How JobLok handles information

JobLok is operated by Michael Ferguson in Australia. For a privacy question, access or correction request, or complaint, email michael.g.ferguson@gmail.com. If you used a Business's public work-enquiry link, you may also contact that Business about the copy it controls.

JobLok stores account and Business details, billing and support correspondence, customer contact details and addresses, work enquiries, Site Visit notes, voice recordings and transcripts, photos, sketches, measurements, quote and job records, completion evidence, integration references, and security history. Information comes from account holders, invited team members, people submitting a public enquiry, connected services used at a Business owner's direction, and service/security logs. A public work enquiry is provided to the Business whose enquiry link you used.

This information is used to capture and understand site work, prepare reviewed work records and quote drafts, organise jobs, secure accounts, investigate faults, and create an accounting draft when a Business owner deliberately connects Xero.

JobLok is likely to disclose or make information available to overseas service providers as described below. Provider infrastructure and support access can involve other countries, so the list is the current practicable description rather than a promise that processing never occurs elsewhere.

• Supabase hosts sign-in, Business records and private media in Seoul, South Korea for the current project.
• Vercel hosts the application. Current production functions run in Washington, D.C., USA, and provider systems may process operational data globally.
• OpenAI processes in the United States and other locations only the evidence needed for a requested transcription, Draft Review, or material suggestion. Requests are made securely from JobLok.
• Xero receives a customer contact and quote details only when a Business owner connects a Xero organisation and creates a draft. Xero maintains that independent record under its own locations and terms.

JobLok removes known customer names, contact details and site addresses from text immediately before structured AI requests, and asks OpenAI not to store Responses API application state. Free-form evidence and sketches can still contain personal information. OpenAI states that API data is not used to train its models unless the account opts in. Under OpenAI’s default controls, abuse-monitoring data may be retained for up to 30 days, and prompt-caching infrastructure can retain derived cache data temporarily. The transcription endpoint does not retain application state under OpenAI’s current endpoint policy. JobLok has not verified approval for OpenAI Zero Data Retention or Modified Abuse Monitoring.

Business records and evidence remain in JobLok until an authorised change or whole-Business closure. A Business owner can schedule closure from Account: the preview remains cancellable for 72 hours, then a second exact confirmation permanently removes private media, Business records, the Xero connection and team access for people who belong to no other Business. Removed evidence cannot be recovered after final cleanup starts.

A limited security history and the completed closure record are retained for at least 365 days and currently have no automatic deletion date. Pending uploads remain on the capture device until upload succeeds or browser site data is cleared. OpenAI abuse-monitoring records may outlast deletion in JobLok for the period above. A Xero contact or quote is a separate record in Xero and must be managed there.

People with active access to the relevant Business can see records allowed by their access level. A Business owner can correct ordinary Business records and download complete JSON, a ZIP of spreadsheet-friendly CSV files, and numbered private-media downloads from Account. Sign-in and Xero connection details are excluded. Limits are six exports per hour, 50,000 records per section, and media downloads of up to 40 files and about 40 MB; contact JobLok support for a larger export or a paused closure retry.

An individual may use the contact above to request access to or correction of their personal information, or make a privacy complaint. Include enough detail to locate the record but do not send passwords, payment credentials, private evidence, or unnecessary customer information by email. JobLok will acknowledge a complaint, investigate it fairly, request only necessary verification, and explain the outcome and any correction or refusal. If the response does not resolve an eligible complaint, the individual may contact the Office of the Australian Information Commissioner.

JobLok uses AI to transcribe or suggest structured work information, but an authorised person must review the result. JobLok does not use personal information to make solely automated decisions that determine access, price, employment, credit, legal rights, or another similarly significant outcome.

JobLok requires authentication for Business records, enforces Business separation in the database, keeps media private, uses short-lived media links, and keeps provider credentials on the server. No internet service can guarantee absolute security.

This notice is reviewed when providers, regions, data categories or product behaviour change. Material changes will be dated here. Customer use of the paid service is also governed by the JobLok service terms.