Privacy Policy

The short version

Your business and customer information is yours. By default it lives on your own device. We don't sell your data, ever. You can export or delete it any time.

What we store, and where

• On your device (default): your jobs, quotes, invoices, customers, expenses and settings are saved in your browser/app on your phone or computer. They stay there unless you turn on a cloud feature.
• In the cloud (only if you use these features): cloud backup, customer quote/invoice/request links, and sign-in store the relevant data on our hosting provider (Supabase) so the feature can work. If you sign in, signing out clears your books off that device once they are backed up to your account.
• Your booking link and busy days: if you turn the booking link on, it carries the days you have blocked out, and for days you are already part-booked, how much time is left. That is a date and a number of minutes - never a job, a customer, an address or a time of day. Your customer only ever sees whether a day looks busy.
• When you report a problem in the app: we get your note, which version you are on, the screen you were on, your screen size, your phone and browser, whether you were online, your local time, which features are switched on for you, and the last few error messages, with any numbers and addresses blanked out. No job details, no customer names or numbers, and no screenshot. We delete a report 12 months after you send it.
• If you have a crew: we record which person changed which record and when, kept 90 days. We record the names of the fields that changed, never what they changed to.
• If you lodge with the ATO from Yamate, we keep a record of sign-ins, of who gave, changed or removed a person's access, and of who opened payroll, for 13 months, because the ATO requires it. To turn it on, we text a code to your mobile and check your ABN with the Australian Business Register.
• Forms you fill in on a job: the answers, any signature drawn on the screen and the finished PDF are kept with that job, like its photos. With cloud backup on they are stored privately for your business, and deleting the job deletes them.
• If a tradie asks you for a photo and you send one: the photo is stored privately for that one tradie and nobody else can see it. Your phone makes a smaller copy before it is sent, which also removes the hidden details a phone adds to a photo, like where it was taken. Once it reaches the tradie's app we delete our copy 30 days later; the tradie keeps theirs with the job.
• If you send an electrical certificate (CCEW) to Building Commission NSW from Yamate: we send them what the certificate needs, which is your name, licence and contact details, the tester's if someone else tested it, the customer's name and address, the site and the work done. We keep a record of each send so you can see what happened. If you delete your account we remove the customer's and your details from that record, and keep only the job reference, the certificate number, your licence number and the dates, because the Commission can ask to check a certificate later. If you sent them as part of someone else's business, those certificates are that business's records, so your name and licence stay on them for the same reason.
• We count how ya mate gets used (answers given, buttons tapped, questions asked twice) as numbers only, with no words from your questions or answers and nothing that says who you are.
• When a customer opens a quote or invoice link: we record that it was opened and when, so the tradie can tell whether it arrived. We do not record who opened it, and we do not record anything about their device, browser or location.

