Solar Proof Solutions Pty Ltd (ACN 633 010 821)
Trading as: solarproof.com.au

Last Updated: 29th January, 2025

Thank you for choosing Solar Proof Solutions Pty Ltd ("Solar Proof," "we," "us," or "our"). We are committed to protecting your privacy and ensuring the security of your personal information.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Software-as-a-Service (SaaS) platform and related services (collectively, the "Service"). This Privacy Policy has been drafted to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1.1 Personal Information

We collect personal information that you provide directly to us:

• Account Information: Full name, email address, phone number, business name (if applicable), and ABN (for business customers)
• Billing Information: Payment details, billing address, and GST registration status
• Professional Information: Job title, company role, and professional qualifications (if applicable)
• Communication Records: Customer service interactions, support tickets, and correspondence

1.2 Business and Project Data

Information related to your use of our Service:

• Solar system designs and specifications
• Project documentation and reports
• Client property information and site assessments
• Energy consumption data and analysis
• Compliance documentation

1.3 Automatically Collected Information

• Technical Data: IP address, device information, browser type, operating system
• Usage Data: Log files, access times, pages visited, features used
• Location Data: General location based on IP address
• Cookies and Similar Technologies: Session cookies, persistent cookies, and analytics tools

2.1 Primary Purposes

• Providing and maintaining our Service
• Processing payments and managing subscriptions
• Authenticating user access and maintaining account security
• Providing technical support and customer service
• Generating solar design proposals and compliance documentation

2.2 Secondary Purposes

• Improving and optimizing our Service
• Conducting research and analysis
• Sending service updates and maintenance notifications
• Marketing communications (with your consent)
• Complying with legal obligations

These secondary purposes do not apply to Google user data. Data obtained from Google APIs is used only to provide and improve the calendar features it was granted for, and is never used for research, analysis, marketing, advertising, or to train machine learning or AI models. See section 13.

3.1 Third-Party Service Providers

We may share your information with:

• Cloud hosting and storage providers
• Payment processing services
• Analytics and monitoring services
• Customer support tools
• Professional services (e.g., accountants, lawyers)

3.2 Legal Requirements

We may disclose your information if required by:

• Australian law or legal process
• Court orders or subpoenas
• Regulatory authorities
• Protection of our legal rights or those of others

We implement appropriate technical and organizational measures to protect your personal information, including:

• End-to-end encryption for data transmission
• Secure socket layer (SSL) technology
• Access controls and authentication requirements
• Regular security assessments and penetration testing
• Employee training on data protection
• Secure data centers located in Australia

We retain your personal information for as long as necessary to:

• Provide our Service
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

When personal information is no longer needed, it is securely destroyed or de-identified.

Under Australian privacy law, you have the right to:

• Access your personal information
• Correct inaccurate or outdated information
• Request deletion of your information (subject to legal requirements)
• Opt-out of marketing communications
• Lodge a complaint about our privacy practices

While our primary data storage is in Australia, some data may be transferred to overseas service providers. We ensure that any international transfers comply with Australian privacy law and that adequate protection is in place.

Our Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will:

• Post the updated policy on our website
• Update the "Last Updated" date
• Notify you of material changes via email or Service notification
• Obtain consent where required by law

For privacy-related inquiries or complaints, please contact:

Privacy Officer
Solar Proof Solutions Pty Ltd
764 Cudgen Rd Kingscliff, NSW, 2487
Email: privacy@solarproof.com.au
Phone: 1300 602 452

Our Service may contain links to external websites or services. This Privacy Policy does not cover these external sites, and we encourage you to review their privacy policies.

If you are using our Service on behalf of a business, additional terms may apply through our Business Terms of Service.

This section governs all Google user data and overrides anything broader elsewhere in this policy. Where sections 1 to 12 describe wider uses of personal information - such as research and analysis, or marketing - those uses do not apply to data obtained from Google APIs. Google user data is used solely to provide and improve the user-facing calendar features described below.

Solar Proof offers an optional calendar integration. If you choose to connect a Google Account, this section explains exactly what Google user data we access, why, how we store it, and how you can remove it. Connecting a calendar is never required to use Solar Proof, and you can disconnect at any time.

What we access, and why

• The list of calendars in your Google Account (scope calendar.calendarlist.readonly) - so you can choose which of your calendars to sync. We read the calendar names and identifiers only.
• Events on the calendars you select (scope calendar.events) - so your existing commitments appear alongside your Solar Proof jobs and you are not double-booked, and so that appointments you create in Solar Proof appear in your own calendar.
• Your Google Account email address (scopes openid and email) - shown in Solar Proof so you can tell which account is connected, and used to keep the connection attached to the right account.

We do not request access to Gmail, Google Drive, Contacts, or any other Google service.

What we store

• A rolling window of your events covering the last 7 days and the next 60 days, for the calendars you selected. For each event we store the event identifier, title, description, start and end times, and whether it is an all-day event. This mirror is deleted and rewritten on every sync, so it never holds anything outside that window.
• Your connection details - the connected Google Account email address, and the access and refresh tokens that keep the connection alive. Refresh tokens are encrypted at rest using AES-256.
• A link table recording which Solar Proof appointment corresponds to which event in your calendar, so updates and cancellations stay in step rather than creating duplicates.

What we write to your calendar

Only appointments you create in Solar Proof. We create, update and cancel those events on the calendar you nominate, carrying their title, description and times. We do not modify or delete events that Solar Proof did not create.

How your Google data is used

Google user data is used solely to provide the calendar features described above, to you and to the colleagues in your own Solar Proof company account with whom you choose to share your availability. We do not sell it, use it for advertising, use it to build user profiles, transfer it to third parties for their own purposes, or allow humans to read it, except where you have explicitly asked us to (for example when you raise a support request), where it is necessary for security purposes such as investigating abuse, or where we are required to by law.

Artificial intelligence and machine learning

Solar Proof uses AI for a small number of clearly separated features, none of which involve your calendar: reading power bills you upload, extracting published network tariffs, checking proposal templates, and summarising battery safety datasheets. Our only AI provider is Anthropic (Claude), called directly over its commercial API - we do not use AI aggregators, gateways or model hubs.

Google user data is never sent to Anthropic or to any other AI or machine learning service, in raw, aggregated, anonymised or derived form, and is never used to create, train, improve or fine-tune any AI or machine learning model, whether ours or a third party's. Calendar data is read from Google, stored as described above, and displayed to you inside Solar Proof. It does not enter any AI request.

Limited Use

Solar Proof's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect and delete your Google data

Open the calendar in Solar Proof and choose Disconnect on the connected account. This immediately and permanently deletes the stored event mirror, the appointment link table, and the stored access and refresh tokens from our systems. You can also revoke Solar Proof's access at any time from your Google Account permissions page. Appointments already copied into your own calendar remain yours and are not removed; you can delete them in Google Calendar if you wish.