Skip to main content

Privacy Policy

Last updated: 5 September 2026

PaperFlow is a product of DigiGroup Pty Ltd (ACN 685 208 226). This policy explains how we collect, use, store, and protect your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). It covers our website, the PaperFlow web applications, and the PaperFlow mobile app for Android and iOS.

1. Information We Collect

We collect personal information through our website forms:

Email signup form:

  • Name
  • Email address
  • Marketing consent preference
  • Form submission source (automatically recorded)

Shortlist registration form:

  • Name
  • Email address
  • Company name
  • Phone number (optional)
  • Team size
  • Current software
  • Marketing consent preference
  • Form submission source (automatically recorded)

We also collect technical data automatically:

  • Anonymised website usage data via Google Analytics 4 (page views, device type, approximate location)
  • IP address and browser type (standard web server logs)

Subscription and payment information:

If you subscribe to PaperFlow, we collect the information needed to manage your subscription — your name, email address, business details, and a record of your plan and payments. Your card details are entered directly with our payment processor, Stripe, and are stored by Stripe — not by PaperFlow. We never see or store your full card number.

Information created in PaperFlow:

If you or your employer use PaperFlow, the platform holds the records created in it — inspections, tasks, assets, defects, photos, documents and notes — together with the name and email address of each user. Accounts are created by a customer’s administrator; there is no public sign-up. Section 5 explains how this works in the PaperFlow mobile app.

2. How We Use Your Information

We use your personal information to:

  • Follow up with you about PaperFlow access
  • Process your subscription payments and manage your account, if you are a customer
  • Personalise our communication based on your team size and current software
  • Send marketing communications, only with your explicit consent
  • Improve our website and understand how visitors use it

3. Marketing Communications

We comply with the Spam Act 2003 (Cth). We will only send you marketing emails if you have given your explicit opt-in consent via the checkbox on our forms.

You can withdraw your consent at any time by contacting us at info@paperflow.com.au. We will action your request promptly.

4. Data Storage & Security

  • Your PaperFlow account and business data — inspections, tasks, assets, defects, photos, documents and notes — is stored in Australia. Our application servers and PostgreSQL database run on Google Cloud in the Sydney region (australia-southeast1)
  • Photos and documents you upload are held in a private Google Cloud Storage bucket in the same Sydney region. They are never publicly accessible — each view is served through a short-lived signed link
  • Data submitted through our website forms is stored in Google Firebase (Firestore), also in the Sydney region (australia-southeast1)
  • All data is transmitted over HTTPS (encrypted in transit)
  • Google Cloud provides encryption at rest by default
  • Payment card details are entered with and held by our payment processor, Stripe — PaperFlow does not store your full card details. Stripe maintains its own industry-standard (PCI DSS) security for the card data it processes
  • Access to your data is limited to authorised DigiGroup staff

If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth).

5. The PaperFlow Mobile App

This policy also covers the PaperFlow mobile app for Android and iOS. The app is used by technicians at businesses that subscribe to PaperFlow. There is no public sign-up — accounts are created for staff by their employer’s PaperFlow administrator.

Who the information belongs to

Almost everything created in the app — inspections, tasks, assets, defects, photos and notes — is your employer’s business record. Your employer controls that information; PaperFlow stores and processes it on their behalf. If you want information you created corrected or removed, ask your employer’s PaperFlow administrator first, because they decide what is kept. We will always help an administrator carry out a request.

Location

The app can show your position on the job map so you can see where you are in relation to your work. Your device asks your permission before this happens, and you can refuse or turn it off at any time in your device settings — the rest of the app keeps working. Your location is used on your device only. We do not send it to our servers, and it is never recorded or stored. The only coordinates our servers hold are the addresses of the properties your employer has set up.

Camera and photos

The app uses your camera so you can photograph equipment, asset tags, defects and completed work. Those photos are uploaded and attached to the relevant job record in your employer’s account. They are stored privately, and are only viewable by people your employer has authorised. The camera is also used to scan asset tag barcodes and QR codes — these are read on your device as you point the camera at them, and no image is uploaded or kept. The app does not read your photo gallery or your other files — it only receives the pictures you take with the camera inside the app.

Unlocking the app

You can use your device’s fingerprint or face unlock to open the app. This is handled entirely by your device’s operating system, which simply tells the app whether it recognised you. We never receive, see or store your fingerprint or face data.

No tracking

The app contains no advertising, no analytics, and no crash-reporting or tracking tools of any kind. We do not build a profile of you, and we do not sell or share your information for advertising. The Google Analytics described in Section 6 applies to our website only.

Maps

Map imagery is provided by Mapbox. Displaying a map sends the area being viewed to Mapbox so it can return the map tiles, along with your device’s IP address and an anonymous usage identifier.

Where your information is stored

PaperFlow is built, hosted and operated in Australia. Our servers, our database, and the photos and documents you upload are all held in Google Cloud’s Sydney region, and our notification email is sent through Amazon SES in its Sydney region. Sign-in is handled by Google Firebase Authentication, map imagery by Mapbox, and payments by Stripe — these are global services, so account, billing and map-request details may be processed outside Australia by those providers.

Questions or requests

Email info@paperflow.com.au. If you use the app as an employee, please contact your employer’s PaperFlow administrator first — see “Who the information belongs to” above.

6. Analytics

We use Google Analytics 4 to understand how visitors use our website. GA4 collects anonymised data, we do not use it to identify individual users.

You can opt out of Google Analytics by using browser extensions such as the Google Analytics Opt-out Browser Add-on or by adjusting your browser privacy settings.

7. Your Rights

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

To exercise any of these rights, contact us using the details below.

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes described in this policy. If you are a customer, we keep your account and business data for 30 days after your subscription ends so you can re-subscribe or export it, after which we may delete it — this matches our Terms of Service. You can request deletion of your data at any time by contacting us.

9. Third Parties

We use the following third-party services:

  • Google Cloud Platform - application hosting, database, and storage of the photos and documents you upload (Sydney region)
  • Google Firebase - website hosting and storage of website form submissions (Firestore, Sydney region)
  • Google Firebase Authentication - sign-in for the PaperFlow platform and mobile app
  • Mapbox - map imagery in the job and scheduling maps. Displaying a map sends the area being viewed, your IP address, and an anonymous usage identifier to Mapbox. See Mapbox’s privacy policy.
  • Amazon SES - delivery of our notification and transactional email (Sydney region)
  • Google Analytics 4 - anonymised website usage analytics. This applies to our website only; the PaperFlow mobile app contains no analytics
  • Stripe - payment processing for subscriptions. When you subscribe, your payment and card details are collected and processed by Stripe as our payment processor. See Stripe's privacy policy.

We do not sell or rent your personal information. We share it only with the service providers listed above, and only to the extent needed to provide our service — for example, your payment details are shared with Stripe to process your subscription. We do not share your personal information with any other third parties for their own purposes.

Some of these providers may store or process your personal information outside Australia. In particular, Stripe (payment processing), Mapbox (map imagery), and Google (analytics and sign-in) may handle your information overseas, including in the United States. Your PaperFlow account data and the photos and documents you upload are held in Australia, as described in Section 4. Where we disclose personal information to an overseas recipient, we take reasonable steps to ensure it is handled in a way consistent with the Australian Privacy Principles.

10. Contact Us

If you have questions about this privacy policy or wish to exercise your rights, contact us:

11. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.