Back to home

Privacy Policy

Effective date: 24 October 2026 · Kilkelly Enterprises (ABN 82 862 013 361)

1. Who We Are

Clearway Apps is a trading name of Kilkelly Enterprises (ABN 82 862 013 361), based in Perth, Western Australia, Australia. We operate web-based software applications (Flatmate Flow and Tradley) and provide website design, build, AI visibility, and retainer services to clients. References to "we", "us", or "our" in this policy refer to Kilkelly Enterprises.

This policy explains how we collect, use, store, and share your personal information when you use our apps, submit an enquiry, or engage us for a website build or retainer, and the rights you have over that information. It applies to users and clients worldwide.

For any privacy-related enquiry, contact: admin@clearwayapps.com.au.

2. What Information We Collect

We collect the following categories of information:

  • Account information (apps): Your name, email address, and password (hashed) when you register for an app, or your profile data when you sign in via a third-party provider such as Google OAuth.
  • Content you create (apps): Household data in Flatmate Flow (bills, chores, expenses, shopping lists, calendar events, polls, notices), job and business data in Tradley (jobs, quotes, invoices, leads, messages, job photos, crew members, and the customer and property records you enter about your own clients), notes, and other data you input into our apps. This data is stored securely and linked to your account or household.
  • Enquiry and intake form data: When you submit the "Start a Project" form at /start, the "Request a Call" form at /request-a-call, or contact us about a website build or retainer, we collect the fields you provide: your name, business name, business type, whether you have an existing website, what you need, what you want the project to do, whether you have brand assets, your preferred timeline, budget preference, optional phone number, and email. These submissions are emailed to us using Resend (see Section 6).
  • AI Visibility Check data (past requests): The free AI Visibility Check is no longer offered. When it was, we collected your name, business name, main service, suburb or area, email address, and optionally your website and phone number. We also recorded your IP address with the request, to enforce the daily usage limits that stop the tool being abused. Your business name, service and suburb were sent to OpenAI as part of the query we ran on your behalf, and the result plus your details are stored in our Supabase database so we can send your report and follow up (see Sections 5 and 6).
  • Retainer client records: For active retainer clients, we hold the business information and project materials needed to deliver the service, contact details, invoices and payment receipts, brand and content materials you supply, access credentials to platforms or integrations you ask us to configure on your behalf, and correspondence about the project.
  • Usage data: Information about how you use our services, including pages visited, features used, actions taken, device type, browser, operating system, approximate location derived from IP address, and access timestamps.
  • Payment information: No app subscription is on sale at the time of writing: Flatmate Flow is free to use and Tradley is free during its closed beta. Tradley does not process card payments: it records a payment you have taken on your own terminal, or issues a pay link on a public quote page, so we never receive or store your customer’s card details. If we offer a paid app plan in future, payment will be processed by Stripe. For website build and retainer clients, we issue invoices payable by bank transfer or Stripe. We do not see or store your full card details, Stripe handles card data under its own privacy policy. We receive limited metadata (such as the last four digits of your card, billing country, and subscription status).
  • Tradley waitlist: When you ask for access to the Tradley closed beta, we collect your email address, and optionally your name, trade and region. It is used to contact you about beta access and nothing else.
  • On-device app data: Tradley works offline, so a copy of your job data is held in your device’s own browser storage and synced back when you reconnect. Clearing your browser data or signing out removes that local copy.
  • Communications: If you contact us by email or through in-app forms, we retain that correspondence and any information you include in it.
  • Cookies and local storage: Session tokens, authentication cookies, and minimal local-storage data needed to keep you signed in and deliver the service.

We do not knowingly collect sensitive categories of personal information (such as health, biometric, or racial/ethnic data). Please do not submit such information through our forms or into our apps.

3. How We Use Your Information

We use your information to:

  • Provide, operate, maintain, and improve our services;
  • Associate your content with your account or household and keep it accessible to you;
  • Scope, quote, and deliver website builds and retainer services you request;
  • Follow up on enquiries submitted through the /start form, typically by email or, if you supplied it, by phone, to discuss feasibility, cost, and timeline;
  • Process payments and manage your subscription or retainer invoices;
  • Respond to support requests and enquiries;
  • Send essential service communications (billing, security, changes to terms);
  • Detect, prevent, and respond to fraud, abuse, and security incidents;
  • Comply with our legal obligations and enforce our Terms of Service.

