PRIVACY POLICY

CcAHub is a trade network for the Australian construction industry. This policy covers the website at ccahub.me and everything that runs on it — accounts, public profiles, search, messages and the dashboard.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) set out in it, as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth), whether or not the small business exemption in that Act applies to us. Where this policy and the APPs differ, the APPs win and we will correct the policy.

Account information. Your name, email address, and a password stored as a hash — we never hold the password itself. If you sign in with Google instead, we receive your name, email address and account identifier from Google and no password.

Profile information. Everything you enter about your work: trade and specialisations, languages, years of experience, the suburb, state and travel radius you work from, a short bio, your phone number, an optional nationality, whether you carry public liability insurance and the cover amount, your availability, your hourly rate, your licences and certifications (title, number, issuer and expiry where you give them), your profile photo and your portfolio photos with their captions.

Messages sent through a profile. When someone contacts you from your profile we store the sender’s name, email address, phone number and message, plus any job details they chose to add — start date, location and value — and whether you have read, answered or archived it.

Technical information. Your IP address and browser user agent, used to keep the public pages from being scraped in bulk and to stop the contact form being used to send spam. A signed-in session also records the IP address and user agent it was created with. We keep a pseudonymous key derived from your IP address and user agent (a one-way HMAC hash, with the UTC date) so that repeat visits to the same profile on the same day count once, and so that searching the directory by the same trade twice in a day counts once — that key is never read back out and never linked to a person.

Searches are counted, not logged. When you filter the directory by a trade we record that trade and the day, under the same pseudonymous key, so we can tell which trades people are looking for. The words you type into the search box, the suburb you search in, the filters you set for rate or availability, and the results you open are not recorded. Nothing on the page you see is personalised by this, and no employer or professional is shown who searched for what.

We do not ask for, and do not want, your tax file number, bank details, payment card numbers, health information or government identifiers. Please do not put them in a bio, a caption or a message.

Your profile is public by design. A published profile is readable by anyone at your address, ccahub.me/your-name, without an account, and search engines may index it and keep a cached copy. The public page shows your name, trade, specialisations, languages, service area, bio, licences and certifications, portfolio and availability. For each licence and certification it shows what you gave it: the name, who issued it, the register number and the date it was issued. The register number is public on purpose — a company checks it against the issuer's own register, and several states require a licensed trade to publish it in its advertising. Everything there is your own statement; CcAHub verifies none of it. The CV you can download as a PDF from your profile page gathers all of it in one file — your photo, every credential and the ABN — and you choose whether it also carries your phone, your email and your nationality: that switch is the contact card, and the CV prints its code like the page does.

Your contact details travel in a scannable card, and the switch is yours to turn off. The profile carries a QR code that a phone camera reads and saves as a contact — your name, trade, specialisations, languages and their levels, nationality, service area, phone number and the email address on your account, plus the link to your profile. It is on by default: the code is generated with the profile, and “Contact card on my profile” in the dashboard takes it down again — with it off, the page publishes no contact details at all. While it is on, anyone who can open your profile can scan or decode it, so treat those details as public, exactly as you would a business card you hand out. The enquiry form stays the way companies reach you inside CcAHub, and your hourly rate appears in search results rather than on the public profile.

You can take your profile out of search results and off the homepage with the visibility switch in the dashboard, and you can edit or remove any field, photo or credential at any time. Removing something from the site does not reach into a search engine’s cache or a third party’s copy — that is outside our control.

We set one essential cookie: a signed session token that keeps you logged in. Without it the dashboard cannot work. We do not set advertising or analytics cookies, and we do not run third-party advertising or tracking scripts on the site.

Your browser storage also holds three things for convenience: your light or dark theme preference, your dashboard notification preferences, and — while you are part-way through the registration wizard — a draft of the profile you are filling in, so a refresh does not lose it. The draft never contains your password. All of it is stored in your own browser and can be cleared from your browser settings.

Two Google services load on some pages and receive your IP address as part of serving them: Google Fonts, which supplies the site’s typeface, and Google Maps and Places, which powers the address suggestions when you type a location. If you choose to sign in with Google, that request goes to Google too.

