Privacy Policy

Version 2026-10-29 · effective 29 October 2026

This Privacy Policy explains how Matheus Mendes, a sole trader, ABN [ABN to be confirmed] (we, us), handles personal information in connection with the Mendes Hub (the Service). We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

1. Two kinds of personal information

  • About our users. Information about the people who use the Service: studio owners and the members they add. We decide how this information is handled.
  • Inside a studio. Information a studio puts into the Service about its own clients, team and contacts (for example, a client's name, email, phone number, address and project details). The studio decides what to store and why, and is responsible to those people for it. We store and process this information only to provide the Service to that studio, as set out in our Terms of Use. If you are a client of a studio and have a question about your information, please contact that studio first. We will help them respond.

2. What we collect about our users

  • Account details: your name, email address and a scrambled (hashed) version of your password. We never store your password in readable form.
  • Studio and business details: studio name, time zone, business name, ABN, business email and, if you add them, the details printed on your invoices (such as account name, BSB, account number or PayID) and your logo.
  • Preferences: language, theme and display settings.
  • Connected services: if you connect your Apple iCloud calendar, your Apple ID and an app-specific password, which we store encrypted.
  • Security and technical information: the IP address and time of sign-ins and failed sign-in attempts, security events (such as account lockouts) and a record of changes made in your studio (who changed what and when).
  • Two-factor details for platform administrators.

We collect this information from you when you sign up, use the Service or contact us, and from the owner of your studio when they add you as a member.

3. Cookies

The Service uses only the cookies it needs to work: one to keep you signed in, one to protect forms from forgery (CSRF) and, where used, one to remember your language. We do not use analytics, advertising or tracking cookies, and we do not use third-party trackers.

4. Why we use it

  • To provide the Service: create and run your account, show your studio's data and carry out the actions you ask for (for example, producing invoices or syncing your calendar).
  • To keep the Service and your data secure, prevent fraud and misuse, and investigate security incidents.
  • To send you messages about the Service, such as password resets, invitations, security alerts and notices about changes to our terms.
  • To give you support when you ask for it.
  • To meet our legal obligations.

We do not sell personal information, we do not use it for advertising, and we do not send marketing emails without your consent. If we ever do send marketing, every message will have a way to unsubscribe.

5. Automated decisions

We do not use personal information to make decisions by computer alone that significantly affect anyone's rights or interests. The Service's automatic features (such as reminders, overdue alerts and calculations) only help you make your own decisions.

6. Who we share it with

We share personal information only with service providers who help us run the Service, and only what they need to do their job:

  • Hosting: the servers where the Service and its data are stored, located in [server location to be confirmed].
  • Network and security: Cloudflare, Inc., which carries traffic to the Service and protects it from attacks. Cloudflare operates a global network, so information passing through it may be processed outside Australia, including in the United States.
  • Email delivery: the provider we use to send the Service's emails (such as password resets and invitations).
  • Apple: if a studio connects its iCloud calendar, session and deadline details are sent to that studio's Apple iCloud account. Apple may store them outside Australia.

We may also disclose personal information if the law requires it, or to protect the safety of a person or the security of the Service. We take reasonable steps to make sure our service providers protect personal information in a way that is consistent with the Australian Privacy Principles.

7. How we protect it

  • All traffic to the Service is encrypted (HTTPS).
  • Each studio's data is kept apart from every other studio's, both in the application and in the database.
  • Passwords are hashed; connected-service passwords are encrypted; sign-in attempts are limited; platform administrators must use two-factor authentication.
  • Location data (GPS) is removed from the photos and image receipts you upload.
  • Backups are encrypted and stored separately from the main server.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

8. How long we keep it

We keep personal information while your account is active and as long as needed for the purposes above. Security records are kept for a limited period. When a studio is closed, its data is deleted as set out in the Terms of Use (normally removed from backups within 90 days), except where we must keep information by law.

9. Access and correction

You can see and update most of your information in the Service (for example, in Settings). You can also ask us for access to, or correction of, the personal information we hold about you by emailing [contact email to be confirmed]. We will respond within 30 days. We may need to confirm your identity first. If we refuse, we will tell you why and how to complain.

10. You can stay anonymous only in limited ways

Because the Service is a business account, we need your real name, email and your studio's ABN to provide it. You can contact us with a general question without identifying yourself.

11. Children

The Service is for businesses and is not intended for anyone under 18.

12. Complaints

If you have a concern about how we handle personal information, please email [contact email to be confirmed]. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, phone 1300 363 992.

13. Changes to this policy

We may update this policy. We will give notice of significant changes as set out in the Terms of Use. The version and date at the top show which version is in force.

14. Contact

Matheus Mendes, ABN [ABN to be confirmed]. Email: [contact email to be confirmed].

Versão em português