Third parties we use

• Supabase — hosting/database for the optional cloud features and sign-in.
• Stripe — handles your Yamate subscription, and your customers' card payments if you connect your own Stripe account. We never see or store card details.
• Square — the same, if you connect Square instead. Your customers' card payments go through your own Square account. We never see or store card details.
• Anthropic (AI) — if you use the AI quote helper, the job description (and any photo you choose to send) is processed to draft a quote. When you ask ya mate about your records, the jobs, customers and money it needs to answer your question are sent too. It isn't used to train models.
• SMS provider — delivers the texts: the automatic ones you turn on, the one welcome text Yamate may send when you sign up, and short alerts to Yamate's founder. It gets the message and the number it goes to.
• Google Analytics — measures how the website and the app get used: which screens open, which buttons get tapped, and error reports when something breaks. It runs on this site and inside the app, and it sets cookies. We don't send it your job details or your customers' contact details.
• Google (address lookup) — when you type a job or customer address, what you have typed so far is sent to Google to suggest the rest. That includes your customer's street address. It is only sent while you are typing in an address box.
• WeatherAPI — for outdoor jobs booked in the next few days, the job's location is sent to WeatherAPI to check the forecast. This happens on its own when you open Today — no name, phone or email goes with it.
• Xero — if you connect Xero, the invoices you choose to push are sent there, including your customer's name, address and the amount. If you let your accountant send your books to their Xero, we send your invoices, payments and bills there when they tap Send.
• Resend — sends the emails Yamate sends: the alerts telling you a customer accepted a quote or asked for a job, messages you send us, the founder's own notifications about new signups and directory requests (see When Yamate gets in touch), and the quotes and invoices you choose to email to your customers from Yamate — for those it gets your customer's email address, the message and the link. It also sends the invite when you add someone to your crew or your accountant, and gets their email address and the link. It gets the email address and the message.
• Microsoft Clarity — records how this website is used: taps, scrolling and mouse movement, so we can see which pages confuse people. It runs on the public website only, never inside the app or on your customers' quote and invoice links, and it sets cookies. We don't send it your job details or your customers' contact details.
• Twilio — runs the missed-call numbers. Turn on missed-call texts and we check which phone company your mobile is on, then rent a Twilio number for that phone company to divert your unanswered calls to. Twilio gets your mobile number, the caller's number and the number that diverted, then ends the call so it never connects. The caller may be someone who has never used Yamate.

If you arrive from someone who recommended us

Some websites and people recommend Yamate and earn a commission if you subscribe. If you land here from one of their links, we record that the link was followed and store a small code on your device for 60 days so they still get credit if you come back later and sign up.

That code identifies them, not you. It carries no name, no email and nothing about you. We keep a scrambled (hashed) version of your IP address and browser type with it — enough to spot someone faking clicks, not enough to identify you. We don't use any of it for advertising, we don't sell it, and it isn't shared with the person who recommended us: they see that a signup happened and what they earned, never who you are.

Clearing your cookies removes it. If you'd rather not have it set at all, come to yamate.au directly instead of through a recommendation link.

When Yamate gets in touch

When you sign up. We ask for your mobile when you set up. It goes on your quotes and invoices, and Yamate's founder may call or text you to help you get set up. We may also send you one welcome text with a short setup video. Every text from Yamate says who it is from. Reply STOP and Yamate won't text you about Yamate again. That only stops our texts. It never stops a tradie you deal with texting you about your own job.

Where you came from. On your first visit we note the website that sent you, any campaign tag in the link and the page you landed on. When you sign up we keep that with your account, so we know which places bring tradies to Yamate. It is a website name and a few words, not anything about you, and we don't sell or share it.

What the founder sees. When you sign up, start paying, claim a directory listing or ask for quotes through the directory, Yamate's founder gets a short text and an email so she can follow up in person. The text carries a business name, a trade or a suburb, never a phone number or a customer's name. The email and a private page only she can sign in to carry the details: how far you have got setting up, and for a quote request, the job, your contact details and the tradies you picked. She gets a reminder the same way if a new account goes quiet, or a free trial is about to end.

When you ask for quotes through the directory. The tradies you pick get the details the confirmation screen lists, and Yamate may call or text you to check you got sorted. We don't use your details to sell you anything else.

When you book a setup call. We keep your name, number, note and the time you picked, so Tessa can call you, and she gets a text with them before the call. We delete the booking 90 days after the call. We never keep your IP address itself, only a scrambled code that changes every day, so one connection cannot fill the calendar.

Searching the tradie directory

Anyone can search the directory without an account, and we would like to keep it that way. You get the first page of results without signing in; more pages need a free account. To stop one script copying the whole thing, we keep a short log of searches.

If you ask for a quote, we keep your name, phone number and suburb on your account so you do not type them again. Only the tradies you pick see them, inside Yamate. You can change or remove them any time under Account.

For each search the log holds three things: the postcode searched, the trades searched, and which page of results was asked for. Not the words you typed, and not what you told a tradie about the job.