• to create and secure your account, and to sign you in
• to publish the profile you asked us to publish, and to let companies find it
• to carry a company’s enquiry to you and let you answer it
• to keep the platform usable and safe — rate limits, spam and scraping controls, and abuse handling
• to count views on a profile, as a number, so you can see whether the profile is being opened
• to count searches by trade, as numbers, so we can tell which trades are in demand and what the directory is missing
• to meet our legal obligations and to respond to lawful requests

We do not use your information for automated decision-making that has a legal or similarly significant effect on you, and we do not sell or rent personal information to anyone.

Other users of the site. Anyone can read a published profile, and a company that sends you a message sees the name and email address it typed into the form, alongside the profile it wrote to.

Service providers who run the platform on our behalf. Our hosting and delivery provider, our managed PostgreSQL database, our photo storage provider (Cloudflare R2, which holds profile and portfolio images), our transactional email provider, and Google for the font, address and optional sign-in services described above. They may only use the information to provide their service to us.

Where the law requires it. A court order, a warrant, or a request from a regulator or law enforcement agency that we are legally obliged to answer. Where we are permitted to tell you, we will.

If the business is ever sold or restructured, personal information may transfer with it. This policy would continue to apply until it is replaced, and we would give notice before your information came under a new policy.

Some of the providers above store and process data in several countries, including the United States. That means personal information may be handled outside Australia. Where it is, we take the reasonable steps Australian Privacy Principle 8 requires — we choose providers with contractual privacy and security commitments, and we disclose only what the service needs.

By using CcAHub you acknowledge that this disclosure happens. If you would rather your information were not held overseas, the practical options are to keep your profile unpublished or not create an account — there is no way for us to run the service on infrastructure that is entirely inside Australia.

Passwords are stored as hashes, traffic to the site is encrypted in transit, access to production data is limited to staff who need it, and the public pages are rate-limited against bulk collection. Images are stripped back and re-encoded before they are stored.

No system is unbreakable. If a data breach occurs that is likely to result in serious harm, we assess it under the Notifiable Data Breaches scheme and notify the affected people and the Office of the Australian Information Commissioner as the Privacy Act 1988 (Cth) requires.

Most of it you can do yourself: the dashboard edits every profile field, the portfolio page adds and removes photos, Settings changes your address and preferences, and Settings also deletes the account — with the name typed back as confirmation, because it cannot be undone. Corrections land immediately.

For anything you cannot do in the dashboard — a copy of what we hold, or a correction the forms do not reach — email support@ccahub.com.au from the address on the account. We will acknowledge the request and answer within 30 days, as APPs 12 and 13 require. If we cannot do what you asked, we will tell you why and how to complain.

Account and profile information stays while your account exists. A photo you remove is deleted from storage; a message you delete is removed from your dashboard. Profile view counts are kept as a number.

Two windows run on their own, without anyone asking. The IP address on a message sent through our contact form is erased after 90 days (that address exists only so we can recognise a spam burst; the message itself stays). Contact-form messages, profile view counts and search counts are deleted after two years. Messages between you and a professional are not on that clock: they are that professional's own record of the work they were asked about, and they stay until the professional deletes them or closes the account.

When you ask us to delete your account, we delete the account, the profile and the media attached to it, and the retired web addresses that pointed at that profile stop answering. Two things can outlive a deletion: records we must keep to meet a legal obligation, and backups, which are overwritten on their own cycle.

CcAHub is for adults. Accounts are for people aged 18 and over, and the platform is not directed at children. We do not knowingly collect personal information from anyone under 18; if you believe a child has created an account, tell us and we will remove it.

Two emails come from CcAHub, and nothing else. The first is the password reset you ask for. The second is a notification when a company sends you a message through your profile — it carries the message and the sender’s contact details, so you can judge the job without opening your dashboard, and it is on by default. A switch under Settings in your dashboard turns it off, and every one of those emails carries the link to that switch.

We do not send marketing or promotional email, and we do not sell or share your address for anyone else to do so — consistent with the Spam Act 2003 (Cth).

If you think we have mishandled your personal information, email support@ccahub.com.au with what happened and what you want done about it. We will look into it and reply within 30 days.

If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner — oaic.gov.au, 1300 363 992. You can also contact the OAIC without approaching us first.

We will update this policy when what we do changes, and the date at the top will move with it. If a change materially affects how we handle your information, we will tell account holders by email or with a notice on the site before it takes effect.

Questions about this policy, or about the Terms of Use that go with it, can go to the same address: support@ccahub.com.au.