Privacy Policy

verEx is operated by Acom Systems Pty Ltd (ABN 50 079 047 528), trading under the registered business name VeRex Marketing Co., in Sydney, Australia. verEx is a construction program application, at app.verex.build, that connects project delivery, procurement and finance.

This policy explains how we collect, hold, use and disclose information through this website, the verEx application and its public pages, demonstration bookings and related business communications. For privacy questions, write to james@verex.build.

This policy covers website visitors, people who contact us or book a demonstration, demonstration participants, and business contacts we communicate with about verEx. It covers people who use the public pages of the application: the Start page, the program page and the links in our emails. It also covers the businesses that use the verEx application ("customers"), the people in their teams who sign in, the subcontractors and suppliers they give a login to, subcontractors and suppliers that join verEx with their own profile, and people whose details a customer records in its workspace, such as a subcontractor's contact.

Demonstrations and illustrations on this website use sample information. Booking a demonstration does not create a workspace or authorise us to share your details with anyone.

The booking form asks for your full name, business name and email address, with an optional phone number. We also receive your selected appointment time and the page address. Booking records include the calendar event, meeting link and confirmation correspondence.

If you contact us or attend a demonstration, we may also hold the messages, business contact details, workflow requirements, feedback and discussion notes you provide. Please share only information you are authorised to disclose. Our website forms do not ask for identity documents, bank details, credit reports, health information or live project documents.

For each person who signs in we hold their name, email address, phone number where they gave one, position at their company where they gave one (optional, and asked only when an admin adds them or on an older form), access role and workspace, a record of the changes they make, how they sign in, and when they last opened verEx and on how many days. A person signs in with a password, with their Google account, or with a link we email them. For a password we hold only a one-way scrambled form of it, never the password itself. For Google we hold Google's identifier for the account instead, and such an account may have no verEx password at all.

Customers put their own business information into their workspace: entities, companies, projects, construction programs, packages, budgets, costs, variations, progress claims, quotes, tenders, planning approvals, uploaded feasibility and bill of quantities versions, and subcontractor and supplier details such as business names, ABNs, GST status and contact details, and, where a subcontractor or supplier signs itself up through the customer's sign-up link or the customer engages it from its verEx profile, what it provides, where it works or delivers, its specialisation and crew size, the outcome of the customer's review, and the customer team's performance reviews of it. We call all of this "your workspace content". The customer decides what goes in it and who in its team can see it.

verEx does not ask for, keep or check insurance or licence details for any business. A customer checks those itself when it engages a business.

The Start page at app.verex.build/start lets a developer, principal contractor, subcontractor or supplier join verEx. It asks which best describes you, then your full name, the email you will sign in with, and, if you choose, your company or business name and a phone number. We use these to open and run your workspace or profile, to contact you about it, and, for a customer, to bill its company if it subscribes. A client's phone number, when given, is kept on the account; a subcontractor's or supplier's in its profile. The Start page also records which link or advertisement brought you, as a short tag read from the link, and, when you arrive from an advertisement on Facebook or Instagram, the advertisement's click identifier, so that we can measure where sign-ups come from.

The workspace or profile opens the moment the form is sent: you are signed in on the browser you used, and, unless that address has asked us to stop emailing it, a welcome email carries a link, which works once within 7 days, that signs you in on any device with one tap and confirms your email. You can choose a password instead. The address counts as confirmed once that link, a sign-in link, a password reset link or a Google sign-in has been used; until then the application shows you the address we hold and lets you send the welcome email again, ask for a sign-in link or correct the address. A developer or principal contractor can instead continue with Google, in which case the address Google vouches for must be the email typed. Nobody at verEx reviews or confirms anything before you can use it. When a form is accepted from an email that has no account, verEx also emails its own operators the name, business, email, phone (if given), the tag and the time, as a record of the sign-up. We name the company as you typed it, or after you, and the first project "First project"; you add the legal entity, the company's legal name, its ABN and GST registration inside verEx.

