How we handle personal information contained in the business data you connect. Last updated 9 October 2026.
Your ServiceM8, Xero and mailbox records contain personal information about other people — your customers' names, addresses, phone numbers and email addresses, and your staff's names and job activity. When we read that data to build your dashboard, you are the business that decides what happens to it and we are simply acting on your instructions. This Addendum is the written commitment that governs that arrangement. It forms part of our Terms of Service and applies automatically from the moment you connect a system — there is nothing to sign.
Under the Privacy Act 1988 (Cth) both of us are responsible for the personal information we handle. This document divides that up so neither of us has to guess.
You appoint us to handle Customer Personal Information for one purpose: to provide, support, secure and improve the Service for you. That purpose, together with the Terms of Service, our Privacy Policy and any configuration you set in the product, is your complete set of instructions to us.
We will not handle Customer Personal Information for any other purpose. Specifically, we will not sell it, will not use it for advertising, will not use it to market to your customers, and will not pool it with other businesses' data to build benchmarks, industry statistics or AI training sets without asking you first and getting a yes. If we ever want to do something with the data that is not on this list, we will come and ask.
If we believe an instruction from you would breach Privacy Law, we will tell you rather than quietly carry it out.
You confirm that: you have the right to connect the systems you connect and to have the data in them handled as described; you have given your customers and staff whatever privacy notice Privacy Law requires of you; and the data you give us access to was collected lawfully. You are responsible for who you invite into your account and what permissions you give them. Handling requests from your own customers about their information is your obligation as the controller — we will help you meet it (clause 9).
We maintain technical and organisational measures appropriate to the risk, described in Annexure B and in more detail on our security page. We review them as the product and the threat landscape change, and we will not reduce the overall level of protection during your subscription.
Our support staff cannot open your dashboard at will. A request naming the person and the reason goes to your account owner, and nothing happens without approval. An approved session is read-only, expires within 24 hours, can be revoked instantly, and every request, approval, refusal and expiry is recorded in your own Settings page. Declining never affects your service.
You give us general authorisation to engage subprocessors to provide the Service. In exchange:
If we receive a request directly from one of your customers or staff to access, correct or delete their information, we will not action it ourselves. We will pass it to you promptly and let the individual know that the business they dealt with holds the record. If you ask us to access, export, correct or delete specific Customer Personal Information in order to answer a request, we will do it without undue delay and at no charge for reasonable volumes.
If we become aware of an actual or suspected Eligible Data Breach affecting Customer Personal Information, we will notify your account owner without undue delay and in any case within 48 hours of becoming aware. Our notice will tell you, so far as we know it: what happened and when; the categories and approximate number of individuals and records involved; the likely consequences; what we have done to contain it; and what we recommend you do. We will keep you updated as we learn more, help you assess whether the breach is notifiable, and support any notification you must make to affected individuals or the OAIC. We will not make a public statement identifying you without consulting you first, unless the law requires it. We keep records of incidents and make them reasonably available to you.
Our platform and database infrastructure is currently located in the United States, so Customer Personal Information is disclosed overseas. You instruct and authorise that disclosure by using the Service. Before engaging an overseas provider we take the reasonable steps APP 8 requires: contractual obligations to handle personal information consistently with the Australian Privacy Principles, encryption in transit and at rest, and a prohibition on the provider using the data for its own purposes. The processing location of each provider is stated on our subprocessor page. If an Australian region becomes available for our stack we intend to move to it and will tell you when we do.
On reasonable written request, and no more than once a year unless we have notified you of a breach, we will give you the information you reasonably need to confirm we are meeting this Addendum — our security documentation, subprocessor details, and answers to a security questionnaire. Where that is not enough to satisfy a specific, legitimate concern, we will cooperate with an audit conducted on reasonable notice, during business hours, in a way that does not disrupt other customers or expose their data, at your cost. If we have notified you of an Eligible Data Breach, you may audit without waiting for the annual window.
Disconnecting an integration stops the sync immediately. On request during your subscription we will export your data to you in a machine-readable format. When your account closes we delete synced business data within 90 days, other than records we are required to keep for legal, tax or accounting purposes, or copies held in encrypted backups which age out on their normal rotation and are not used for any other purpose. We will confirm deletion in writing if you ask.
This Addendum is built for Australian law, because our customers are Australian trade businesses. If you are handling personal data subject to the EU or UK GDPR — for example because you operate there — tell us before you connect it. We will put the appropriate transfer mechanism in place, including the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum, and those clauses will prevail over this Addendum to the extent of any inconsistency for that data.
The liability provisions in the Terms of Service, including the caps and exclusions, apply to this Addendum. This Addendum starts when you first connect a system and continues while we hold Customer Personal Information, even after your subscription ends. A breach of this Addendum is a material breach of the Terms of Service. Where this Addendum conflicts with the Terms of Service on a data protection matter, this Addendum prevails.
| Item | Detail |
|---|---|
| Subject matter | Provision of a read-only reporting and analytics dashboard over your connected business systems. |
| Duration | The term of your subscription, plus the deletion period in clause 13. |
| Nature and purpose | Reading, storing, structuring, aggregating and displaying business records; generating reports, worklists and alerts; supporting and securing the Service. |
| Categories of individuals | Your customers and site contacts; your staff, technicians, subcontractors and office users; callers to your business numbers. |
| Categories of personal information | Names; business and site addresses; phone numbers and email addresses; job, quote and invoice records associated with a person; payment status (not card numbers); staff names, job activity, timestamps and productivity data; inbound and outbound call records and durations. |
| Sensitive information | We do not require and do not intentionally collect sensitive information as defined in the Privacy Act. Do not enter it into free-text fields you sync to us. |
| Historical scope | Up to two years of history is pulled at first connection, then kept current. |
| Frequency | Continuous or scheduled synchronisation while the connection is active. |
Data protection questions, requests and breach notices: [email protected]
SOLE ENTERPRISE PTY LTD (ACN 703 066 782), trading as Dashboard Solutions. Queensland, Australia.
We're finishing the build with our first operators. Leave your email and we'll notify you the day trials open — plus 50% off your first three months when you subscribe during your 14-day free trial.
One email at launch. No newsletter, no sales calls.
One tap, completely anonymous. It genuinely shapes what we fix next.
We don't collect your name, email or IP address here.