We do not sell your personal information to anyone. We do not use your content to train AI models. We do not share your personal information with third parties for their own marketing purposes.

4. Legal Bases for Processing (GDPR / UK GDPR)

For users in the European Economic Area (EEA), the United Kingdom, and Switzerland, our legal bases under the EU General Data Protection Regulation (GDPR) and UK GDPR are:

  • Contract performance, processing necessary to provide the services you have signed up for;
  • Legitimate interests, improving our services, preventing fraud, ensuring security, and understanding how our apps are used (balanced against your rights);
  • Legal obligation, where we are required to process data to comply with applicable law;
  • Consent, where you have given explicit consent, such as for optional marketing communications. You may withdraw consent at any time.

5. Data Storage, Security, and Retention

Your data is stored on the infrastructure of our trusted cloud provider Supabase (database, authentication, and storage for Flatmate Flow), which maintains industry-standard security controls including encryption in transit (TLS) and at rest.

We take reasonable technical and organisational measures to protect your personal information from unauthorised access, disclosure, alteration, or loss, including access controls, row-level security, least-privilege permissions, and regular review of our providers' security posture. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Retention, app users: We retain your data for as long as your account is active, or as needed to provide our services and comply with legal, accounting, or reporting obligations. When you delete your account, your personal data and content are deleted within 30 days, except for data we are legally required to retain (such as transaction records, which we retain for 7 years under Australian tax law). Backups containing residual data are purged on their regular rotation cycle (typically within 90 days).

Retention, AI Visibility Checks: Details you submit for a free AI Visibility Check, together with the result and the IP address recorded with the request, are retained for up to 12 months so we can follow up and so the abuse limits work, then deleted. The cached result of a given business, service and suburb query is held for 7 days so a repeat request does not re-run the check. You can ask us to delete your check at any time by emailing admin@clearwayapps.com.au.

Retention, enquiries and retainer clients: Information submitted through the /start intake form is retained while we are actively corresponding with you about a project. If a project does not proceed, we retain the enquiry for up to 12 months so we can follow up if you come back, then delete it. For active retainer clients, we hold your business information and project materials for the life of the retainer plus a further 12 months after termination to cover handover, follow-up questions, and any final reconciliation, after which we delete the records, except for invoices and tax records retained for 7 years under Australian law. You can request earlier deletion at any time by emailing admin@clearwayapps.com.au; we will delete everything that is not subject to a legal retention requirement.

Breach notification: If we become aware of a data breach that is likely to result in serious harm, we will notify affected users and the Office of the Australian Information Commissioner (OAIC) as required by the Privacy Act 1988 (Cth), and any other supervisory authorities required by applicable law (including supervisory authorities under the GDPR) within the applicable legal timeframes.

6. Third-Party Services (Sub-processors)

We use the following third-party services, which may process limited personal data on our behalf:

  • Supabase, Inc., database, authentication, and storage. This includes AI Visibility Check submissions and their results (processing may occur in the United States and Europe).
  • Vercel, Inc., web hosting and content delivery for this site and for client websites we build and host.
  • Resend, transactional email. Intake form submissions, AI Visibility Check reports, and our own lead notifications are delivered through Resend.
  • Cloudflare, Inc., DNS, CDN, and security. Cloudflare Turnstile also runs the "verify you are human" check on our forms, which processes limited browser and network signals to tell people from bots.
  • Google LLC, optional third-party sign-in (Google OAuth), and Google Analytics 4 plus Google Tag Manager for website analytics.
  • Microsoft Corporation, Microsoft Clarity for anonymised session replay and heatmaps on this website.
  • Meta Platforms, Inc., the Meta (Facebook) Pixel for advertising measurement and audience building on this website. See Section 7.
  • Stripe, Inc., payment processing for client invoices, and for any paid app subscription we may offer in future.
  • OpenAI, L.L.C., AI model provider. Used to run the free AI Visibility Check, which sends your business name, main service and suburb as part of the query. Inputs submitted to these models may be processed by these providers under their own terms (we use API tiers that contractually prohibit use of inputs for model training).

We do not authorise these providers to use your personal information for their own purposes. Each provider is bound by its own privacy policy, which we encourage you to review.

7. Cookies and Tracking

Our apps use cookies and similar technologies (including local storage) for essential purposes, session management, authentication, and remembering your preferences.