The person who starts a workspace is its first admin. verEx keeps a register of the businesses on verEx by ABN, so that an ABN has one workspace and one subcontractor profile. When an ABN is entered or checked in the application, verEx sends it to the Australian Business Register's ABN Lookup and keeps the public record it returns (legal and business names, entity type, ABN status, state and postcode, and GST registration) with the company, subcontractor or profile. An ABN or ACN is a public business identifier; where the business is a sole trader, it identifies that person, and we treat it as their personal information. Checking an ABN also shows whether that ABN already has a verEx workspace or a subcontractor profile and since when; someone whose ABN already has a workspace is told to sign in to it instead.

Subcontractors and suppliers on verEx: a business that chooses Subcontractor or supplier on the Start page joins verEx with its own profile rather than a workspace. The profile is named after the business, or after the contact until a business name is given, and starts with no ABN and no services. From its own page the business adds its ABN, which verEx checks with the ABN Lookup as above (the business confirms the legal name the register gives before anything is saved, and an ABN can be on one profile only), and says what it provides: whether it is a subcontractor or a supplier, its main trade or supply and others, its specialisation, the postcodes it works in or delivers to and, for a subcontractor, its crew size. The profile is the business's own information on verEx, not any customer's workspace content, and it opens at once. A builder that looks up the business's ABN in verEx sees that it is on verEx, with its business and legal names, entity type, state and postcode, what it provides and where, its specialisation and crew size, and can engage it, which then waits for that builder's own review of the details, since a profile proves an email address, not who holds the ABN; the builder does not see the contact name, email or phone number until then. When a builder engages the business, or the business joins the builder through its sign-up link or invitation, a copy of the profile, including those details, goes into that builder's workspace and becomes part of that customer's workspace content, which the customer controls. The business's login then works with each builder that has engaged it, and shows it which builders those are. When the business changes what it provides on its own page, the change goes to its profile and to the copies each builder holds.

A customer's sign-up link: an admin can share a link through which a subcontractor or supplier signs itself up with that customer. The page names the customer's company and asks whether the business is a subcontractor or a supplier, its ABN (checked with the ABN Lookup as above) or, for a business outside Australia, its legal name, country and registration, its business name, what it provides and where, its specialisation and crew size, a contact name, email and phone, and, if the business chooses, a password. The sign-up goes into that customer's workspace as a subcontractor or supplier awaiting the customer's review. Its login opens at once, on a page that shows only the customer's company name and the details it gave, and nothing of the customer's work. The customer's approval decides whether it can be invited to quote, awarded a package or lodge anything. A customer that rejects it blocks it with that customer alone and can review it again; the login stays open and shows none of that customer's work. The email is confirmed later, by a sign-in link, a password reset link or a Google sign-in.

Signing in with Google: Google tells us your email address, your name and its own identifier for your account, and confirms that the email is yours. We keep the identifier so we recognise you next time, and we accept only an email Google has verified. We never see your Google password, mail, files or contacts. Google learns that you signed in to verEx, under its own privacy policy. While a sign-in is in progress, a second cookie ties it to your browser for up to ten minutes and is then discarded. If an address was first used to sign up through a customer's link and Google later vouches for it, the password chosen at that sign-up stops working and its other sessions end, so the account belongs to the holder of the address alone.

Email links: we email welcome links, sign-in links, password reset links and the other emails described in this policy through our Google Workspace. A welcome link works once, within 7 days; a sign-in link or a password reset link works once, for 30 minutes. A welcome link signs you in with one tap, and so does a sign-in link for an account with no password; an account with a password gets a password reset link instead. If the email was not confirmed yet, the tap confirms it, signs the account out everywhere else and clears any password chosen before. We keep only a scrambled form of each link's code. Setting a new password from a reset link signs the account out everywhere else, and signs in the browser that used it if the login is open. We answer a request the same way whether or not an account exists for the email.

