Privacy Policy

This policy explains how BreathWise ("BreathWise", "we", "us"), based in Perth, Western Australia, handles personal information when you visit breathwise.com.au, contact us, or use the BreathWise web app (app.breathwise.com.au) and mobile app. We follow the Australian Privacy Principles (APPs) in how we collect, use, disclose, store and protect personal information.

Who is responsible for your information

BreathWise is software. Our customers are property managers and hosts running short term rentals, and each customer works in its own organisation inside BreathWise.

For the information a customer puts into BreathWise about its team, its property owners and its guests, the customer decides what is collected and why, and we handle it on the customer's behalf to provide the service. If you are a cleaner, a team member, a property owner or a guest of one of our customers, please contact that business first about your information. We will help them respond.

We are responsible for the information we collect for our own purposes: visits to our website, enquiries, sign-up and billing, support, and keeping the service secure.

What we collect

On our website

• Contact form: your name, email, number of properties and message, plus the plan you were looking at, the page and language you sent it from, campaign tags in the link (such as utm_source), the page that referred you and your browser's user agent.
• Analytics: Google Analytics records the pages you view and how you move around the site, using cookies.
• Spam protection: Google reCAPTCHA checks signals such as your IP address and browser when you send the contact form.

Your account

• Name, email, phone number, profile photo if you add one, your role (admin, manager, cleaner or viewer), the organisations you belong to, and your language and notification preferences.
• Your password is handled by our authentication provider, Supabase. We never see it in plain text. If you choose Sign in with Google, we receive your name, email address and Google account identifier from Google.
• When you register, the date and the version of the terms you accepted. Sign-up is protected by Cloudflare Turnstile, which checks signals from your browser to tell people from bots.

Organisations and properties

• Organisation details: name, billing address, ABN, currency and settings.
• Property details: address and map coordinates, photos, documents, cleaning schedules and instructions. Coordinates are looked up from the address with the OpenStreetMap Nominatim geocoding service.
• Property owner details: name, email, phone and address, used to send owner reports.
• Guest and access information: Wi-Fi name and password, door or lockbox codes, check-in and check-out instructions, parking, house rules and an emergency contact phone. Door codes are encrypted before they are stored.

Bookings from connected calendars

When an organisation adds a booking calendar link (iCal) from Airbnb, Booking.com or another platform, BreathWise reads it about every hour. We store the booking dates and whatever the platform includes in each calendar entry, which can include the guest's name and booking notes. A cleaning task created from a booking keeps the guest's name and those notes as part of the task.

Day to day operations

• Tasks and their history: offers, acceptances, assignments, status changes, start and finish times, pauses, checklists, quality checks, comments, incidents and maintenance reports.
• Photos taken as evidence of the work, and other photos and files. Photos uploaded through the BreathWise apps (task evidence, property photos, and images in chat and support requests) are re-encoded on our servers when they are uploaded, which removes embedded metadata such as the camera's GPS position. Documents and other files, such as PDFs, are stored as they were uploaded, including any metadata they contain.
• Cleaner availability and time off.
• Internal chat messages and attachments between members of an organisation.
• Task reports. A manager can share a task report through a link. The link contains a long random code and works without signing in, so anyone who has it can view the report, including its photos. A link stops working after the number of days the organisation sets (90 days unless it changes this), and a manager can revoke it, or replace it with a new link, at any time. A property owner can leave a comment on a shared report, and that comment is stored with the task.

Cleaner location in the mobile app

When a cleaner opens a task in the BreathWise mobile app, the app asks for permission to use the phone's location. While that task screen is open, the app compares the phone's position with the property to show whether the cleaner is at the property. When the cleaner starts the task, the location at that moment (coordinates and distance from the property) is saved with the task, so the organisation can confirm the job was started on site. The app does not use location in the background and does not track cleaners between tasks. A cleaner can refuse the permission and still start the task. The map in the app can show your position on your phone; that position is not sent to BreathWise.

Invoices, rates and payments

• Cleaners' hourly rates, invoices, penalties applied for late cancellations, and payments the organisation records.
• Cleaners' details for invoicing: billing address, ABN, and bank account name, BSB and account number.
• If the organisation connects Xero (Pro plan), approved cleaner invoices are sent to Xero as bills, and their payment status comes back from Xero.

Subscription billing

The customer's plan, subscription status and billing history. Card details are collected and stored by Stripe. We do not see or store full card numbers.

Notifications

We send emails (for example invitations, task updates, owner reports, password resets and billing notices) and push notifications to the mobile app. For push notifications we store the push token that Expo issues for your device. If an organisation connects its own WhatsApp Business account, owner reports can also be sent by WhatsApp to the owner's phone number. WhatsApp is used only for owner reports: BreathWise does not message guests.

