Privacy policy

1. Who we are

ClientCarePlus is operated by Parneet Singh Batra (ABN 53 661 545 083), a sole trader in Victoria, Australia. In this policy, "we", "us" and "our" mean ClientCarePlus. Our website is clientcareplus.com and the app is at app.clientcareplus.com.

You can contact us about privacy at [email protected].

2. Your information, and your customers' information

We handle personal information in two ways.

• About you, when you use our website, sign up, sign in, pay us or ask us for help. We decide how this is used, and this policy covers it.
• About the people in your workspace: the contacts, leads, clients and others a business keeps in ClientCarePlus. The business that owns the workspace decides what goes in and how it is used; we store and process it for them, to provide the service. If you are one of those people, the business you dealt with is the place to start, and we will help them answer you.

A business using ClientCarePlus is responsible for having the right to collect and use the personal information it puts in, including consent to send marketing emails.

3. What we collect

About people who use ClientCarePlus:

• Account details: your name, work email, and, if you add them, your mobile, job title and photo.
• Sign-in details: your password, stored only as a one-way hash; whether two-step verification is on; and, if you sign in with Google or Microsoft, the account identifier they give us.
• Where you are signed in: the browser and device, IP address and times, so you can see your sessions and sign out of them, and so we can protect your account.
• What you do in a workspace: changes to records are kept in the workspace's audit log, with who made them and when.
• Business details for a workspace: its name, ABN, address, logo and, if the business sends invoices through ClientCarePlus, the bank account those invoices show.
• Billing: the plan, invoices and payment status. Card payments are taken by Stripe; we never see or store your full card number.
• Help and feedback: questions you send us from the help centre, and whether a guide helped, with any comment.

About people a business keeps in ClientCarePlus, as that business enters or imports it: names, contact details, addresses, notes, appointments, tasks, files, deals, quotes, invoices, support tickets, and whether they have agreed to marketing emails, with the date. Enquiries from a business's website, and leads from its Facebook or Instagram forms if it connects them, arrive the same way.

About visitors to our website: if you ask for a demo, your name, work email, business, industry, team size and phone number. Our website uses no analytics, advertising or tracking cookies, and loads nothing from other companies' servers.

4. How we use it

• To provide ClientCarePlus: to sign you in, keep each workspace's records, send the emails you and your workspace ask it to send, and take payments.
• To keep accounts and the service secure: to tell you about changes to how you sign in, to limit repeated attempts, and to investigate misuse.
• To support you: to answer your questions and, only with a workspace's approval, to look into a problem inside it (see below).
• To bill you, and to keep the records the law requires us to keep.
• To tell you about changes to ClientCarePlus and your account. We only send product news if you agree to it, and every such email has an unsubscribe link.
• To improve ClientCarePlus, using what people tell us and how the service performs. We do not sell personal information, and we do not use the records in your workspace to advertise to anyone.

5. Emails sent through ClientCarePlus

Some emails are about your account, such as sign-in codes, password resets and security notices. These are part of the service and can't be switched off.

A business can send marketing emails from its workspace. Those go only to people it has recorded as agreeing to receive them. Each one carries the business's name and postal address and an unsubscribe link that works straight away. To see whether a marketing email was opened and which links were clicked, the email contains a small image and links that pass through ClientCarePlus. One-to-one emails, invoices and appointment emails a business sends from ClientCarePlus come from that business, and replies go to it.

6. Who we share it with

We share personal information only as needed to run ClientCarePlus, with these service providers:

• Stripe, which takes card payments for our subscriptions and, if a business connects it, for that business's invoices.
• Cloudflare, which carries traffic between your browser and our servers and protects the service from attacks.
• Google and Microsoft, only if you choose to sign in with them; they tell us your name and email address.
• Meta (Facebook and Instagram), only if a business connects its lead forms; leads are fetched from Meta into that business's workspace.

A business can also send its one-to-one emails through its own mail server, which it chooses and controls.

Support access: our support staff cannot see inside a workspace unless an owner or admin of that workspace approves it, for a limited time and read-only. In an emergency affecting customers, our most senior staff can open a workspace read-only without waiting; its Primary Owner is emailed straight away, and every page viewed is recorded and shown to the workspace.

We may also disclose information when the law requires it, or to protect someone's safety.

7. Where it is stored

ClientCarePlus's servers, database and files are in Australia.

Some service providers above may handle limited information outside Australia: Stripe processes payments in the United States and elsewhere; Cloudflare's network operates worldwide; Google, Microsoft and Meta are based in the United States. We use providers that protect personal information to a standard comparable to the Australian Privacy Principles.

8. How we protect it

• Everything between your browser and ClientCarePlus is encrypted (HTTPS), and so is email between mail servers where the receiving server supports it.
• Passwords are stored as one-way hashes; mail server passwords and sign-in secrets are encrypted.
• Two-step verification is available for every account, and every change to how you sign in is emailed to you.
• Each workspace's records are kept apart from every other workspace's, and roles decide who in a workspace can see and change what.
• Changes to records are logged, and the database is backed up.

No system is perfectly secure. If a data breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

9. How long we keep it

We keep information for as long as a workspace or account is active.

• Records deleted in a workspace can be restored for 30 days, and are then removed for good.
• When a business cancels, its workspace becomes read-only, then is closed after 30 days, and all its data is deleted after 90 days.
• When you close your own account, your sign-in details are removed; records you created in a workspace stay with that workspace.
• Invoices and payment records are kept for as long as Australian tax law requires.
• Backups are kept for a limited time and replaced on a rolling basis, so deleted information leaves them within that time.

10. Seeing and correcting your information

You can see and change your own account details at any time in Settings → Your account, and a business can change the records in its workspace.

You can ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing [email protected]. We will reply within 30 days. If the information is in a business's workspace, we will pass your request to that business, which decides about its own records.

You can unsubscribe from any marketing email using its link, and you can visit our website without giving us any personal information.

11. Information from Facebook and Instagram, and deleting it

When a business connects its Facebook Page in Settings → Lead sources, we receive the Page's name, an access token that lets us read its lead forms, and the leads people send through those forms on Facebook and Instagram. We use them only to bring those leads into that business's workspace.

A business can remove our access at any time: Disconnect in Settings → Lead sources stops new leads and deletes the access tokens we hold. Removing ClientCarePlus from the business integrations in your Facebook settings does the same.

Leads already brought in are that business's records. The business can delete them in its workspace, where they can be restored for 30 days and are then removed for good.

If you sent a lead form to a business and want your information deleted, ask that business, or email [email protected] with the business's name and the email address or phone number you used. We will pass your request to the business, or delete the information ourselves where it is ours to delete, and reply within 30 days.

12. Questions and complaints

If you have a question or a complaint about how we handle personal information, email [email protected]. We will acknowledge it within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

13. Changes to this policy

We will update this policy when how we handle personal information changes, and change the date at the top. If a change matters to people using ClientCarePlus, we will tell workspace owners by email before it takes effect.