Privacy Policy

This Privacy Policy explains how ARVOB Command Centre (“ARVOB”, “we”, “us”) collects, uses, stores, and shares information when you use our mobile and web applications (the “Service”). ARVOB is a management platform for construction and trades businesses, used by owners, office staff, and field crews.

1. Information we collect

Account information

When you or your administrator creates an account, we collect your full name, email address, business name, and an encrypted password. Authentication is handled by our backend provider (Supabase Auth).

Location data

When a worker is clocked in, ARVOB records device GPS location — including while the app is in the background — so that the office can see crew location on active jobs. Unless auto clock-on is switched on (below), location collection stops when the worker clocks out. You may revoke location permission at any time in your device settings; doing so will disable on-the-clock location features.

Auto clock-on is off unless your business switches it on. When it is on, and only for a worker who has given location consent, the app also checks that worker’s location while they are not clocked in, so it can clock them on after they have been inside a job site’s area for a few minutes and clock them off after they have been away for a set time. While it is watching for an arrival it keeps only the worker’s latest position, not a record of where they have been. A worker can stop this at any time by withdrawing location consent or by turning off location permission for the app, and then clocks on and off by hand.

Camera and photos

With your permission, ARVOB uses your device camera to capture receipts and time-stamped job photos. These images are uploaded to your organisation’s account and stored in our backend file storage.

Push notifications

If you enable notifications, we store your device push token so we can send you job updates, schedule changes, and other operational alerts related to your work.

Business data you enter

ARVOB stores the business information you create or upload, including clients, contacts, quotes, jobs, schedules, invoices, payments, and other financial records. This data belongs to your organisation.

Calls to and from our business phone numbers may be recorded and transcribed for quality, training and record-keeping. You’ll hear a message at the start of each call. Recordings and transcripts are stored securely, can only be accessed by authorised staff, and are kept for 7 years after your last contact with the business, then destroyed.

Usage and diagnostic data

We collect basic usage and diagnostic information (such as device type, operating system version, app version, crash reports, and feature usage) to maintain reliability and improve the Service.

2. How we use information

• To provide, operate, and maintain the Service.
• To authenticate users and protect accounts.
• To show crew location, job progress, and operational information to your organisation.
• To send notifications you have opted into.
• To generate AI-assisted summaries, briefings, and insights from your business data — only after you have given explicit in-app consent (see “AI features and your data” below), on your behalf and only for users within your organisation.
• To diagnose problems and improve product quality.
• To comply with legal obligations.

3. AI features and your data

Some ARVOB features use artificial intelligence: the AI Briefing, Ask the AI Brain, “Improve with AI” quote writing, and automatic receipt scanning. These features work by sending some of your business data to the AI service providers named below.

Nothing is sent to any AI provider until you have explicitly agreed in the app. The first time you use an AI feature, ARVOB shows you exactly what data would be sent and to whom, and asks for your permission. If you decline, AI features are switched off and no data is shared; the rest of ARVOB works as normal. You can review or withdraw your consent at any time in Settings → AI & privacy, and withdrawal stops all further sharing immediately.

Depending on the feature you use, the data sent is:

• Business snapshots for briefings and questions — job titles, statuses, values and dates; quote numbers, titles, statuses and totals; client and business names.
• Questions you type into Ask the AI Brain.
• Quote text you ask AI to improve.
• Photos of receipts you scan, including the purchase details shown on them.
• Call transcripts from recorded calls, so a short summary of each call can be written for the business owner and the people they choose.

It is received by:

• AI model providers — ARVOB uses the most capable AI models for each task. Requests go to the model provider directly (for example Anthropic) or through OpenRouter, a gateway that connects ARVOB to models from providers such as Anthropic, OpenAI, Google, DeepSeek, Zhipu (GLM) and Moonshot (Kimi). These providers may process data outside Australia, including in the United States and China. ARVOB instructs them to process data only to return the response, and excludes any provider that stores or trains on submitted data.
• Veryfi — reads scanned receipt images to extract the vendor, date, and amounts.
• ARVOB AI — our own AI service, which prepares and routes briefing and chat requests before an AI model processes them.

Data shared with these providers is used only to produce the response you asked for. It is never sold, never used for advertising, and is protected by contractual and technical safeguards equivalent to those that apply to data ARVOB holds directly, including encryption in transit.

4. Service providers and processors

ARVOB relies on a small number of trusted infrastructure providers that process data on our behalf:

• Supabase — database, authentication, and file storage.
• Vercel — application hosting and content delivery.
• AI model providers (directly and via OpenRouter), Veryfi, and ARVOB AI — AI processing, only with your explicit in-app consent, as described in section 3.
• Stripe — subscription billing and deposit payments.
• Telnyx, Twilio and Resend — phone calls, SMS and email delivery for messages your organisation sends and receives, including call recording and transcription where enabled.
• Basiq and Intuit (QuickBooks Online) — bank feed and accounting integrations, only if your organisation connects them.
• Google (Firebase Cloud Messaging) — delivery of push notifications you have opted into.

These providers may store data in regions outside your country. We choose providers that offer appropriate security and contractual protections.

5. Sharing

We do not sell personal data. We do not share your data with third parties for advertising. We share information only:

• Within your organisation, according to the roles your administrator has set.
• With the processors listed above, strictly to operate the Service.
• When required by law, valid legal process, or to protect rights and safety.

6. Data retention

ARVOB keeps business records (quotes, jobs, invoices, payments, messages, emails, documents and call records) permanently. Nothing is deleted from inside the app — not even by the account owner. Removing an item from view archives it: it is kept, and the change is recorded with who made it, when, and from which internet address. Personal details in those records (such as names, phone numbers, email and street addresses) are kept for 7 years after your last activity with the business, then removed, while the business record itself is kept.

When someone’s access is granted, changed or removed — by anyone, including the account owner — ARVOB records who made the change, when, and the internet address and device it was made from. Only the account owner can see this record.

7. Your rights

You can access, correct and export the personal data we hold about you, and delete your login at any time from Settings. Deleting your login does not delete the business’s records. Your personal details in them are removed 7 years after your last activity with the business.

8. Security

ARVOB uses industry-standard encryption in transit (HTTPS/TLS) and at rest. Access to production systems is restricted, audited, and protected by multi-factor authentication. No system is perfectly secure; you are responsible for keeping your account credentials safe.

9. Children

ARVOB is a business product and is not directed to children under 16. We do not knowingly collect personal information from children.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. The “Last updated” date at the top of this page reflects the most recent version.

11. Contact

For privacy questions or to exercise your rights, contact us at privacy@arvob.com.