Privacy & Cookies Policy

SmartKarobar respects your privacy and takes our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) seriously. This policy explains, in plain language, what information we collect, why we collect it, how we use and protect it, how we use cookies and similar technologies, how you can delete your account, and how long we keep your data.

It covers both the SmartKarobar portal (for individuals) and the SmartKarobar hub (for businesses running their operations on the platform), whether you use them on the web or through our mobile apps for Android and iOS. SmartKarobar is operated by Smart Karobar Pty Ltd.

We collect information directly from you when you register or use the platform, from the business you’re part of if you join one, automatically through your use of SmartKarobar (like technical and usage data), and from connected third-party services where you choose to use them (like Google sign-in).

Account information. When you register, we collect your name, email address, and password (stored securely, never in plain text), and confirm the email address with a one-time code before the account is created. If you later sign in to that account with Google on the website, we receive the basic profile information Google shares for that purpose (your name, email address and profile picture).

Business information. If you set up or join a business on SmartKarobar, we collect information about that business — its name, business ID, contact details, industry, and the modules and plan it uses.

Customer, supplier and employee information you enter. If you’re running a business through the hub, you may enter information about your own customers, suppliers, and staff — names, contact details, order and invoice history, timesheets, and similar operational records. This is your data, entered by you, for your business purposes (see our Terms of Service, section 7).

Opportunities and proposals. If you post an opportunity — a business seeking investment or acquisition — we collect what you put in it, such as the business’s sector, location, the amount sought and supporting documents. If you respond to one, we collect your proposal, including the amount and your message.

Enquiries. If you enquire about a service SmartKarobar offers, we collect your name, email address, phone number (if you give one) and your message, whether or not you have an account.

Personal tools. If you use personal features such as reminders, goals and finance planning, or the Karobar personal ledger, we store the entries you create so they are available to you across your devices.

Payment and billing information. When you subscribe to a paid plan or pay a fee, we keep limited billing information (such as the plan you’re on, subscription status, amounts paid and invoice history). Where a card payment is taken, our payment processor collects your card details directly; we don’t store full card numbers ourselves.

Technical information. We automatically collect some technical information when you use SmartKarobar — your IP address, browser type, device information, and general usage patterns (like which pages or features you use) — mainly for security, troubleshooting, and improving the platform. Section 10 explains the cookies and browser storage we use.

Most of what you enter into SmartKarobar is private. Your business hub information — customers, invoices, orders, quotes, projects, timesheets, payroll, suppliers and financial records — is only visible to your authorised users and is never shown to other businesses or made public.

Some information is different because the public portal’s purpose is to connect businesses with the people who might back them:

• opportunities you post are shown, once reviewed and approved, to anyone browsing the portal, signed in or not — including the details you put in the listing; and
• the library and SmartKarobar’s own service listings are public too, but contain nothing about you.

By contrast, a proposal you send in response to an opportunity is shared only with that opportunity’s owner, together with your name, email address and profile picture so they can reply. It isn’t published to the portal.

Where it’s practicable, you can browse the public parts of SmartKarobar without identifying yourself. However, most meaningful use of the platform isn’t practicable anonymously — creating an account, setting up or joining a business, posting an opportunity, and processing payments all require you to identify yourself, so full anonymity isn’t available for those features.

We collect and use information to:

• create and manage your account and your business’s access to SmartKarobar;
• provide the features you use — reviewing and publishing opportunities, passing proposals to their owners, processing orders, generating invoices, running payroll, managing projects, and everything else the platform is built to do;
• respond to enquiries about SmartKarobar’s services;
• verify identity or business details where a feature requires it (for example, opportunity review or business verification);
• communicate with you about your account, service updates, or support requests;
• process payments and manage subscriptions;
• keep the platform secure, investigate suspicious activity, and prevent misuse;
• understand how the platform is used so we can improve it; and
• meet our legal and regulatory obligations.

We don’t use your business’s customer, supplier or financial data for our own marketing, we don’t sell personal information to third parties, and we don’t use your information for third-party advertising.

We may send you occasional emails about new features or updates to SmartKarobar. You can opt out of these at any time using the unsubscribe link or your account settings. We’ll still send you essential communications about your account or the service — like security notices, billing information, or changes to these policies — which you can’t opt out of while you have an account.

We share information only where it’s genuinely necessary to run the platform, and always with appropriate safeguards. There’s a difference between providers we use to operate SmartKarobar and integrations you choose to connect yourself:

Cloud hosting and infrastructure providers, who store and process data on our behalf so the platform can run.

Payment providers, who process payments and handle your payment details directly.

Email and communication providers, who deliver transactional emails such as password resets, invitations, and notifications.

Third-party integrations you choose to connect (such as Google sign-in) — where you enable these, information is shared with that provider as necessary for the integration to work, subject to their own privacy practices.

Law enforcement or regulators, where we’re required to by law, or to protect the rights, safety or property of SmartKarobar, our users, or others.

We don’t share your business’s data with other SmartKarobar tenants, and we don’t disclose it to third parties for their own marketing purposes.

If you’re a business entering personal information about your own customers, suppliers or employees into SmartKarobar, you’re responsible for having the appropriate authority to provide that information to us and for meeting your own obligations to those individuals, including under the Privacy Act where it applies to your business. This doesn’t reduce our own responsibilities as the platform processing that data on your behalf.

