Privacy Policy

Account information. Name, email address, phone number and login credentials when you create an account or contact us.

Business data you store in our products. Our products are business-management tools. The businesses that use them store their own operational records with us — for example clients, quotes, jobs, invoices, staff details and related files. That data belongs to the business that entered it; we process it solely to provide the product.

Connected-integration data. You can optionally connect third-party services to your workspace — for example Google (Analytics, Business Profile, Google Ads, YouTube), Meta (Facebook Pages, Instagram, Meta Ads), TikTok for Business, and accounting platforms such as Xero. When you authorise a connection we receive only the data the provider’s consent screen describes — for marketing integrations this is read-only performance metrics (such as impressions, clicks, reach, ad spend, sessions, calls) for the accounts you choose.

Usage and technical data. Standard server logs (IP address, browser type, pages requested) used for security and to keep the service running.

How you found us. When you sign up for Dispatch we keep a short note of what brought you: campaign tags on the link you came through, the name of the website that sent you, the first page of ours you landed on, and your answer to the optional “How did you hear about us?” question. Section 10 says exactly what this is.

We use information only to:

• provide and operate the products you’ve signed up for;
• display your own connected-account data back to you (for example, a marketing attribution dashboard combining your lead records with your advertising metrics);
• provide support and respond to enquiries;
• send service and billing communications;
• if you accept cookies on our website, measure whether our own Facebook and Instagram ads lead to sign-ups (see section 10);
• meet legal obligations and keep the service secure.

We do not sell personal information. We do not share one customer’s data with another. We do not use data obtained through connected integrations for advertising, profiling, or training machine-learning models.

Extrua’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data we access (read-only analytics, business-profile, advertising and YouTube metrics) is used only to provide user-facing features visible to the account owner inside their own workspace. It is never sold, never used for advertising, never transferred except as necessary to provide those features or comply with law, and never used to train AI or machine-learning models.

Data received from Meta’s APIs (Facebook Page, Instagram and ad account metrics) and from TikTok’s APIs is handled the same way: read-only, displayed only to the business that connected the account, never shared across customers, never sold, and deleted when you disconnect the integration or ask us to remove it. See data deletion for how to remove it.

• Stored in Australia. The records you keep in our products — the database, uploaded files and login accounts — are stored in Sydney, Australia (Supabase). The servers that run our products also operate in Sydney (Vercel).
• Data is encrypted at rest by our storage provider, and all traffic is encrypted in transit (HTTPS/TLS).
• Integration access tokens get an extra layer: they are encrypted with AES-256-GCM before they are stored and decrypted only server-side at the moment of use.
• Every customer workspace is isolated by database row-level security — one business can never read another’s records.
• A weekly backup of the database and files is encrypted in Australia before it is copied off-site for disaster recovery (see section 7). The backup provider cannot read it; only we hold the key.

We use a small set of processors to run the service: Supabase (database, file storage and logins), Vercel (application hosting, and counting visits to our website), Stripe (subscription billing — we never see full card details), Resend (email delivery), Twilio (SMS and phone calls), and GitHub (encrypted off-site backups). Where a business connects an integration (Google, Meta, TikTok, Xero), data flows directly between that provider and our servers under the authorisation the business granted.

Advertising measurement. If you accept cookies on our website, Meta Platforms receives the measurement information described in section 10 so we can tell whether our own ads work.

AI assistant providers. Our website assistant, phone assistant and in-app assistants send what you tell them — for example your name, contact details, and the address and details of the work you are asking about — to a large-language-model provider in order to generate a reply. Our main provider is Anthropic, reached directly or through OpenRouter (openrouter.ai); some features use OpenAI. Anthropic and OpenAI do not use this data to train their models, although they may keep it for a short period for safety and abuse monitoring.

Voice call handling. Phone calls are carried by Twilio, which also converts speech to text and text to speech. Our phone assistant runs on infrastructure provided by Render (render.com), which processes call audio and transcripts in order to operate the service. Call transcripts are not written to our application logs.

Your stored records stay in Australia, but some of the providers above are based overseas or process information overseas to deliver their part of the service. Personal information is likely to be disclosed to recipients in these countries:

• United States — AI providers (Anthropic, OpenAI and OpenRouter), Twilio (SMS and phone calls), Render (phone assistant), Stripe (billing), and GitHub (encrypted backups only). Meta Platforms (advertising measurement, only if you accept cookies; it also processes information in Ireland).
• Japan — Resend, which sends our emails from its Tokyo region.

