Solar Proof Solutions Pty Ltd (ACN 633 010 821)
Trading as: solarproof.com.au

Last Updated: 3rd November, 2026

Thank you for choosing Solar Proof Solutions Pty Ltd ("Solar Proof," "we," "us," or "our"). We are committed to protecting your privacy and ensuring the security of your personal information.

This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Software-as-a-Service (SaaS) platform and related services (collectively, the "Service"). This Privacy Policy has been drafted to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1.1 Personal Information

We collect personal information that you provide directly to us:

• Account Information: Full name, email address, phone number, business name (if applicable), and ABN (for business customers)
• Billing Information: Payment details, billing address, and GST registration status
• Professional Information: Job title, company role, and professional qualifications (if applicable)
• Communication Records: Customer service interactions, support tickets, and correspondence

1.2 Business and Project Data

Information related to your use of our Service:

• Solar system designs and specifications
• Project documentation and reports
• Client property information and site assessments
• Energy consumption data and analysis
• Compliance documentation

1.3 Automatically Collected Information

• Technical Data: IP address, device information, browser type, operating system
• Usage Data: Log files, access times, pages visited, features used
• Location Data: General location based on IP address
• Cookies and Similar Technologies: Session cookies, persistent cookies, and analytics tools

2.1 Primary Purposes

• Providing and maintaining our Service
• Processing payments and managing subscriptions
• Authenticating user access and maintaining account security
• Providing technical support and customer service
• Generating solar design proposals and compliance documentation

2.2 Secondary Purposes

• Improving and optimizing our Service
• Conducting research and analysis
• Sending service updates and maintenance notifications
• Marketing communications (with your consent)
• Complying with legal obligations

These secondary purposes do not apply to Google user data. Data obtained from Google APIs is used only to provide and improve the calendar features it was granted for, and is never used for research, analysis, marketing, advertising, or to train machine learning or AI models. See section 13.

3.1 Third-Party Service Providers

We may share your information with:

• Cloud hosting and storage providers
• Payment processing services
• Analytics and monitoring services
• Customer support tools
• Professional services (e.g., accountants, lawyers)

3.2 Legal Requirements

We may disclose your information if required by:

• Australian law or legal process
• Court orders or subpoenas
• Regulatory authorities
• Protection of our legal rights or those of others

We implement appropriate technical and organizational measures to protect your personal information, including:

• End-to-end encryption for data transmission
• Secure socket layer (SSL) technology
• Access controls and authentication requirements
• Regular security assessments and penetration testing
• Employee training on data protection
• Secure data centers located in Australia

We retain your personal information for as long as necessary to:

• Provide our Service
• Comply with legal obligations
• Resolve disputes
• Enforce our agreements

When personal information is no longer needed, it is securely destroyed or de-identified.

Under Australian privacy law, you have the right to:

• Access your personal information
• Correct inaccurate or outdated information
• Request deletion of your information (subject to legal requirements)
• Opt-out of marketing communications
• Lodge a complaint about our privacy practices

While our primary data storage is in Australia, some data may be transferred to overseas service providers. We ensure that any international transfers comply with Australian privacy law and that adequate protection is in place.

Our Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will:

• Post the updated policy on our website
• Update the "Last Updated" date
• Notify you of material changes via email or Service notification
• Obtain consent where required by law

For privacy-related inquiries or complaints, please contact:

Privacy Officer
Solar Proof Solutions Pty Ltd
764 Cudgen Rd Kingscliff, NSW, 2487
Email: privacy@solarproof.com.au
Phone: 1300 602 452

Our Service may contain links to external websites or services. This Privacy Policy does not cover these external sites, and we encourage you to review their privacy policies.

If you are using our Service on behalf of a business, additional terms may apply through our Business Terms of Service.

This section governs all Google user data and overrides anything broader elsewhere in this policy. Where sections 1 to 12 describe wider uses of personal information - such as research and analysis, or marketing - those uses do not apply to data obtained from Google APIs. Google user data is used solely to provide and improve the user-facing calendar features described below.

Solar Proof offers an optional calendar integration. If you choose to connect a Google Account, this section explains exactly what Google user data we access, why, how we store it, and how you can remove it. Connecting a calendar is never required to use Solar Proof, and you can disconnect at any time.

What we access, and why

• The list of calendars in your Google Account (scope calendar.calendarlist.readonly) - so you can choose which of your calendars to sync. We read the calendar names and identifiers only.
• Events on the calendars you select (scope calendar.events) - so your existing commitments appear alongside your Solar Proof jobs and you are not double-booked, and so that appointments you create in Solar Proof appear in your own calendar.
• Your Google Account email address (scopes openid and email) - shown in Solar Proof so you can tell which account is connected, and used to keep the connection attached to the right account.

We do not request access to Gmail, Google Drive, Contacts, or any other Google service.

What we store

• A rolling window of your events covering the last 7 days and the next 60 days, for the calendars you selected. For each event we store the event identifier, title, description, start and end times, and whether it is an all-day event. This mirror is deleted and rewritten on every sync, so it never holds anything outside that window.
• Your connection details - the connected Google Account email address, and the access and refresh tokens that keep the connection alive. Refresh tokens are encrypted at rest using AES-256.
• A link table recording which Solar Proof appointment corresponds to which event in your calendar, so updates and cancellations stay in step rather than creating duplicates.

