Legal
Privacy Policy
Effective date: July 2026
This Privacy Policy explains how ObliTrack collects, uses, stores, discloses and protects personal information when individuals access or use the ObliTrack website, platform and related services.
ObliTrack seeks to handle personal information transparently and in accordance with applicable Australian privacy laws.
1. About this policy
This policy applies to personal information handled through:
- ObliTrack accounts;
- customer workspaces;
- uploaded documents;
- project and contact registers;
- automated communications;
- billing and support interactions; and
- the ObliTrack website.
A customer organisation may also have its own privacy obligations concerning information uploaded by its users. Customers are responsible for ensuring that they have lawful authority to provide that information to ObliTrack.
2. Information we collect
Depending on how the Platform is used, ObliTrack may collect:
Account information
- name;
- email address;
- organisation name;
- role or position;
- authentication information;
- account preferences; and
- subscription details.
Organisation and project information
- company and business details;
- project names and addresses;
- permit and approval references;
- project stages;
- obligations and due dates;
- consultant and authority details;
- responsibility assignments; and
- project notes and records.
Uploaded documents
Users may upload:
- planning permits;
- cultural heritage management plans;
- referral authority responses;
- professional reports;
- approvals;
- correspondence;
- plans;
- evidence records; and
- other development-related documents.
These documents may contain personal information concerning employees, consultants, contractors, landowners, applicants, authority representatives or other individuals.
Contact information entered by customers
- names;
- email addresses;
- phone numbers;
- companies;
- professional roles; and
- communication history.
Billing information
ObliTrack may collect:
- billing name;
- billing address;
- subscription plan;
- payment status;
- invoice records; and
- transaction identifiers.
Payment card details are processed by Stripe and are not ordinarily stored directly by ObliTrack.
Technical and usage information
ObliTrack may collect:
- IP address;
- device and browser information;
- login times;
- activity logs;
- pages and features used;
- document upload activity;
- error logs;
- email delivery events; and
- security-related information.
3. How we collect information
Information may be collected:
- directly from you when you create or update an account;
- from your employer or organisation when it invites you;
- when users upload documents or enter project information;
- automatically through use of the Platform;
- from payment, email, hosting and authentication providers;
- through support enquiries; and
- through cookies and similar technologies.
4. Why we collect and use information
ObliTrack may use information to:
- create and administer accounts;
- provide and operate the Platform;
- store and display project information;
- process uploaded documents;
- manage reminders and send authorised communications;
- process subscriptions and payments;
- provide customer support;
- monitor usage and fair-use compliance;
- secure and troubleshoot the Platform;
- prevent fraud, misuse and unauthorised access;
- maintain backups and audit logs;
- improve features and usability;
- comply with legal obligations; and
- communicate service, security and billing information.
ObliTrack does not use uploaded project documents for unrelated advertising purposes.
6. Service providers
ObliTrack uses third-party providers to operate the Platform. These may include:
- Stripe for subscriptions and payments;
- Supabase for database, storage and authentication services;
- Resend for email delivery;
- Vercel for application hosting and deployment; and
- providers used for analytics, monitoring, security or customer support.
These providers may process information only to the extent required to provide their services or comply with applicable law.
The specific providers used may change as the Platform develops.
7. Overseas processing and disclosure
Some service providers or their infrastructure may be located outside Australia or may process information in multiple countries.
As a result, personal information may be disclosed to or accessed from overseas locations, including locations in which ObliTrack’s cloud, email or payment providers operate.
Where applicable, ObliTrack takes reasonable steps to assess providers and use contractual, organisational or technical safeguards appropriate to the nature of the information and service.
Customers should avoid uploading sensitive or unnecessary personal information where it is not required for the Platform’s purpose.
8. Legal bases and customer authority
Customers are responsible for ensuring they have a lawful basis and appropriate authority to upload, store and process information relating to other individuals.
This may include providing appropriate notices or obtaining consent where required.
ObliTrack may process information where reasonably necessary to:
- perform its agreement with a customer;
- provide requested services;
- comply with legal obligations;
- protect legitimate business and security interests; or
- act on consent where consent is required.
9. Disclosure of information
ObliTrack may disclose information:
- to service providers described in this policy;
- to authorised users within the relevant customer workspace;
- where directed or authorised by the customer;
- to professional advisers;
- in connection with a business sale, investment, merger or restructure;
- to investigate fraud, security incidents or misuse;
- where required or authorised by law; or
- where reasonably necessary to protect the rights, safety or property of ObliTrack, customers or third parties.
ObliTrack does not sell personal information to advertisers.
10. Data security
ObliTrack takes reasonable technical and organisational steps to protect information from misuse, interference, loss, unauthorised access, modification and disclosure.
Measures may include:
- authenticated account access;
- access controls;
- encrypted data transmission;
- role-based workspace restrictions;
- database security policies;
- monitoring and audit logs;
- backups;
- security updates; and
- restricted administrative access.
No online service can guarantee absolute security.
Users must protect their credentials and notify ObliTrack promptly of suspected unauthorised access.
11. Multi-tenant access
Customer data is logically associated with the relevant organisation or workspace.
ObliTrack uses access controls intended to prevent customers from accessing another organisation’s private information.
Platform administrators may access customer information where reasonably necessary for:
- customer support;
- security;
- troubleshooting;
- legal compliance;
- account administration; or
- maintaining the Platform.
Administrative access should be limited to authorised personnel and recorded where appropriate.
12. Data retention
ObliTrack retains information for as long as reasonably necessary to:
- provide the Platform;
- maintain customer accounts;
- comply with legal and financial obligations;
- resolve disputes;
- investigate security incidents;
- maintain backups; and
- enforce agreements.
Following cancellation:
- a workspace may become read-only;
- information may remain available during a recovery period;
- information may persist temporarily in backups; and
- data may later be deleted or de-identified.
Customers may request deletion, subject to legal, security, billing, technical and backup requirements.
13. Data exports and account closure
Account owners may request:
- access to workspace information;
- an export of available data;
- closure of the organisation account; or
- deletion of customer information.
Before deleting an account, ObliTrack may need to verify the requester’s identity and authority.
Deletion may not be reversible.
14. Access and correction
Individuals may request access to personal information held about them or ask for inaccurate information to be corrected.
Requests should be sent to support@oblitrack.com.au.
ObliTrack may require identity verification and may refuse or limit a request where permitted by law. Where a request is refused, reasons will be provided where required.
15. Cookies and similar technologies
ObliTrack may use cookies, local storage and similar technologies to:
- authenticate users;
- maintain sessions;
- remember preferences;
- support security;
- measure performance; and
- understand Platform usage.
Disabling essential cookies may prevent parts of the Platform from functioning properly.
16. Analytics and monitoring
ObliTrack may collect aggregated or de-identified usage information to understand:
- active users;
- feature adoption;
- document upload volumes;
- reminder activity;
- performance; and
- customer support needs.
Where information is genuinely de-identified, it may be used for analytics, service improvement and business planning.
17. Marketing communications
ObliTrack may send product updates, offers or other marketing communications where permitted by law.
Recipients may unsubscribe using the link provided or by contacting support.
Service messages relating to security, billing, account administration or material Platform changes are not marketing communications and may still be sent while an account remains active.
18. Data breaches
If ObliTrack becomes aware of a data breach, it will investigate and take reasonable steps to contain and assess the incident.
Where required by applicable law, ObliTrack will notify affected individuals and relevant regulators.
19. Children
The Platform is intended for business and professional users and is not directed to children under 18.
ObliTrack does not knowingly invite children to create accounts.
20. Third-party links
The Platform may contain links to third-party websites or services.
ObliTrack is not responsible for the privacy practices or content of third parties. Users should review the relevant third-party privacy policies.
21. Changes to this policy
ObliTrack may update this Privacy Policy to reflect changes in law, technology, service providers or Platform functionality.
Material changes will be notified through the Platform, by email or by another reasonable method.
The updated policy applies from the stated effective date.
22. Privacy enquiries and complaints
Privacy enquiries, access requests, correction requests, deletion requests or complaints can be sent to:
Email: support@oblitrack.com.au
ObliTrack will review complaints and respond within a reasonable period.
Individuals may also have the right to contact the Office of the Australian Information Commissioner where applicable.
23. Business details
ObliTrack ABN 65 390 745 370 Melbourne, Victoria, Australia Email: support@oblitrack.com.au