Privacy Policy

Version: WEB-1.0
Last updated: 18 October 2026
Effective date: 18 October 2026

1. Who we are

Caleana Pty Ltd (ACN 703 147 773, ABN 77 703 147 773), trading as Flowcost ("Flowcost", "we", "us") provides the business estimating platform at flowcost.com.au (the "Service"). This policy explains how we collect, hold, use and disclose personal information.

We comply with privacy laws that apply to us, including the Privacy Act 1988 (Cth) where applicable.

2. Account information and workspace content

Customers choose what they enter into workspaces, including estimates, libraries, imports and comments. This may include personal information about clients, employees and subcontractors.

We use workspace content to provide the Service and authorised support, maintain security and meet legal obligations, under our customer agreement. For requests about workspace information, we may coordinate with the customer while protecting other people's information.

3. Information we collect and why

We collect information reasonably necessary to provide, administer and secure the Service, directly from you, from workspace users and sign-in providers, and automatically during use.

Workspace and activity: Workspace settings, roles, invitations, estimates and change history support collaboration and access control. Workspace members can see your name, email, role, presence and changes.

Technical and security: IP address, browser details, session records and sign-in activity help us secure accounts, prevent abuse and diagnose problems.

Support and diagnostics: Feedback and screenshots help us resolve issues. Sentry receives error/performance diagnostics, email, user ID and workspace ID. Session replay samples 10% of sessions and all sessions hitting an error, with text and media masked. There is currently no replay opt-out; contact us about concerns.

Plan enquiries: Email and IP address, plus any name, company, phone, industry or SSO interest you provide, help us respond and arrange access. Unsubscribe from product/plan emails using their link or by contacting us.

4. Cookies, sensitive information and aggregated data

We use cookies and browser storage for sign-in, sessions, workspace selection and preferences. The session cookie lasts seven days and refreshes with activity. We do not use advertising cookies. Diagnostics and session replay are described above.

Do not upload sensitive personal information, such as health information, unless necessary and lawfully authorised. The Service is not designed to collect it.

We may use de-identified, aggregated data to operate, secure and improve the Service. We do not sell personal information.

5. Providers and other recipients

We use service providers for hosting, data storage, sign-in, email delivery, diagnostics, security and support. These providers handle personal information as needed to provide their services under contractual arrangements.

We may also share information with workspace members and administrators, where required or permitted by law, or in connection with a business sale or restructuring, subject to applicable law. We do not sell personal information.

6. Overseas handling

Our application, database and collaboration cache are hosted in Sydney, Australia. We also use providers in the United States for diagnostics, feedback screenshot storage and operational security. Sign-in information may be handled in Australia or overseas, depending on the sign-in provider and your organisation's configuration. Provider support access and onward processing may also occur outside Australia.

We take reasonable steps to protect personal information handled by our providers and comply with applicable overseas-disclosure requirements.

7. Holding, security and retention

We hold information electronically using service providers. We use reasonable safeguards, including encryption and access controls, to protect personal information. Staff access is limited to support, maintenance, security and legal needs.

We keep information for service, security and legal needs, then take reasonable steps to delete or de-identify it. Backup copies may remain until the relevant retention cycle ends. We assess suspected data breaches and notify affected people and authorities where legally required.

We retain feedback and attached screenshots for support and service improvement unless you request their removal, subject to applicable legal requirements. Email [email protected] to request removal. Sentry errors, session replays and logs are retained for up to 30 days. Aiven provides a single database backup for disaster recovery under our current plan; it does not publish a fixed retention period for that backup.

8. Automated processing

Estimating calculations produce figures for users to review. Security checks use IP addresses, email domains and sign-in details and may block requests or access. Contact us to request human review.

9. Access, correction and deletion requests

Email [email protected] to request access, correction or deletion of personal information. We may verify your identity and coordinate with your workspace administrator. Requests are subject to applicable law, other people's privacy and continuing retention needs.

10. Complaints and children

Send privacy questions or complaints to [email protected]. We will investigate your complaint and provide a written response within a reasonable time. If we need more time or information, we will let you know. You may also contact the OAIC where it has jurisdiction.

The Service is not directed at people under 16. Contact us if you believe we hold a child's information.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will publish the updated policy on this page and update the "Last updated" date. Where required by law, we will provide additional notice or seek your consent.

12. Contact

Caleana Pty Ltd trading as Flowcost
Privacy and Data Processing Agreement (DPA) enquiries: [email protected]
Support: [email protected]
Website: flowcost.com.au
ACN: 703 147 773
ABN: 77 703 147 773