We send each provider only what its feature needs, use providers whose terms commit them to protecting it, and encrypt backups before they leave Australia. Our main providers are US companies, so information they hold, including information stored in Australia, may be subject to US law. Integrations you connect yourself (Google, Meta, TikTok, Xero) store data in their own locations under their own terms.

Business data is retained while the account is active. Disconnecting an integration deletes its stored access tokens immediately. You can ask us to delete integration data, specific records, or an entire account at any time — see /data-deletion — and we action requests within 30 days, except where law requires longer retention (for example, tax records).

You may request access to, correction of, or deletion of your personal information at any time. If you believe we’ve mishandled your information you can complain to us first, and to the Office of the Australian Information Commissioner (OAIC) if unresolved.

Our website (https://www.extrua.com.au) sets one cookie, extrua_consent, which remembers whether you accepted or declined our cookie notice. It holds nothing but that answer and lasts 12 months. It is shared with app.extrua.com.au, where you sign up for Dispatch, so the same answer applies there.

We count visits to the website with Vercel Web Analytics. It doesn’t set cookies or keep anything on your device, and it doesn’t follow you to other sites. It tells us which pages are visited and how people found them. If you decline in the cookie notice, we stop counting your visits.

For each visit we also note how long each page was on your screen, how many pages you looked at, how far you scrolled the first page, whether you clicked to start a trial, see pricing or open the live demo, whether you played a video (not which one or for how long), whether you are on a phone or a computer, any campaign tags in the address you arrived by, and in broad terms how you arrived: from a search engine, a social network, one of our ads, or none of these. We never keep the page you came from. This is anonymous: no cookie, nothing kept on your device, no IP address and nothing that could identify you or link it to a sign-up. It is kept in our own database for 180 days, and if you decline in the cookie notice we don’t record it.

Meta pixel, only if you accept. If you click “Accept” in the cookie notice, our Dispatch pages (www.extrua.com.au/dispatch and the pages under it, and our pages comparing Dispatch with other job apps) load Meta’s pixel. It sets Meta’s cookies (_fbp, and _fbc when you came from a Facebook or Instagram ad) and tells Meta which of those pages you viewed, so we can see whether our ads bring people to Dispatch. It doesn’t run on the rest of the website, and its automatic collection is switched off.

If you then start a Dispatch trial, our sign-up pages on app.extrua.com.au (choosing a plan, and the welcome page after payment) load the same pixel, and our sign-up tells Meta about the sign-up steps (starting checkout, starting the trial, and the trial becoming a paid subscription), with your email address hashed (scrambled so Meta can only match it to an account it already knows), your IP address and browser type, and the plan’s price.

If you decline, or never answer, none of this happens: the pixel doesn’t load and our sign-up sends Meta nothing. Meta handles what it receives under its own terms and data policy; you can also manage ads in your Facebook or Instagram settings.

Whether or not you accept, if you arrive through a link carrying campaign tags (such as utm_campaign), we keep those tags with your Dispatch sign-up so we know which ad or post brought it. They name the campaign, not you.

Also whether or not you accept, a Dispatch sign-up keeps three more things about how you found us: the name of the website that sent you to us, if another site did (its name only, such as www.google.com, never the page you were on or what you searched for); the first page of our website or sign-up page you landed on (the page only, nothing typed into its address after it); and, if you choose to answer it, what you picked for “How did you hear about us?” on the sign-up form, with any few words you add. We also note yes or no for whether you came through a Facebook or Instagram link (not the link’s click id, which is kept only if you accepted). Our website passes these to the sign-up page in the link’s address and stores nothing on your device. They are kept with your sign-up by Stripe, our payment processor, and in our own database, and are used only to see what brings people to Dispatch. We don’t send them to Meta or anyone else.

Our products use only the cookies they need to work: to keep you signed in, to keep your session secure, and to remember settings such as how you like your schedule shown. The one exception is the Meta pixel on the Dispatch sign-up pages described above, and only if you accepted.

You can change your answer at any time with “Cookie settings” at the bottom of every page of our website, or by clearing the cookie in your browser.

Privacy questions, access requests and complaints: hello@extrua.com.au. We’re based in Australia.

We’ll update this page when our practices change and bump the date at the top.