Adminroo
The short version
- Your business data is stored with Cloudflare in its Oceania region, encrypted at rest, with backups kept for 30 days.
- You own your data. Ask and we send you an export; delete your account and it is gone at once.
- No ads, no tracking, and we never sell personal information.
- These outside services touch your data: Cloudflare (hosting), Resend (email we send you), Apple (if you sign in with Apple), Anthropic (only when someone in your business uses AI help) and Meta (only if your business connects its Facebook Page). Nobody else.
Who we are
Adminroo is job management software for trade businesses, made and run in South Australia by one operator (“Adminroo”, “we”, “us”). This policy explains how we handle personal information in the Adminroo office web app, the Adminroo iPhone app and this website, in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. It describes what the service does today, not what it might do later; when we add a service provider or a feature that touches personal information, this page changes first.
Our customers are trade businesses (“you”). You put information about your own customers, staff and subcontractors into Adminroo. For that information you are in control, and we handle it on your behalf.
What we collect
About you and your business
- Your name, email and a salted password hash (never the password), or your Apple account identifier if you sign in with Apple.
- Your business details: name, ABN, GST registration, phone, email, address, trade, and the bank details (BSB and account number) you want printed on invoices.
- Your team members' names, emails and roles and, if you use timesheets, their hours.
What you put in Adminroo
- Your customers' names, contact details and site addresses.
- Enquiries sent through your public enquiry form (the enquirer's name, phone, email, job address and description).
- Quotes, jobs, notes, photos, forms, certificates, invoices and payment records, and a customer's typed name and drawn signature when they accept a quote.
From the apps
- Neither app uses your location, and neither contains advertising or analytics SDKs.
- Basic technical records to keep the service running: sign-in sessions, the connection address for rate limiting while a request is handled, and the time and error code of failures.
How we use it
- To run Adminroo for you: store your jobs, send your quotes and invoices by email, and show them to your customers through the links you send.
- To send you account email: sign-in codes and password resets.
- To give you support, when you ask for it.
- For AI help, when someone in your business asks for it (see below).
Adminroo has no card payments, SMS or accounting sync yet; when those arrive they will be listed under service providers below before they are switched on. We never sell personal information and we don't use your customers' details to market to them.
Where it is stored
Adminroo runs on Cloudflare, a US company, on its Workers platform. Your business data is stored in Cloudflare's database and file storage, encrypted at rest, in its Oceania region. No other hosting company holds a copy. Connections are encrypted and pass through Cloudflare's network, which may route them through its servers in Australia or other countries.
Backups stay with Cloudflare in the same region: 30 days of point-in-time history of the database, plus a copy of the database saved each night to Cloudflare's R2 storage and kept for 30 days. They are used only to restore data after a fault.
Service providers
| Provider | What for | What they receive |
|---|---|---|
| Cloudflare, United States (data stored in its Oceania region) | Hosting: runs Adminroo and stores its database, files and backups | Everything stored in Adminroo, encrypted at rest |
| Resend | Account email (sign-in codes, resets) and sending quotes and invoices | The recipient's email address and the email, including the document link |
| Apple | Sign in with Apple, if you choose it | Apple handles the sign-in; we receive an account identifier and, if you share it, your name and email |
| Anthropic (Claude), United States | AI help: suggesting quote lines, tidying job notes, drafting replies to enquiries, turning a spoken job update into notes, and reading supplier bills | Only what that task needs. See AI help |
| Meta (Facebook), if your business connects its Facebook Page | Bringing your lead ad leads and Messenger messages into Adminroo, and sending your Messenger replies | Your replies on Messenger. Adminroo receives the leads and messages Meta already holds. See Facebook |
That is the whole list. There is no payments partner, SMS gateway or accounting integration yet.
A business can connect its Facebook Page. Adminroo then receives the leads from the business's Facebook and Instagram lead ads (what the person typed into the form, and which ad and form it was) and the messages people send the Page on Messenger (with their name on Facebook), and keeps them as enquiries for that business. Replies the business writes in Adminroo go back through Meta. Adminroo keeps the Page's access token encrypted, never posts on the Page, and stops receiving anything the moment the business disconnects or removes Adminroo in its Facebook settings. If you ask Facebook to delete the data Adminroo has from your Facebook account, the connection is deleted; enquiries already made stay with the business, as its own records of its customers. To have those removed too, contact the business or support@useglovebox.app.
AI help
Adminroo's AI help uses Anthropic's Claude through Anthropic's commercial API, so this information is sent to Anthropic in the United States. It is sent only when someone in your business uses an AI feature, and nothing the AI suggests is saved until that person accepts it. Under its commercial terms Anthropic does not train its models on what Adminroo sends. Each business has a monthly limit on AI use.
- Always: your business's name, trade, phone, email, whether you charge GST and your labour rate.
- Suggesting a quote: the job's title, description and notes (or what you typed), the site's access notes and up to 150 price list items (name, unit and sell price only).
- Tidying notes: the text you typed and the job's title.
- A spoken job update: what was said, the job's title and checklist, and price list item names.
- Drafting a reply: the enquiry's description, how it came in and the enquirer's first name.
- Reading a supplier bill: the bill itself.
It never receives your buy prices or markups, bank details, ABN, your customers' contact details or addresses, or another customer's records.
Your rights
You can ask to see or correct the personal information we hold about you, and to have it deleted. Account owners can delete their business and account from Settings; deletion is immediate. The owner can download all of the business's data, every record and file, from Settings at any time; if it is too big for one download, email us from the owner's address and we send it within a few days. If your customer asks you for their information, you can find it in their customer record and you can delete it there.
How long we keep it
While your account is active, we keep your data. When you close your business or delete your account, its records, files and team memberships are deleted from the live system at once, and the last copy ages out of the backups within 30 days. Enquiries sent through your public form stay in your account until you delete them. Our own records of what you paid us, if anything, are kept for seven years as tax law requires.
Security
Data is encrypted in transit (HTTPS everywhere) and at rest, backups included. Access to the hosting account is limited to the operator, and no per-request access log is kept. Passwords are hashed. Team roles limit what each member can read: field staff never see invoices, bank details or buy prices. The operator opens customer records only to support you or to keep the service running. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
This website
This website sets no cookies, runs no scripts and loads nothing from other sites. Our web server keeps no access logs for it. Cloudflare, which sits in front of it, keeps its own aggregate statistics.
Changes and contact
We'll update this page when our practices change, and email account owners about significant changes. Questions or complaints: support@useglovebox.app. If you're not happy with our answer, you can contact the OAIC.