The program page: at app.verex.build/program a developer or principal contractor can ask for a draft construction program without an account. The page asks which best describes you, your name and email, optionally your company and project name, the development's facts (such as its type, location, size and planned start) and, if you choose, one file: a feasibility, bill of quantities or similar document as a PDF, image, spreadsheet or text file of up to 8 MB. We keep the request to reply to you; the file is kept for 30 days and then removed, while the request, its facts and the draft stay as our business record. The development's facts and the file, without your contact details, are sent to Anthropic's Claude model to draft the program (see section 10). We email you a link that reopens your draft, and, if you then start a workspace from it, the facts and the draft become your first project.

Registered interest: a short form on the program page takes which best describes you, your name and email, optionally your company and a line about what you are running. We keep it to reply to you and to follow up, and we send you a confirmation.

Inviting subcontractors: an admin can enter subcontractors' email addresses to send them the company's sign-up link. We use each address only to send that one invitation, which names the admin's company, through Google Apps Script from our Google Workspace. verEx does not store the addresses, and the workspace's activity records only how many invitations were sent; a copy of each sent email stays in our Google Workspace like any email we send.

Emails about your work on verEx: if a new workspace from the Start page has saved no program, we email its first admin up to two notes, about a day and about five days after sign-up. After its first program is saved we may email that admin that it is saved and, while it has no card, up to two reminders of what opens with one. When a business waits for approval we email the first admin, naming nobody. When a customer approves a business or invites it to quote, we email that business's own login, naming the customer, never the contact email the customer keeps on its record. Each of these says how to stop them: reply with the word stop. Once we have recorded a stop for an address, none of these goes to it, and neither does the welcome email, an invitation to sign up, a new link sent by us, the notice that a workspace is read-only or our replies to the interest and program pages, even when someone asks for them, since anyone can type an address. The sign-up or request still goes ahead. Sign-in links, password reset links, the email saying a business is admitted, and the notices that free time is ending or a payment failed still go.

Paying for verEx: Stripe handles subscriptions and payments once a customer adds a card. When an admin subscribes, verEx creates a customer in Stripe with the business name, the admin's email address and the workspace's identifier, and Stripe's own checkout page asks for the card, the billing address and the ABN. Card details go straight to Stripe and never reach verEx's servers. verEx keeps Stripe's identifiers for the customer and the subscription, the plan chosen, the subscription's status, its billing period and any period before billing starts, and Stripe tells verEx when the subscription changes. Invoices, receipts and the billing portal come from Stripe. Stripe is based in the United States and holds this information under its own privacy policy.

We treat your workspace content as your confidential business information. We do not sell, rent or trade it. We do not share it with your competitors, other customers, advertisers or data brokers, or with builders, suppliers, brokers, lenders or anyone else for their own purposes.

Each customer company has its own separate workspace, and the application limits every request to the signed-in person's workspace. Other customers cannot see your workspace. A subcontractor's or supplier's profile is that business's own information, and is shown to builders only as described in section 5. A subcontractor or supplier you give a login sees only what concerns it: the packages you invite it to quote for, and its own quotes, claims and variations. One that signs itself up through your sign-up link can sign in at once. Until you approve it, it sees only your company's name and the details it gave. If you reject it, it keeps its login, sees none of your work, and you can review it again.

Our own access is limited. Our administration tools show customer workspaces by name, size and subscription status; when each client and each subcontractor or supplier profile last used verEx and on how many days; for each client, how many projects it has, how many have a program and how many packages they hold, with the dates its first program was saved and its projects last changed; how many businesses came in through clients' sign-up links, and when; which addresses we have stopped emailing; the details each sign-up gave on the Start page with whether its email is confirmed; the ABN Lookup's record; the program requests and registered interest described in section 5; the feedback described in section 7; and counts of how the application is used. They never show a workspace's contents: no project or package name, site address, amount or person's name, beyond what the sign-up itself gave and the name on a piece of feedback. A program request stays there as it was sent, even if it became that customer's first project. We access your workspace content only where needed to give you support you ask for, to keep the service secure and working (including making and restoring backups), or where the law requires it.