What we write to your calendar

Only appointments you create in Solar Proof. We create, update and cancel those events on the calendar you nominate, carrying their title, description and times. We do not modify or delete events that Solar Proof did not create.

How your Google data is used

Google user data is used solely to provide the calendar features described above, to you and to the colleagues in your own Solar Proof company account with whom you choose to share your availability. We do not sell it, use it for advertising, use it to build user profiles, transfer it to third parties for their own purposes, or allow humans to read it, except where you have explicitly asked us to (for example when you raise a support request), where it is necessary for security purposes such as investigating abuse, or where we are required to by law.

Artificial intelligence and machine learning

Solar Proof uses AI for a small number of clearly separated features, none of which involve your calendar: reading power bills you upload, extracting published network tariffs, checking proposal templates, and summarising battery safety datasheets. Our only AI provider is Anthropic (Claude), called directly over its commercial API - we do not use AI aggregators, gateways or model hubs.

Google user data is never sent to Anthropic or to any other AI or machine learning service, in raw, aggregated, anonymised or derived form, and is never used to create, train, improve or fine-tune any AI or machine learning model, whether ours or a third party's. Calendar data is read from Google, stored as described above, and displayed to you inside Solar Proof. It does not enter any AI request.

Limited Use

Solar Proof's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How to disconnect and delete your Google data

Open the calendar in Solar Proof and choose Disconnect on the connected account. This immediately and permanently deletes the stored event mirror, the appointment link table, and the stored access and refresh tokens from our systems. You can also revoke Solar Proof's access at any time from your Google Account permissions page. Appointments already copied into your own calendar remain yours and are not removed; you can delete them in Google Calendar if you wish.

Solar Proof Capture ("Capture", "the app") is our mobile app for Android and iOS used by installers and sales representatives to photograph solar and battery installations against a shot list, complete on-site checklists and collect customer signatures. The app is published by Solar Proof Solutions Pty Ltd and is only available to people who hold an installer or representative login on a Solar Proof business account. This section explains what the app collects and why. Everything else in this policy also applies.

Who the data belongs to

The app is a tool used on behalf of the solar business that employs or engages you. Photos, checklists and signatures you submit are held in that business's Solar Proof account and are controlled by that business. Solar Proof processes them on the business's behalf.

What the app collects

• Login details. Your Solar Proof username (usually your email address) and password are sent once to obtain an access token. The password is never stored on the device; the token is stored in the device's secure keychain / keystore and is used for all subsequent requests.
• Photos you take or attach. Site photos are stored on the device until they have been uploaded, then transmitted to Solar Proof's private cloud storage and attached to the job they were taken for. The app does not access photos in your library other than those you explicitly choose to attach.
• Precise location (GPS) at the moment a photo is taken. Latitude, longitude and accuracy are recorded with each photo so the business can verify that photos were taken at the job address. Location is read only when you take or attach a photo while the app is open. The app does not track your location in the background and does not request background location permission.
• Capture time and device-generated identifiers for each photo, checklist answer and signature, so that uploads are idempotent and nothing is duplicated or lost when the app syncs after being offline.
• Checklist answers and captions you enter against a job.
• Customer signatures drawn on the device, together with the signer's name as entered, which are attached to the job as an image.
• Job and shot-list data downloaded from your business's account (site address, customer name, assigned shots) so the app works without signal. This is cached on the device and refreshed on sync.
• App settings such as the Wi-Fi-only sync preference and whether to save a copy of each photo to the phone's photo library (off by default). These stay on the device.

The app does not collect contacts, calendar, microphone, call logs, SMS, advertising identifiers or browsing data, and does not contain any advertising, analytics or crash-reporting SDKs.

Permissions the app asks for

• Camera - to photograph the site against the shot list.
• Photos / media - to let you attach an existing site photo to a job, and (only if you turn the setting on) to save a copy of each capture to your photo library.
• Location (while using the app) - to record where each photo was taken.

You can decline any permission; the related feature will be unavailable but the rest of the app will keep working.

How the data is used

Solely to deliver the installation record to the business you work for: displaying photos in that business's Solar Proof installer portal, generating installation documents, and allowing the business to verify that required shots were taken at the right site. We do not use app data for advertising, do not sell it, and do not use it to train AI or machine learning models.

Storage and security

• All traffic between the app and our servers is encrypted in transit (HTTPS/TLS).
• Photos and signatures are stored in a private object-storage bucket. There is no public access; the business's portal retrieves images through authenticated, short-lived signed links.
• Access tokens can only read and write jobs assigned to the account that issued them.
• Data waiting to be uploaded is stored in the app's private storage on the device and is removed from the device once uploaded.

Retention

Installation photos, checklists and signatures form part of the business's compliance record for that job and are retained for as long as the business keeps the job in its Solar Proof account, or as required by law. Cached job data on the device is cleared when you sign out.

Deleting your data

Signing out of the app removes your access token and the cached job data from the device. To have your login removed, or to request deletion of photos or other data you submitted, contact the business that administers your Solar Proof account, or email us at privacy@solarproof.com.au and we will act on the request in consultation with that business, subject to its record-keeping obligations.

Children

The app is a business tool for licensed trades and sales staff and is not directed at anyone under 18.