Privacy policy

Last updated: October 2026

Who we are

Inducta Flow is operated by Clouded House (ABN 74 396 255 667) ("we", "us"). We provide QR-code site forms for construction businesses. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Our customers and their workers

Construction businesses ("customers") use Inducta Flow to collect records from people on their sites. For those records, the customer decides what is collected and why, and we store and process the information on the customer's behalf. If you are a worker and have a question about a record, you can contact the business that runs the site, or contact us and we will pass it on.

What we collect

• From workers and visitors on a customer's site: name, company, mobile number, induction and fit-for-work answers, signatures, the forms submitted (sign-ins, SWMS sign-ons, hazard and incident reports, toolbox talk attendance) and any photos attached, with the time and site.
• Location at sign-in (only on sites that switch it on): the worker's phone shares its position once, when they sign in. We work out how far they are from the site and keep only that distance and whether they were on site. We do not keep the position itself or track anyone after sign-in.
• From customer staff: name, email address, company details and logo, site details and SWMS content. If you sign in with Google, see Signing in with Google below.
• Payments: handled by our payment provider (Stripe). We do not see or store full card details. Printers you order signs from collect their own details under their own privacy policies.
• Technical information: basic logs such as browser type and time of access, used to keep the service secure and working.

A worker's name, company and mobile number are also saved on their own phone so they do not have to type them again. They can clear this by clearing their browser data.

How we use it

• To provide the service to our customers, including showing records, producing PDFs, print-ready sign files and exports.
• To sign you in, by emailed code, emailed link or your Google account.
• To send login codes and links, and service messages.
• To keep the service secure, fix problems and improve it.

We do not sell personal information and we do not use workers' information for marketing.

Signing in with Google

Site managers can sign in to Inducta Flow with their Google account instead of an emailed code. Workers who scan a site's QR code never sign in, and nothing in this section applies to them.

What we receive from Google. When you choose Continue with Google and agree on Google's screen, Google sends us only your name, your email address and your profile picture link (the basic "email" and "profile" permissions). We do not ask for, and cannot see, your Google password, Gmail, contacts, calendar, Drive files or any other Google data.

How we use it. We use your email address to confirm who you are, sign you in and connect you to your company's Inducta Flow account and the sites you manage. We use your name to show who is signed in and who made changes to records. We do not use your Google information for advertising, we do not sell it, and we do not use it to train artificial intelligence or machine learning models.

Who we share it with. Nobody, except the service that runs our sign-in and database (Supabase, hosted in Sydney, Australia), which handles it only to provide our service to you. We do not transfer it to anyone else unless the law requires it.

Storage and deletion. Your name and email are kept in our sign-in database in Sydney while your account is active. You can ask us to delete them at any time by emailing hello@inductaflow.app; we delete them within 30 days, and within 90 days of a company closing its account. You can also remove Inducta Flow's access at any time from your Google Account, under Security, Your connections to third-party apps and services.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Where it is stored

Records are stored in a database hosted in Sydney, Australia. Some service providers we use, such as our email, hosting, sign-in (Google), address lookup (Google) and payment providers, may process limited information outside Australia. We choose providers that protect information to a standard comparable to the Australian Privacy Principles.

How long we keep it

We keep records for as long as the customer's account is active, or as the customer directs, so they can meet their own record-keeping obligations. When a customer closes their account, we delete their records within 90 days unless the law requires us to keep them.

Security

Access to records is limited to the customer's own managers. Information is encrypted in transit, and each company's data is separated by access rules in the database.

Access, correction and complaints

You can ask to see or correct personal information we hold about you by emailing hello@inductaflow.app. If you have a complaint, contact us first and we will respond within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.