We do not use your workspace content to market to anyone else. Emails and pages for your own workspace may mention it, such as how many packages your program holds or who waits for your approval, including where they ask you to add a card. We never contact the subcontractors or other people in your workspace to market to them. We do email a business that has a login when you approve it or invite it to quote, as section 5 says.

We use application information to provide the service, sign people in, keep workspaces separate and secure, prevent misuse, investigate problems, and give support.

We also use it to optimise our product and service. For this we look at how the service is used, such as which features are used, where errors happen and how quickly pages respond, and we may analyse information in a de-identified and combined form across workspaces. Nothing we publish, share or show to anyone else from this work will identify you, your company, your projects or your subcontractors. If we would like to use identifiable information in a new way, such as a case study, we will ask you first.

Feedback: anyone signed in can send us feedback from the Feedback item in the application. We keep each message with your name, your workspace or profile, the page you were on and whether you said we may email you about it, outside every workspace, so that suggestions are logged for feature improvements; our operators read it, an email with a short excerpt goes to them, and the application shows you each item's status. We use it only to improve verEx and, where you allowed it, to reply.

We use personal information to respond to enquiries, arrange and deliver demonstrations, send confirmations and calendar invitations, manage appointment changes, and follow up on the matters you discuss with us. Feedback helps us understand project delivery needs and develop the product.

We also use relevant records to administer business communications, prevent spam and booking abuse, maintain website security, investigate problems, deal with privacy requests and complaints, and meet applicable legal obligations.

A demonstration request, a Start page form, a program request or registered interest is an enquiry to verEx. We do not distribute these to builders, suppliers, brokers or lenders for their own marketing.

We record or transcribe a demonstration only with the permission of everyone attending. Before starting, we will explain the recording or transcription tool, what it captures and how we will use the result. You can decline and still take part in an unrecorded demonstration.

An agreed recording or transcript may include your voice, image, name, comments, chat messages and information you choose to show on screen. We use it to prepare accurate notes, review the discussion and follow up. We limit access to the people and service providers needed for those purposes. Contact us to request access, correction or deletion.

DigitalOcean hosts the verEx application and its backups on servers in Sydney, Australia.

The Australian Business Register's ABN Lookup receives each ABN entered or checked in the application (by a customer's team, by a subcontractor or supplier on its own page, or on a customer's sign-up link), and the public record it returns is kept with the subcontractor, the company or the profile.

Google acts as a sign-in provider for people who choose to continue with their Google account. Stripe processes subscription payments, as described in section 5. Every email the application sends (welcome, sign-in and password reset links, the program draft link, the confirmation that a business is on verEx, the notes about drafting a first program and what opens with a card, the notes about businesses waiting, approved or invited to quote, the notices to our operators that a form was sent or feedback arrived, invitations, and the emails about a subscription) is sent through Google Apps Script from our Google Workspace, and a copy of each is filed in our Workspace mailbox. From the date of this policy, the copy of an email to you that carries a link with a code in it (a welcome, sign-in, password reset, program draft or invitation link) has the link left out, and the email as sent goes to that mailbox's trash.

Meta (which runs Facebook and Instagram) is told from our server, never from your browser, when a Start page form, program request or registered interest is accepted from an email that has no account ("Lead"), when a sign-up's email is confirmed ("CompleteRegistration"), when a workspace first subscribes through Stripe ("StartTrial") and at its first payment, with the amount and currency ("Subscribe"). Each event carries your name, email and phone number in hashed form (SHA-256, which Meta can match against its own accounts but cannot read back), your IP address and browser, the page address, and the advertisement's click identifier where you arrived from an advertisement on Facebook or Instagram. Meta is also told, with no name, email or phone number, when the Start page or the program page is opened ("ViewContent") and when someone begins the form on either page ("FormStarted"); those two events carry only your IP address and browser, the page address and the click identifier. We do this so that our advertising on Facebook and Instagram can be measured and shown to businesses like yours. Meta uses these events under its own terms. The notice on the Start page and the program page says so where the details are asked for.