We do not keep your IP address. If you are not signed in we scramble it into a code that changes every day, so we can tell that a thousand searches came from one visitor without ever knowing who. If you are signed in, the code is made from your account instead, so a day's searches can be added up against your account's limit.

The log is deleted after 14 days. It is read by two things only: the check that pauses a visitor who is copying the directory, and Yamate staff checking how the directory is used and looking for misuse such as robots, one day at a time. No feature of Yamate reads it, and it is never used to build a picture of you.

We also count page views on this website. For each view we keep the page and whether it looked like a robot, under the same daily code, and delete it after 14 days. We keep a running total for each page, with nothing about who viewed it. Visits from Yamate's own internet connections and devices are counted separately, as ours.

We also count which buttons get tapped on a tradie's card: Request a quote, Call, Website or opening the listing. Each tap adds one to a tally for that day. The tally holds the day, the kind of page and the button, and nothing else: not you, not your IP address, not which tradie.

Anyone can report a listing. A report keeps the listing, the reason you picked, the words you typed, your email if you chose to give it, and a scrambled code made from your connection so one person cannot flood us with reports. We never keep your IP address itself. Only Yamate staff read reports, and we never tell the business who reported it.

Your customers' data

You're responsible for the customer details you enter. Only add what you need to do the job, and let your customers know you keep their contact details to quote, invoice and service them.

If a customer rates a job on their invoice page and ticks to share it, we show their stars, words and the first name they give on that business's Yamate page. If they don't tick, only that business sees it.

Site sign-in: when someone scans a site's sign-in code, the page asks for their name, who they work for and a yes or no to "fit for work today". Those, and the times they signed in and out, go to the business running that site for its site safety records. If they sign the job's safe work method statement on the page, that they signed it, and when, goes with them. They are kept with that job until the business deletes the job or its account. The page remembers the name on that phone so it is not typed again. Nothing is texted or emailed to anyone.

Safety documents: the safety documents you make in Yamate, such as an incident report or a register of injuries, can hold people's names and injury details. They are stored like the rest of your records. The owner and office logins see them; a crew login sees the documents on its own jobs and can read, not change, the business plans and registers workers need (never the register of injuries); the accountant login sees none. Nothing in them goes to anyone unless you print or share it.

Your rights

• Export: download your data any time from Settings → Your data.
• Delete: delete your account and its cloud data — both ways to do it, on one page.

Where your data goes (overseas disclosure)

Some of the third parties above may store or process data outside Australia (for example cloud infrastructure or AI processing). Where that happens we take reasonable steps to use reputable providers, but overseas recipients may not be bound by the Australian Privacy Principles. Ask us if you'd like specifics for a particular feature.

Access, correction & complaints

If you did not sign up, and we hold a listing for your business

Yamate builds a trade directory from public sources, so we may hold a listing for a business that never created one. That is a different collection from everything above, and it has its own notice: how we collect business information — what we took, where from, and how to change or remove it without an account.

You can ask what personal information we hold and request a correction any time — email us. If you're unhappy with how we've handled your privacy, tell us first and we'll try to fix it; you can also complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Data breaches

If a breach occurs that's likely to cause serious harm, we'll act promptly to contain it and notify affected people and, where required, the OAIC, in line with the Notifiable Data Breaches scheme.

Security (honest note)

On-device data is as secure as your device. The cloud features are pilot-stage — fine for getting started, but during the pilot please don't store anything you'd be uncomfortable having in a shared pilot system. Cloud features are protected by secure per-user sign-in and database row-level security, so your account's data is kept separate from other users'. We're still hardening the system during the pilot, so please avoid storing anything highly sensitive for now.

Who we are

Yamate is a product of Clarova Pty Ltd · ABN 12 701 418 957. That company is the entity responsible for the personal information described in this policy, and “we” means it throughout.

Contact

Questions or a data request? Get in touch via our contact page or email us · Something not right? Report it · Find us on Facebook · Review us on Google · ProductReview · Trustpilot · Who Do I Call? Australia, our free Facebook group.