms of Service.