Anthropic provides the model that drafts a construction program, on the program page and, when an admin chooses the assistant, in the application. On the program page, the development's facts you type, and the file you upload, are sent to Anthropic's API; your name, email, phone and company are not. In the application, the project's name, type, location, dates, budget and contract value, the answers the admin gives and any bill of quantities section names and totals are sent to Anthropic's API; verEx does not add your name, email, phone or company, or the subcontractors and suppliers in your workspace. Anthropic handles what it receives under its own terms and does not train its models on it. On the program page, the draft comes back to verEx and is kept with your request. In the application, it comes back for the admin to edit and is kept only if they save it.

Google services support our email, business records, scheduling and online meetings. Related records may be held in Google Sheets and Gmail. Bookings use Google Apps Script, Calendar, Gmail and Meet to create appointments and send meeting information.

Lovable hosts this website and provides operational logs, error reporting and visitor analytics. Recording or transcription providers may process meeting content when attendees have agreed to their use.

Our booking alert service sends our team a short internal SMS containing the booker's name, company and appointment time through our SMS provider. The SMS does not include the booker's email address, phone number or discussion notes.

These providers handle information only to provide their service to us. We may also disclose information to a professional adviser where needed to address a matter involving us, or where disclosure is required or authorised by law. If the verEx business is ever sold or restructured, customer information may pass to the new operator, who must keep to the confidentiality commitments in this policy. If a separate introduction or project collaboration involves sharing your information with another business, we will explain that arrangement and seek any required permission first.

Lovable visitor analytics provides information about website visits, pages viewed, traffic sources, visit duration, device types and approximate country. Hosting and error-reporting services may also process IP addresses, request times, page addresses and technical error details to operate and maintain the website and the application.

The site loads fonts from Google, which receives the technical information needed to deliver them, such as your IP address and browser request details.

The verEx application uses one cookie to keep you signed in, a second one for up to ten minutes while you sign in with Google, and no advertising or tracking cookies; there is no Meta pixel on this website or in the application, and what Meta is told is described in section 10. Stripe's checkout and billing pages set Stripe's own cookies. The application counts failed sign-in attempts by visitor address and email to block password guessing, and limits how many forms one visitor can send.

The application counts how it is used, as counts only: each step a visitor reaches on the Start page, the sign-in page, the program page and a customer's sign-up link page, and the steps a new workspace takes towards a program and a subscription, such as opening the program builder, the Invite page or the card page, by day and by the tag on the link that brought them. Many links in our emails go through app.verex.build/go, which counts that the link was opened and, from the page's script, whether it was opened by a person in Australia or by an automated mail scanner, by day and tag, and then sends you on to the page the email is about. That page sets no cookie, reads no account and keeps nothing about you; your browser's time zone and whether it reports itself as automated are used only to choose which count to add to and are not kept.

Both the website and the application use your browser's local storage for small conveniences, such as cached appointment times and the entity you last viewed. The application also keeps there the tag and advertisement click identifier of the link that brought you, which it uses for 28 days; a mark of each step already counted that day, so that a device counts once; and your email address, with the entity you last viewed and, while you are signed in, with when you last opened the application, so that a browser signed out from elsewhere can say why. You can clear these through your browser settings.

For relevant business communications, we may collect your name, role, company and work contact details from you, your organisation's website, professional directories or public registers. We use these details to discuss verEx and project delivery needs.

Our commercial emails identify us and provide a way to unsubscribe. You can also reply to a commercial email to ask us to stop marketing contact. We action unsubscribe requests within five business days and retain only the details needed to respect your preference. Essential correspondence about an existing booking, account or privacy request may still be sent.

You can browse the public website without completing a form. If you choose not to provide required booking details, we may be unable to respond or arrange a demonstration. The phone field is optional on the booking form and on the Start page.

