Privacy Policy

Last updated: 7 May 2026

1. Who we are

ClientOS is operated by JVANET PTY LTD (“we”, “us”), a company registered in Australia. We comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). For privacy questions, contact privacy@jvanet.com.

2. What we collect

When you sign up and use ClientOS, we collect:

  • Account data: email address, name, workspace name, password hash (we never see your plain-text password — authentication is handled by Supabase Auth).
  • Workspace data: boards, columns, items, files, and any content you create. This data belongs to you.
  • Billing data: subscription status and payment-method tokens. We do not store credit-card numbers — that’s handled directly by Stripe.
  • Operational logs: IP address, request paths, error traces. Retained for up to 30 days for debugging and security monitoring.

3. How we use it

  • To provide the ClientOS service to you and your team.
  • To send transactional email (account verification, password resets, billing notifications, board status changes you have explicitly subscribed to). We do not send marketing email without explicit opt-in.
  • To process payments via Stripe.
  • To investigate abuse, fraud, or security incidents on our platform.
  • To meet legal obligations.

4. Subprocessors

We share data only with the following third-party processors, each bound by their own data-processing agreement:

  • Supabase — database hosting, authentication, file storage. Data is stored in their AWS-backed infrastructure.
  • Vercel — application hosting and edge delivery.
  • Stripe — payment processing. PCI-DSS Level 1 certified.
  • Resend — transactional email delivery.
  • Xero / MYOB — accounting integration, only if you connect your account.

5. Your rights

You can access, correct, export, or delete your data at any time from your account settings, or by emailing privacy@jvanet.com. Data is deleted within 30 days of account closure (longer if required by law).

Under Australian and EU/UK data law, you can also lodge a complaint with your local privacy regulator (in Australia, the OAIC).

6. Cookies

We use only essential cookies — a session cookie for authenticated access, and a CSRF protection token. We do not use third-party advertising or analytics trackers.

7. Changes

We’ll update this page when our practices change. Material changes will be notified by email at least 14 days before they take effect.