Some of the providers we rely on for hosting, payments or other infrastructure may store or process data outside Australia. Where this happens, we take reasonable steps to ensure the overseas recipient handles personal information consistently with the Australian Privacy Principles, as required under APP 8. These recipients currently include: [Insert countries/providers, e.g. hosting provider and region].

We use a layered approach to security: scoping each business’s data to its own tenant so it can’t be seen by other businesses, role-based permissions enforced on our servers rather than hidden in the interface, encryption of data in transit, and password hashing rather than plain-text storage. On our mobile apps, sign-in tokens are kept in the device’s secure storage. Access by our own staff is limited to what’s genuinely needed to operate and support the platform.

No online platform can guarantee absolute security, and we can’t promise that data will never be accessed, disclosed or lost due to circumstances beyond our reasonable control. If a breach is likely to result in serious harm, we’ll respond as set out in section 14.

Cookies are small text files a website places on your device. Browser storage (such as local storage) is a similar technology that lets a website keep small pieces of information in your browser. Here we use “cookies” to mean both. In short: we only use what’s needed to run the platform.

What we use and why

• Essential — needed to keep you signed in, keep your account secure and make core features work. The platform can’t function properly without them.
• Functionality — make sure things you created on this device aren’t lost before they’re saved to your account.

Third-party services

Some features rely on third-party services, which may set their own cookies when you use them:

• Google sign-in — if you choose to sign in with Google on the website, Google may set cookies to authenticate you and protect against fraud. See Google’s cookie policy.
• Embedded videos — some library resources include YouTube videos. We embed them using YouTube’s privacy-enhanced mode (youtube-nocookie.com), which doesn’t store information about you unless you play the video.

What we don’t use

We don’t use advertising, retargeting or third-party analytics cookies, and we don’t track you across other companies’ websites or apps. If we introduce analytics or any other non-essential cookies in the future, we’ll update this policy first and, where required, ask for your consent before setting them.

Our mobile apps

Our mobile apps don’t use browser cookies. They keep your sign-in tokens in your device’s secure storage so you stay signed in, and they don’t use advertising identifiers.

Controlling cookies

You can view, block or delete cookies and site data through your browser settings. Signing out of SmartKarobar removes your sign-in tokens from the browser. If you block or clear essential storage, you’ll be signed out and some parts of SmartKarobar may not work properly until you sign in again.

You can access and update most of your account and business information directly within SmartKarobar. If you’d like a copy of personal information we hold about you that isn’t available in-platform, or you believe something we hold is incorrect, contact us at connect@smartkarobar.com and we’ll respond within a reasonable time, consistent with our obligations under APPs 12 and 13.

You can delete your SmartKarobar account at any time. One account works across the website and the mobile apps, so deleting it removes your access everywhere.

In the app or on the website

1. Sign in, then go to Profile → Security → Delete account in the app, or Security settings on the website.
2. Check the list of businesses that will close with your account, if any.
3. Type your account’s email address to confirm, and delete.

Your account is closed straight away, you’re signed out on every device, and we send a confirmation email. Before you delete, export anything you want to keep — such as invoices, reports or ledger statements.

By email, if you can’t sign in

Email connect@smartkarobar.com from the address registered to your account, with the subject “Delete my SmartKarobar account”. We’ll confirm the request came from you before closing the account.

What we delete

• your profile — name, email address, contact details, profile picture and sign-in details;
• your personal tools — reminders, finance goals and Karobar ledger entries;
• opportunities you posted and proposals you submitted, which are removed from the portal; and
• the hub data of any business nobody else has Full Access to (see below).

Business accounts and staff

• Business owners — if nobody else has Full Access to a business, deleting your account also closes that business and deletes its hub data (customers, quotes, invoices, projects, staff records and so on) after the retention period. To keep the business running under someone else, give another team member Full Access first.
• Team members — deleting your account removes you from every business you belong to. Records a business keeps about your work for it (for example timesheets or payroll) belong to that business, and it’s responsible for them.

Deleting some data without closing your account

You can edit or delete most things yourself — your profile details, reminders, goals, ledger entries and opportunities you’ve posted. For anything you can’t remove yourself, email connect@smartkarobar.com and tell us what you’d like deleted.

We keep personal and business information for as long as your account is active. When an account closes — because you deleted it or under section 12 of our Terms of Service — we keep its data for 60 days so it can be restored or exported if needed, and then delete or de-identify it permanently.

We may keep some information for longer where the law requires or allows it, specifically:

• payment and invoice records, for as long as tax and financial record-keeping laws require (generally up to 7 years in Australia);
• records needed to resolve a dispute, prevent fraud or enforce our Terms; and
• encrypted backups, which are overwritten in the normal backup cycle.

Anything we keep stays protected and is used only for those purposes.

If we become aware of a data breach that’s likely to result in serious harm to an individual, we’ll assess it and, where required, notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act.

If you have a concern about how we’ve handled your personal information, contact us first at connect@smartkarobar.com so we can try to resolve it. If you’re not satisfied with our response, you can lodge a complaint with the OAIC at oaic.gov.au.

SmartKarobar is intended for business use by adults and isn’t directed at children. We don’t knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at connect@smartkarobar.com and we’ll take appropriate steps to delete it.

We may update this policy from time to time, including to reflect changes in the law, the technologies we use, or how we handle information. We’ll post the updated version here with a new “last updated” date, and where a change is material, we’ll take reasonable steps to let you know, such as an email or in-platform notice.

For any questions, requests or complaints about privacy, cookies or deleting your data, contact: