How Frontlatch handles personal information.

People who send a request through an AI assistant

The name, an email address or phone number, the job description, the suburb, an optional postcode and an optional preferred time. If an owner has switched sign-up on, a sign-up sends the name, email and chosen plan to that business. A password or card number is never sent through us.

Business owners

Your email address, your password (stored only as a salted hash), your Google account id if you sign in with Google, the businesses you claim and how you proved it, the address where you want job cards, and the replies and quotes you send. If you pay us, Stripe holds your card; we keep only the Stripe customer and subscription ids.

Partners

Agency name, website, contact name, email, number of client sites and the platforms you use, from the partner application.

Scan requests

The domain you ask us to scan and the email address you give for the report.

The business index

Information businesses publish about themselves, including sole traders: business name, website, category, location and published contact details, gathered from the business’s own site, OpenStreetMap and Common Crawl. A business can claim, correct or remove its listing.

Visitors to frontlatch.com and to sites running the Tracker

On frontlatch.com we set a sign-in cookie and a campaign cookie (see cookies). We use your IP address briefly to limit repeated sign-in and code attempts; we do not store it. The Tracker on a business’s site records browser signals such as the user agent, the page path and the referring site, and never your IP address, a cookie or anything typed into a form.

• To pass a request to the business it is for, and to carry the business’s answer back.
• To run accounts, verify that a claim is genuine and keep the console secure.
• To build and keep up to date the business index that AI assistants search.
• To send scan reports, sign-in codes, job cards and the account emails you asked for.
• To bill, pay partner shares and meet our tax obligations.
• To tell agent traffic from human traffic for the businesses that install the Tracker.

• Accounts, claims, requests and owner replies: while the account is open, then deleted on request.
• Partner applications and partner statements: while the partnership runs, then deleted on request, except records tax law requires us to keep.
• Billing records: as long as tax law requires, currently five years.
• Sign-in sessions: 30 days. Password reset links: 30 minutes. Email verification links: 24 hours. Sign-in and claim codes: 15 minutes.
• Links to confirm a request: 30 days.
• Scan requests and scan reports: 30 days.
• Tracker events: 60 days.
• Index listings: until the business removes its listing. We keep a note of the removal so the listing is not added again.

A request goes to the business it is for. We do not sell personal information. These service providers process it for us, some outside Australia:

• Cloudflare (United States, with servers worldwide): hosting of the site and its database.
• Railway (United States): hosting of the Tracker, the scan service and the gateway.
• Brevo (France): sending email.
• Stripe (United States): payments and billing.
• Google (United States): sign-in, only if you choose Sign in with Google.

We do not send personal information to an AI provider. A request reaches us through the AI assistant the person chose, and that provider handles the conversation under its own privacy policy.

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Write to [email protected]; we answer within 30 days. A business can also remove its listing from its own page in the index.

If you have a complaint, tell us first and we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.