Data Processing Addendum

Part of the Yamate Terms · Last updated 25 September 2026

The plain-English version first. Your books hold other people's details — your customers, your crew. Under privacy law those details are yours to control, and Yamate only handles them to run the features you use. This page is the formal version of that promise, for you or your accountant to keep on file. By default your books live on your own device and we process very little; the server-side processing described here only happens for the features you switch on.

1 · Who this is between

This addendum is between the customer named on the Yamate account (you, the controller of the personal information in your books) and Clarova Pty Ltd (ABN 12 701 418 957), trading as Yamate (we, the processor). It forms part of the Terms and applies whenever we process personal information on your behalf.

2 · Definitions

Applicable privacy laws — the Privacy Act 1988 (Cth) and the Australian Privacy Principles and, only if they apply to you, the NZ Privacy Act 2020, the UK GDPR or the EU GDPR.
Your personal information — personal information you control and put into Yamate: your customers' names, contact details, addresses, job details, notes and photos, and your crew's employment and pay details.
Subprocessor — a provider we use to deliver a feature (hosting, SMS delivery, AI drafting and the rest).
Breach — a security breach leading to accidental or unlawful loss, alteration, disclosure of, or access to your personal information we hold.

3 · Roles

You are the controller: you decide what goes into your books and why, and you are responsible for collecting it lawfully from your customers and crew. We are the processor: we handle that information only to provide Yamate's features, on the instructions you give by using them, and never for our own marketing.

4 · What processing actually happens

By default your books are stored on your own device and we do not hold them. We process your personal information server-side only when a feature needs it, and the privacy policy describes each case: secure backup and sync if you turn it on; customer quote, invoice and request links; texts you send or switch on; AI drafting when you use it; pushes to your own Xero, Stripe or Square accounts when you connect them.

5 · Helping you meet your own obligations

If one of your customers or crew asks you for access, correction or deletion, the tools are already in the app: you can view and edit any record, export your data at any time, and delete records or your whole account. If a request needs something the tools cannot do, email support@yamate.au and we will help within a reasonable time.

6 · If something goes wrong

If we become aware of a breach affecting your personal information, we will tell you without undue delay, with what we know about what happened, what was affected and what we are doing about it — enough for you to meet your own notification duties under the Notifiable Data Breaches scheme.

7 · How it is protected

Server-side data sits behind row-level security so one account cannot read another's; customer tables are reachable only through our own server code, never directly; everything travels encrypted; card details never touch us at all (they go to your own Stripe or Square). The privacy policy has the longer version.

8 · Where data goes

Some providers store or process data outside Australia (cloud infrastructure, AI processing). We take reasonable steps to use reputable providers, but overseas recipients may not be bound by the Australian Privacy Principles — the same statement the privacy policy makes, kept identical on purpose. If a law that applies to you requires transfer safeguards (for example the EU standard contractual clauses), they are incorporated into this addendum for those transfers.

9 · Subprocessors

The privacy policy's "who else touches your data" list is the authoritative list of our subprocessors and what each one sees — one list, kept current there, so this page can never quietly disagree with it. We remain responsible to you for what our subprocessors do with your personal information. If we add one that handles your personal information, the privacy policy is updated first.

10 · Liability, term and the end

Liability under this addendum is as set out in the Terms — this page adds obligations, not a second liability regime. It applies for as long as we process your personal information and ends when that stops: when you delete your account, server-side data is deleted on the schedule the account deletion page states, and anything only ever stored on your device was never ours to hold.

Questions about this addendum: hello@yamate.au