This website also uses analytics and advertising cookies. Specifically:

  • Google Analytics 4, loaded through Google Tag Manager, to measure pages visited and events such as form submissions.
  • Microsoft Clarity, which records anonymised session replays and heatmaps of how visitors move through the site, so we can see where pages confuse people.
  • Meta (Facebook) Pixel, which is an advertising cookie. It records when you visit the site and when you submit a lead form, and it allows Meta to attribute those actions to our ads and to build advertising audiences. This does involve tracking across websites that also run Meta's pixel. When you submit a form, a scrambled (hashed) copy of your email address, phone number and name is also sent to Meta, so Meta can match the enquiry to an ad you saw. Meta receives the hash, not the details as you typed them. Meta may also receive these events through its own server-side connection to the pixel.

You can control cookies through your browser settings, though disabling essential cookies may prevent parts of our services from working. To opt out of the advertising cookie specifically, use your browser's tracking protection, an ad blocker, or your Meta ad preferences. Analytics can be blocked the same way, and nothing on this site is withheld from you if you do.

8. International Data Transfers

Because our service providers operate globally, your personal information may be transferred to, stored in, or processed in countries outside your own, including the United States, the European Economic Area, and other jurisdictions. These countries may have data-protection laws different from your own.

Where we transfer personal data out of the EEA, United Kingdom, or Switzerland, we rely on lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum, along with supplementary measures where necessary. By using our services, you acknowledge and consent to such cross-border transfers where permitted by your local law.

9. Your Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

  • Access, request a copy of the personal data we hold about you;
  • Correction, request correction of inaccurate or incomplete data;
  • Deletion / erasure, request deletion of your personal data ("right to be forgotten"). You can also delete your account and all associated data directly from within the app settings;
  • Portability, request your data in a structured, machine-readable format;
  • Objection / restriction, object to or request restriction of certain processing activities, including profiling;
  • Withdraw consent, where processing is based on consent, you may withdraw it at any time;
  • Complain, lodge a complaint with your local supervisory authority (see Section 10).

California residents (CCPA / CPRA): You have the right to know what personal information is collected, sold, or shared; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the sale or sharing of personal information; the right to limit the use of sensitive personal information; and the right to be free from retaliation for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

Other US state residents (including Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws) have similar rights to access, correct, delete, and port their personal information, and to opt out of targeted advertising and profiling. We honour these rights regardless of state.

Canadian residents (PIPEDA / Quebec Law 25): You have rights to access and correct your personal information and to withdraw consent to its processing, subject to legal or contractual restrictions.

Brazilian residents (LGPD): You have rights of confirmation, access, correction, anonymisation, portability, deletion, and information about sharing, as set out in the Brazilian General Data Protection Law.

New Zealand residents are protected by the Privacy Act 2020 and have equivalent access and correction rights.

To exercise any of these rights, contact us at admin@clearwayapps.com.au. We will respond within the timeframe required by applicable law (generally 30 days, extendable where permitted). We will not discriminate against you for exercising a privacy right.

10. Supervisory Authorities and Complaints

If you believe we have mishandled your personal information, please contact us first so we can try to resolve your concern. You may also lodge a complaint with:

  • Australia, Office of the Australian Information Commissioner (OAIC): oaic.gov.au;
  • EEA, the data protection authority in your country of residence, work, or where the alleged infringement took place;
  • United Kingdom, Information Commissioner's Office (ICO): ico.org.uk;
  • United States (California), California Privacy Protection Agency (CPPA).

11. Children's Privacy

Our services are intended for users aged 18 and over. We do not knowingly collect personal information from children under 16 (or the equivalent minimum age of digital consent in your jurisdiction). If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Automated Decision-Making and AI Outputs

The free AI Visibility Check generates its report using a large-language-model provider. That output is produced automatically from your inputs but is not used to make automated decisions that produce legal or similarly significant effects about you. AI outputs are informational and should not be relied upon as professional advice, see our Terms of Service.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy here with a new effective date and, where practicable, by email or in-app notice. Continued use of our services after changes take effect constitutes your acceptance of the updated policy.

14. Governing Law

This Privacy Policy is governed by the laws of Western Australia, Australia, and applicable Australian federal privacy law including the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Nothing in this policy limits your rights under any other applicable privacy law that applies to you, including the EU/UK GDPR, the CCPA/CPRA, PIPEDA/Law 25, or the LGPD.

15. Contact Us

Kilkelly Enterprises
Trading as Clearway Apps
Perth, Western Australia, Australia
Email: admin@clearwayapps.com.au