1. Scope and our approach
Maintstra ("Maintstra", "we", "us" or "our") is an Australian-operated property maintenance service. We manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply, and use the APPs as our privacy baseline.
This policy applies to Maintstra's mobile app, website, contractor email and secure-link workflows, inspection reporting, company groups and support communications. It does not replace any collection notice shown at the time we request particular information.
2. Personal information we collect
| Category | Examples | How it is collected |
|---|---|---|
| Account and identity | Email address used for magic-link sign-in, profile details, company membership, role and subscription status. | From you, your organisation administrator, Apple, Google, RevenueCat or the applicable app store. |
| Property and location | Building name, address, unit or area labels, notes, optional latitude and longitude, and location used to suggest an address or find nearby contractors. | Entered by you or, with device permission, obtained from your device and reverse-geocoding or Google Places services. |
| Photos, video and audio | Issue photos, videos of up to 60 seconds, video audio tracks and transcripts, metadata, before-and-after evidence and inspection photos. | Captured with the device camera or selected from the device library. |
| Work orders and inspections | Issue descriptions, AI assessments, urgency and trade suggestions, safety notes, status history, costs, quotes, approvals, ratings, inspection areas, findings, reports and completion evidence. | Created by users, contractors and Maintstra's automated workflows. |
| Contractor information | Names, business details, trade, phone, email, ratings, reliability history, licence details, insurance records, certificates and expiry dates. | Entered or imported by users, provided by contractors, or returned by an authorised business-search request. |
| Communications | Email subject and body, recipients and copies, delivery activity, contractor replies, availability, quotes, attachments and support messages. | Sent and received through Maintstra and Postmark, or provided to support. |
| Technical information | Push notification token, device and app version, IP address, security and error logs, request timestamps and usage events. | Generated when you use the service. |
Photos, videos, audio and documents may contain personal information about occupants, visitors, contractors or other people. Only upload content you are authorised to collect and share, and avoid recording people or private areas unless necessary.
3. How we use personal information
We use personal information to:
- authenticate users and secure accounts;
- store and organise building, contractor, work-order and inspection records;
- analyse reported issues and prepare editable summaries, emails and reports;
- send quote requests, work orders, reminders, notifications and secure links;
- extract proposed times, quotes and next actions from contractor replies;
- support company groups, shared contractor directories and role-based access;
- provide location-based address suggestions and nearby contractor search when requested;
- administer subscriptions, report usage limits and provide customer support;
- protect the service, investigate errors, prevent misuse and comply with legal obligations.
We do not sell personal information. We do not use precise device location for advertising.
4. AI processing and overseas disclosure
Maintstra uses OpenAI models accessed through the OpenRouter gateway to assist with issue diagnosis, image and video-frame analysis, transcript and email drafting, contractor-reply parsing, quote comparison, completion review and inspection findings.
Depending on the feature, information sent for AI processing may include issue photos, selected video frames, audio transcripts, property or area context, issue notes, contractor communications and related work-order text. We minimise the context sent where practical. Maintstra does not intentionally use customer content to train its own AI models.
OpenRouter and the selected model provider, including OpenAI, are overseas recipients and may process information in the United States and other countries where they or their subprocessors operate. Privacy protections in those countries may differ from Australia. Maintstra takes reasonable steps to use appropriate provider settings and contractual or technical safeguards, but third-party processing remains subject to the provider's terms and privacy practices.
OpenRouter states that prompts and responses are not retained by default unless logging is enabled, while the downstream model provider's practices can vary by endpoint. We may change models or providers where required for reliability, security or privacy and will update this policy if the change materially affects information handling.
AI output is not an automatic final decision. Users can edit assessments and communications and must approve quotes, contractor selection, inspection findings, status changes and completion decisions.
5. Storage, communications and other providers
We disclose information only as needed to operate Maintstra, respond to you, protect users or comply with law. Providers may process information outside Australia.
- Cloudflare R2: private storage for uploaded photos, video, contractor documents and generated inspection files. Access uses short-lived signed URLs.
- Railway and PostgreSQL: application hosting and structured account, work-order, contractor and inspection records.
- Postmark: magic-link, contractor and support email delivery, inbound replies and related message activity.
- OpenRouter and OpenAI: AI inference and structured outputs as described above.
- Google Places and device location services: address assistance and nearby contractor search initiated by the user.
- Expo: mobile update and push-notification delivery infrastructure.
- RevenueCat, Apple and Google: subscription entitlement and purchase-status administration. Maintstra does not receive full payment-card details.
Contractors and people you choose to copy on an email receive the work-order information, address, contact details and media you intentionally send to them. Members of a company group can access shared company contractor information according to their role; personal work remains private unless a feature expressly shares it.
6. Security
Maintstra uses measures including one-time sign-in links, hashed authentication tokens, access controls, encrypted HTTPS connections, private object storage, expiring signed media links and server-side provider credentials. No online service can guarantee absolute security.
If you believe your account or information has been compromised, contact support@maintstra.com promptly.
7. Data retention and deletion
We retain information only for as long as reasonably necessary for the purposes described above, to maintain an auditable property record, resolve disputes and meet legal obligations.
| Information | Typical retention |
|---|---|
| Magic-link sign-in token | The one-time link expires after 15 minutes. Maintstra stores only a cryptographic hash and removes stale tokens. |
| Account, work-order, contractor, inspection and private media records | While the account is active and until deletion is requested, unless a longer period is reasonably required for a legal claim, safety record, company audit record or applicable law. |
| Postmark email content and activity | Postmark currently retains message content and activity for 45 days by default. Maintstra may separately retain relevant work-order communication in its own records. |
| Verified deletion requests | We aim to delete or de-identify eligible information from active systems within 30 days. Residual encrypted backups may take up to 90 days to rotate out. |
| Financial, tax, fraud-prevention or legal records | For the period required by applicable law, which may be up to seven years for some Australian business records. |
Deletion may be limited where information belongs to a company record, is required to protect another person's rights, must be retained by law, or is needed to establish, exercise or defend a legal claim. Where possible, we will restrict or de-identify information instead.
8. Access, correction and deletion requests
You may request access to personal information we hold about you, ask us to correct inaccurate information, withdraw optional permissions, or request account and data deletion by emailing support@maintstra.com.
Include the email address used for your Maintstra account and describe the request. We may ask for information to verify your identity and authority before releasing, changing or deleting records. We will respond within a reasonable period and explain any lawful reason we cannot fully comply.
You can disable camera, photo-library, location, calendar and notification permissions in device settings. Some features will not operate without the relevant permission. Location is optional and an address can be entered manually.
9. Privacy questions and complaints
Send privacy questions or complaints to support@maintstra.com. Describe what happened, when it happened, the account involved and the outcome you are seeking. We aim to acknowledge the complaint promptly and respond within 30 days.
If you are not satisfied with our response, or we do not respond within a reasonable period, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC generally expects you to complain to the organisation first.
10. Changes to this policy
We may update this policy when Maintstra's features, providers or legal obligations change. The effective date at the top identifies the current version. We will provide additional notice where a change materially affects how existing personal information is handled.