RECOTOWN PRIVACY POLICY

1.1 Statutory Compliance: Triveni Norwest Pty Ltd t/a RecoTown ("the Company", "we", "us", "our") is committed to safeguarding user privacy. We manage all personal information in strict compliance with the Privacy Act 1988 (Cth), the 13 Australian Privacy Principles (APPs), and international best practices for mobile application data safety.

1.2 Policy Scope: This Privacy Policy applies to your download, installation, account creation, and use of the RecoTown mobile application ("the App") and our website at recotown.com.au. It details what data we collect, how we process and store it, with whom it is shared, and how you can exercise your data rights.

We collect personal information through direct user input, authorized device permissions, and automated technical diagnostics:

2.1 User-Provided Account Data:

• Mobile Phone Number: Collected during initial onboarding and verified via SMS One-Time Password (OTP) to establish authentic network identity.
• Profile Details: Full legal name, optional profile photograph, and designated suburb or city.
• Single Sign-On (SSO) Data: If you authenticate using Apple ID, Google SSO, or Facebook Login, we collect your verified name, email address, and platform-supplied authentication tokens.

2.2 Crowdsourced Network Contributions:

• Service Provider Records: Business names, commercial contact numbers, website URLs, and category tags selected from our pre-defined lists.
• Ratings & Reviews: 1-to-5 star ratings and written comments reflecting your genuine experiences.
• Favourites List: Personal lists of tradespersons or services saved within your account.

2.3 Address Book Access & On-Device Cryptographic Hashing:

• Network Discovery Scope: To map 1st-degree (direct friends) and 2nd-degree (friends of friends) recommendations, the App requests permission to access your mobile device's address book.
• Cryptographic Safeguard (SHA-256): Contact phone numbers are converted into non-reversible cryptographic hashes (SHA-256) directly on your mobile device before transmission to our backend servers.
• Raw Contact Non-Retention: We DO NOT permanently store your contacts' raw, unhashed address book details, personal notes, physical postal addresses, or email addresses.
• System Settings Controls: You can revoke address book access at any time through your mobile device's system settings.

2.4 Automatically Collected Technical Telemetry:

• Device Identifiers: Mobile hardware model, operating system version, unique device tokens, and IP address.
• Diagnostic & Performance Logs: Latency metrics, crash reporting, and usage logs monitored to optimize edge execution and protect battery performance.

RecoTown operates as a closed-loop network. Your data is scoped according to explicit relationship tiers:

We process personal information strictly for the following operational purposes:

4.1 Network Graph Generation: Cross-referencing hashed phone identifiers to display trusted 1st and 2nd-degree recommendations without exposing raw address books.

4.2 Authentication & Security: Validating identity via SMS OTP or Social SSO tokens and preventing unauthorized account access.

4.3 Anti-Spam & Fraud Prevention: Monitoring IP addresses and device activity to detect bot networks, commercial lead-scraping, and astroturfing (fake self-promotional reviews).

4.4 Infrastructure Performance: Monitoring application health across Cloudflare Edge and Neon Serverless Postgres systems to ensure rapid search filtering and low latency.

4.5 Off-Platform Interaction Disclaimer: When you click to call or contact a recommended tradesperson, that communication occurs externally via your standard mobile carrier or third-party channels. RecoTown does not monitor, record, or retain off-platform conversations.

4.6 Mandatory Legal Compliance: Disclosing personal data only when strictly required by a valid subpoena, court order, or lawful police investigation under Australian law.

5.1 Serverless Cloud Infrastructure: To ensure high availability, fast response times, and cost efficiency, RecoTown utilizes serverless global edge architecture (Cloudflare Global Edge) and distributed database clusters (Neon Serverless Postgres).

5.2 Cross-Border Transfer Consent: Personal data collected through the App may be routed, processed, and cached on secure servers located outside of Australia, including nodes in the United States and global edge locations. By creating an account and using the App, you explicitly consent to this cross-border data transfer in accordance with Australian Privacy Principle 8 (APP 8). We contractually require our cloud providers to maintain enterprise-grade encryption and security standards.

6.1 Mobile Session Storage: The mobile app uses encrypted local storage on your device (such as iOS Keychain or Android Encrypted SharedPreferences) to manage secure authentication tokens so you stay logged in securely.

6.2 Web Landing Page Cookies: Visitors to recotown.com.au may encounter essential technical cookies used for site navigation and basic analytics. We do not sell your personal data or track your activity across third-party apps for advertising purposes.

In accordance with Australian privacy legislation (APPs 12 & 13) and Apple/Google app platform mandates, you maintain complete control over your personal data:

7.1 Review and Correction: You can view and update your profile details (Name, Photo, Suburb) directly within the App's Settings menu (APP 13).

7.2 Data Access & Export Requests (APP 12): You maintain the right under Australian Privacy Principle 12 to request a complete export of the personal information stored in your account. You may submit a data access request by emailing info@recotown.com.au. We will fulfill verified data export requests within 30 days.

7.3 In-App Account Erasure: You may trigger account deletion at any time directly within the App: Profile Settings -> Account -> Delete Account.

7.4 Deletion Outcomes:

• (a)Personal Metadata: Upon account erasure, your name, verified phone number, email address, and contact-matching links are permanently deleted or anonymized across our live production systems.
• (b)Anonymized Recommendations: To prevent broken network graphs and maintain database integrity for other users, service cards and star ratings you published will remain archived in an anonymized format (completely disassociated from your personal identity).

We employ rigorous administrative, physical, and technical safeguards:

• In-Transit & At-Rest Encryption: All communications between your device and our cloud servers are encrypted using TLS 1.3 protocols, and databases are encrypted at rest (AES-256).
• Administrative Access Limits: Backend system access is restricted to authorized engineering personnel and protected by mandatory multi-factor authentication (MFA).

If you have questions, concerns, or wish to submit a privacy complaint regarding how your data has been handled, please contact our Privacy Officer:

We acknowledge all complaints within 5 business days and aim to provide a formal resolution within 30 days. If you are unsatisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.