AI features (Pro plan)

The AI features are optional. They only work when an organisation connects an account with an AI provider of its choice (Anthropic, OpenAI, xAI or DeepSeek), or its own Ollama server, and they run under that organisation's account and the provider's terms.

• AI assistant: admins, managers and viewers can ask it questions in the app. BreathWise sends the provider the question, the earlier messages in that conversation, and the results of the lookups the assistant runs to answer it.
• Depending on the question, those results can include: tasks (dates, status, property names, cancellation reasons, task offers and the notes cleaners add when they answer them); team members' names (not their email address or phone number); cleaners' availability, time off and its reason, performance figures and hourly rates; and property names and addresses. Guests' names and booking notes are not included.
• Only when an admin or manager is asking: invoice totals, payments, penalties and costs per property, and a property's guest information (Wi-Fi network name, check-in and check-out instructions, parking, house rules and emergency contact). The Wi-Fi password and door or lockbox codes are never sent to the AI provider.
• The assistant does not send cleaners' bank details or billing addresses, the location recorded when a task starts, photos or chat messages.
• Owner comments: if the organisation has connected a provider, a comment a property owner leaves on a shared report is sent to it, with the property name and the task title, to draft a reply. Drafts are never posted on their own: staff approve, edit or discard them.
• We store the provider's API key encrypted, and the conversation history so it can be continued. You can clear your history at any time.
• MCP: an organisation can also create access tokens to connect compatible AI tools (such as Claude Desktop or ChatGPT) through MCP. A connected tool can read the same kinds of information as the assistant, including financial information but not a property's guest and access information, and that information is then handled by the tool's provider under the organisation's arrangement with them. We store only a hashed form of each token. Every token expires 90 days after it is created (tokens created before we introduced expiry were given at least 30 more days), and an admin or manager can revoke any token at any time.

What BreathWise does: we send the provider the information described above and nothing else, we do not use your organisation's information to train AI models, and we do not ask the provider to. What the provider does: whether it keeps the information, for how long, and whether it may use it to improve or train its models is set by that provider's terms and by the settings of your organisation's account with it, not by us. Check them before you connect a provider.

Support

Support requests, their attachments and our replies by email. To solve a problem, authorised BreathWise staff can look at an organisation's account in our internal support tools, or view the app as one of its users in a read-only mode. Each time staff view the app as a user, and each change staff make to an account, is recorded in an internal log. Looking up information in the support tools is limited to authorised staff, but each look-up is not recorded individually.

Usage, security and error information

• Activity events: the name of an action and when it happened, such as signing in, creating or completing a task, adding a property or opening an onboarding step. Not what you type.
• An audit log of security relevant actions, such as sign-ins, role changes, data exports and account deletions.
• Server logs and error reports. We use Sentry to find and fix errors in the web app and the backend. Error reports carry the user's ID, role and organisation. They are set up to leave out the user's email address and IP address, cookies and authorisation headers, and our servers filter out fields that look like email addresses, phone numbers, passwords, tokens or bank details from the extra information they attach. An error message or a page address can still contain personal information, so these filters reduce personal information in error reports but cannot rule it out. In the web app, Sentry can also record a replay of about 1% of sessions and of sessions where an error happens, with on-screen text and what you type masked and images and media blocked.

How we use it

• To provide BreathWise: import bookings, create, offer and assign tasks, run checklists, send notifications and owner reports, prepare invoices, and run the integrations an organisation turns on.
• To take subscription payments and manage plans.
• To give support and answer enquiries.
• To keep the service secure, prevent spam, fraud and abuse, and limit requests that look automated.
• To understand which features are used, fix errors and improve the product.
• To meet our legal obligations.

We do not sell personal information, we do not use it for advertising, and we do not use the information in your organisation to train AI models.

Who we share it with

We share personal information only with the providers that help us run BreathWise, and only what each one needs. Some are always in use; others only come in when a customer turns the feature on.

The booking platforms whose calendar links a customer adds (such as Airbnb or Booking.com) are where those bookings come from; BreathWise reads the links but sends nothing back to them. We may also disclose information when the law requires it, or when it is needed to protect someone's rights or safety.

Information handled outside Australia

Our main database and file storage (Supabase) are hosted in Sydney, Australia. In line with APP 8, this section tells you which providers store or process personal information outside Australia, and where. The locations are those the providers publish, and the regions we have chosen where a provider lets us choose.