The verEx application and its data are stored in Sydney, Australia. Connections are encrypted, passwords are stored only in scrambled form, repeated failed sign-ins are blocked, the server is protected by a firewall, and the application keeps each customer's workspace separate. The database is backed up every night, and those copies are kept for 14 days. A safety copy taken just before an upgrade changes stored data is kept for 90 days. Both sit alongside our hosting provider's daily backups of the server.

Business communications and booking records are held in Google Workspace and with the other service providers described in this policy. Those providers, including Stripe, Google, Meta and Anthropic, operate internationally, so that information may be stored or processed outside Australia, including in the United States; Lovable also operates from Sweden. Their privacy policies explain their international processing arrangements.

We keep workspace content for as long as you use verEx. Admins can export an entity's data at any time, and we will provide an export on request. Stripe keeps billing records for as long as its own rules and tax law require. When a customer leaves and asks us to, we delete its workspace from the live service; copies then drop out of backups as those expire, after about 14 days for the nightly copies and about 90 days for the safety copies, and on our hosting provider's own schedule for its backups. A workspace or profile we remove, at its owner's request or for misuse, goes from the live service with the login it made, so its ABN and email are free to apply again. We keep a note that it was removed, by its record number; where we declined an application or released an ABN, the note also names the business and its ABN, and for a declined application its email. If you asked us to stop emailing you, your address stays on our stop list, with the date and any note we made, so that it stays stopped. Feedback you sent stays in our own list, no longer linked to a name or an account. Earlier lines in our own activity log, such as a new link we sent you, can still name you or your business. Copies of emails already sent stay in our mailbox, Stripe keeps its own records, and what Meta was told stays with Meta. We keep a subcontractor's or supplier's profile while it uses verEx, and delete it when it asks us to; copies already engaged into a builder's workspace are that customer's workspace content and stay until that customer removes them.

A workspace or profile opened from the Start page stays until you ask us to remove it, even if its email is never confirmed; ask us the way section 14 says. A file uploaded on the program page is removed after 30 days; the request, its facts and the draft stay as our business record, as does registered interest, until we no longer need them to follow up or keep business records. The copies of the emails the application sends, including the alert that a form was sent, stay in our Google Workspace mailbox like our other business correspondence, and from the date of this policy any link that has a code in it is left out. Each copy holds what its email says. The emails about a program or about businesses waiting give counts, and name no project, package or waiting business. The copy of an email telling a business it is approved or invited to quote names the customer and shows that business's email address and its contact's first name, and names no project or package. The usage counts described in section 11 hold no personal information. When a login last opened verEx and on how many days is kept with the login, and goes when we delete the login. Other personal information is kept for as long as it is needed to respond to you, manage bookings and follow-up, keep business records, address complaints or meet legal obligations, and is then deleted or de-identified.

If a data breach is likely to cause serious harm to anyone, we will tell the customers and people affected and notify the Office of the Australian Information Commissioner as the law requires.

Admins can view, correct and export their workspace content in the application at any time. A subcontractor or supplier can see and change its own profile on its own page. For anything else, write to james@verex.build about access to, correction of or deletion of your personal information. We will record your request and follow up in writing. We may need to confirm your identity before acting. We respond within 30 days and do not charge for these requests. If information must be retained or a request cannot be met, we will explain why. If your details are in a customer's workspace, we may refer your request to that customer, which controls that information. A subcontractor or supplier can ask us to correct or delete its own profile the same way. A business that finds its ABN was onboarded on verEx by someone else can contact us the same way; we remove that profile and its login, and builders' own records of it stay in their workspaces.

We handle personal information in line with the Australian Privacy Principles. If you have a privacy complaint, contact us the same way so we can record the details, investigate and respond in writing. If you are not satisfied with our response, or have not received one within a reasonable time, you can contact the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

We update this page when our information-handling practices change and show the effective date below the heading. Before we change how we use workspace content, or connect a new outside service to the application, we will update this policy and tell customers first, and obtain any consent required.