Privacy Policy

01 Who we are and the two roles we play

Businesses that use CabSys — we call them factories — run their quoting, orders, production, installation and invoicing in it.

For a factory's own users and for visitors to this website, CabSys collects and holds personal information directly and is responsible for it under this policy.

For the customers, suppliers and installers whose details a factory enters, the factory decides what is collected and what it is used for. CabSys stores and processes that information on the factory's behalf and on its instructions. If you are one of those people, the factory you deal with is your first point of contact; this policy explains what CabSys does with the information in the meantime.

02 What personal information we process

Depending on how you interact with CabSys, this can include:

• Account details of factory users: name, work email address, mobile number, role, language preference, and sign-in and security records.
• Business contacts a factory enters: names, company names, ABNs, email addresses, phone numbers, site and delivery addresses, notes and tags, and the quotes, contracts, orders, invoices, photos and documents that belong to a job.
• Email records: for every message sent through CabSys we keep the recipient address, subject, sending time and delivery outcome (sent, failed, bounced or reported as spam), so the factory can see what it sent and so we can keep delivery healthy.
• Technical data: IP address, browser and device type, request logs and error reports, used to secure the service and fix problems.
• Support enquiries: whatever you include when you write to us.

CabSys does not ask you for payment card details, and invoices sent through CabSys are paid directly to the factory that issued them.

03 Why we use it

We use personal information only to:

• provide the service — storing a factory's records, generating its documents, and showing each user what their role allows;
• send email on a factory's behalf when one of its users triggers it (next section);
• keep CabSys secure — sign-in protection, rate limits, abuse prevention and audit logs;
• support factories and answer enquiries;
• meet legal obligations, such as keeping business records or responding to a lawful request.

We do not sell personal information, do not use it for advertising, and do not use a factory's data for anything other than running CabSys for that factory.

04 Email sent on a factory's behalf

When a factory sends a quotation, contract, design approval, invoice, payment reminder, acceptance report, change order or portal invitation from CabSys, CabSys sends that email on the factory's behalf. It arrives from no-reply@post.cabsys.com.au with the factory's name in the sender name — for example “Acme Joinery via CabSys” — and replies go straight to the factory's own email address. Every such message says which factory sent it.

A factory can instead connect its own mail service, such as Microsoft 365 or Google Workspace. Its email then leaves from its own address through its own provider, and CabSys only prepares the message.

CabSys sends only transactional messages that a factory user triggers for a specific business relationship. CabSys does not send marketing or bulk email to a factory's contacts, and factories may not use the platform for that (see the Terms).

05 How to stop receiving email

If email sent through CabSys is unexpected or unwanted:

• Reply to the message. Replies reach the factory that sent it, which can stop emailing you or correct your details.
• Or write to us at dev@cabsys.com.au with the sender's name and the address the email was sent to. We will block further platform email to that address and tell the factory.
• Addresses that bounce, or that report a message as spam, are blocked automatically.

These emails carry documents you may have asked for, such as a quote or an invoice, so once an address is blocked the factory will have to reach you another way.

06 Where information is stored and who else handles it

The CabSys application, its database and its backups run in Sydney, Australia. Web traffic and uploaded files also pass through, or are stored with, Cloudflare — a United States company whose network spans many countries — so some information may be handled outside Australia. A small number of providers handle information only as needed to run the service:

• Google Cloud (Sydney region) hosts the application, the database and its backups.
• Cloudflare delivers this website and the CabSys application. Every request to them passes through Cloudflare’s global network, which processes technical request data — IP address, request headers and the address requested — at whichever Cloudflare data centre serves the visitor, and that may be outside Australia. Because Cloudflare handles the secure connection, the content of requests and responses, which can include personal information, also passes through its network in transit.
• Cloudflare R2 stores the files uploaded to or generated in CabSys, such as attachments, documents and PDFs, and a backup copy of those files. A file deleted in CabSys stays in R2 for at least 90 days so it can be restored. Storage is set up with an Oceania location hint, which is a preference, not a guarantee: Cloudflare does not promise that files, backups or deleted files stay in Australia.
• Amazon Web Services (Sydney region) relays email sent on the platform channel and reports its delivery outcome to us.
• Cloudflare Turnstile protects the sign-in page from automated abuse and sees the technical data of the visitor completing the check.
• Google Maps Platform provides address lookup when a factory types an address into CabSys.
• A factory's own mail provider, when the factory connects its own mail service.

Cloudflare is a United States company and its network operates in many countries, so information that passes through it, and files held in R2, including their backup copy and deleted files, may be handled in the United States or other countries outside Australia. The database and its backups are held in Sydney.

Access by CabSys staff is limited to what operating and supporting the service requires, and is logged.

07 How long we keep it

A factory's records stay in CabSys for as long as its account is active, and the factory can edit or delete them at any time. A deleted file is kept for at least 90 days so it can be restored; backups expire on a fixed schedule.

When a factory closes its account we delete its data after a reasonable period, keeping only what the law requires us to retain. Email delivery records are kept as part of the factory's records and for as long as we need them to protect the platform's sending reputation.

08 Security

Information is encrypted in transit and at rest. Each factory's data is isolated from every other factory's at the database level, access inside a factory is controlled by roles, sign-in is protected against guessing and automated attacks, and changes to important records are logged. No system is perfectly secure: if you believe an account or the platform has been compromised, contact us straight away.

09 Access, correction and complaints

If a factory holds information about you, ask that factory first — it controls the record and can correct or delete it in CabSys.

For information CabSys holds directly, or if you cannot reach the factory, write to us at dev@cabsys.com.au and we will respond within 30 days. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC).

10 Cookies and browser storage

This website stores only your language choice in your browser and sets no advertising or analytics cookies. The CabSys application uses cookies to keep you signed in and browser storage for your preferences.

11 Changes to this policy

We update this page when our practices change and show the date at the top. Material changes are announced inside the product.