• Railway (application servers, which handle requests between the apps and the database): in a Railway region outside Australia. Railway's regions are in the United States, the Netherlands and Singapore.
• Vercel (this website, its contact form and the web app): pages are served from Vercel's global network, usually from its Sydney location for visitors in Australia; Vercel is based in the United States and processes request data there.
• United States: Stripe (payments), Resend (email), Sentry (error reports), Slack (internal alerts), Expo (push notifications, delivered through Apple and Google) and Xero (only if a customer connects it).
• Google (analytics, reCAPTCHA, Sign in with Google, Android maps), Apple (iOS maps), Cloudflare (Turnstile) and Meta (WhatsApp, only if a customer connects it): in the United States and in the other countries where they run their networks and data centres.
• OpenStreetMap Nominatim, which receives property addresses: run by the OpenStreetMap Foundation from servers in Europe.
• AI providers, only when a customer chooses and connects one: Anthropic, OpenAI and xAI in the United States; DeepSeek in China; an Ollama server wherever the customer hosts it.

Before we disclose personal information to a provider outside Australia, we take reasonable steps to make sure it handles that information consistently with the APPs, for example by choosing providers that commit by contract to protect the information they handle, and we only give them what they need. The laws of those countries may not protect personal information in the same way as Australian law. AI providers and the WhatsApp and Xero accounts are chosen and connected by the customer, under the customer's own arrangement with them.

How long we keep it

When a user account is deleted, the records it took part in still belong to the organisation and are no longer linked to that person's profile, but they are not fully anonymised: names can remain inside the content itself, for example in task comments (which keep the name of the person who wrote them), chat messages, photos, invoices already issued or sent to Xero, and reports already shared.

Deletion from our live systems and the deletion of backups happen at different times. When we delete information, it is removed from the live database and storage straight away (or at the end of the period shown above), but copies can stay in our backups until those backups expire, up to 90 days later. We do not use backups for anything other than recovering the service. If we ever have to restore a backup, we delete again any information that had already been deleted before it is used.

We may keep some records longer when the law requires it, for example for tax. Our providers keep their own records, such as payment records at Stripe, under their own policies.

How we protect it

• Connections to the website, the apps and our servers are encrypted (HTTPS).
• Each organisation's data is kept apart by database access rules and by checks in our servers.
• Passwords are handled by Supabase Auth, and web sessions use secure, HttpOnly cookies.
• Door codes, AI provider keys and WhatsApp access tokens are encrypted before they are stored (AES-256-GCM). MCP access tokens are stored only in hashed form.
• Sign-in and other requests are rate limited. Security relevant actions are logged, and so are BreathWise staff viewing the app as a user and any change staff make to an account.

No system is completely secure, so we cannot guarantee absolute security. If a data breach is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner.

Cookies and similar technologies

• Website: Google Analytics sets cookies to count visits and see which pages are useful, and Google reCAPTCHA runs on the contact form. The site also remembers the plan you picked for the length of your visit (session storage). You can block or delete cookies in your browser, or use Google's Analytics opt-out add-on, and the site still works.
• Web app: we use essential cookies to keep you signed in, and your browser's local storage for preferences such as table columns. The app has no advertising or analytics cookies. Sign in with Google and Cloudflare Turnstile may use their own cookies when you use them.

Your choices and rights

• Access and correction: you can update your profile in the app, or ask us for a copy of the personal information we hold about you, including in a machine-readable format.
• Export: an organisation's admin can ask us for an export of its data while the account is active, and up to 90 days after cancelling.
• Deletion: cleaners can delete their own account from the settings of the mobile app. Other users can ask an admin of their organisation or email us. An organisation's admin can ask us to delete the organisation.
• Location: you can refuse or withdraw location permission in your phone's settings.
• Notifications: you can choose which notifications you receive in the app's notification settings, and turn off push notifications on your phone. We still send emails that are essential to the service, such as password resets.
• Complaints: email us and we will reply within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

We may need to confirm your identity before acting on a request. If your request concerns information that one of our customers controls, we will pass it to that customer and help them respond.

Children

BreathWise is a business tool for people aged 18 or over. We do not knowingly collect information from children, other than what a customer may record about guests in a booking.

Changes to this policy

We may update this policy when the service or the law changes. The date at the top shows when it last changed. We will tell account holders about any change by email or in the app at least 30 days before it takes effect.

Languages

This policy is published in English and Spanish. If the two versions differ, the English version prevails.

Contact us

Questions or requests about privacy: email hello@breathwise.com.au. BreathWise, Perth, Western Australia. Postal address: 11 Snowberry Retreat, Mirrabooka WA 6061, Australia.