1. Information we collect
| Category | What it includes |
|---|---|
| Account information | Full name, company name, email address, account type, and login credentials, when you create a subscriber account. |
| Job and project information | Text you enter for a takeoff — job name, site address, client name, builder name, and any scope notes — plus the architectural/engineering plan documents you upload. |
| Payment information | Handled entirely by our payment processor, Stripe. We receive confirmation that a payment succeeded and a reference to it, but we do not receive or store your full card number. |
| Casual one-off purchases | The email address you provide at checkout and a unique access token used to retrieve your job — no account or password is created. |
| Support messages | Anything you send us through the "Message us" widget, including your name/email if provided. |
| Site usage data | Pages visited, time spent on a page, and your IP address, collected via a first-party analytics cookie (see section 5). |
| Accounting integration (Xero) | If you choose to connect your own Xero organisation, Xero issues us an access token and refresh token scoped to that specific connection, plus your connected organisation's name and ID. See section 4 for how this is used. |
2. How we use it
- To generate your reinforcing steel takeoff and related Outputs from your uploaded plans and job details;
- To create and manage your account, and to process subscription or one-off payments;
- To email you your quote or takeoff, or to send an automatic quote where your plan includes that feature;
- To push your own invoices into your own connected Xero organisation, and read back their payment status, where you've chosen to connect it (see section 4);
- To respond to support requests sent through the "Message us" widget;
- To understand how the site is used, so we can improve it, and to measure conversion from free tools/visits to paid use;
- To meet our legal, accounting, and tax obligations (including GST record-keeping).
3. Uploaded plans and job data
The plans and documents you upload are used solely to generate your takeoff and, where relevant, to provide customer support in connection with your job. Generating an Output involves the document being processed by a third-party AI service provider under contract to us, purely to extract the reinforcing steel information from it. We don't use your uploaded plans to train any third party's general-purpose AI models, and we don't sell or share your plans with anyone outside what's needed to provide the Service to you.
4. Accounting software integration (Xero)
If your plan includes it, you can connect your own Xero organisation to reoXapp so your invoices are pushed straight in, with their payment status read back automatically. This is entirely optional and off by default. Connecting is something you initiate and authorise yourself, directly through Xero's own login and consent screen — we never see or store your Xero password, and each subscriber's connection is kept completely separate: your invoices only ever go to the Xero organisation you personally authorised, never to any other subscriber's or to reo&Steel's own Xero organisation.
Once connected, we store the access and refresh tokens Xero issues for that specific connection (used to authenticate later requests without asking you to log in again), your connected organisation's name and ID, and, for each invoice you send, the Xero-assigned invoice reference so we can show its status and avoid sending it twice. Pushing an invoice sends your invoice's contact name, line items, amounts, dates, and delivery address (as the invoice's reference) to Xero; nothing else in your reoXapp account is shared with Xero. Once your data reaches Xero, it's also subject to Xero's own privacy policy.
You can disconnect at any time from your account's Invoices tab, or by removing reoXapp's access directly within Xero's own Connected Apps settings. Disconnecting stops any future sync but doesn't retract invoices already sent to Xero.
5. Cookies and similar technology
We use a first-party cookie to recognise repeat visits to certain pages (for example, to avoid double-counting a page view on reload) and to measure how long a visit lasts. This cookie doesn't identify you personally on its own — if you later create an account or sign in from the same browser, we may link that browsing history to your account so we can see which pages a subscriber visited before signing up. You can opt out of this tracking; contact us if you'd like the opt-out link. Signed-in sessions use a token stored in your browser's local storage rather than a cookie.
6. Who we disclose information to
- Payment processing — Stripe processes your payment details directly; we never see your full card number.
- Service providers — your uploaded plans and job data are processed by third-party service providers, including an AI processing provider and our cloud hosting provider, solely to deliver the Service to you. We only share what's needed for them to perform that function.
- Accounting integration — if you connect your own Xero organisation, your invoice data is sent to that organisation, at your direction, as described in section 4. We don't send any of your data to Xero unless you've connected your own account.
- Legal requirements — we may disclose information if required by law, or to protect our rights, users, or the public.
We do not sell your personal information to anyone.
7. Overseas disclosure
Some of the service providers described in section 6 — including Xero, if you choose to connect it — may store or process information on servers located outside Australia. Where that's the case, we take reasonable steps to ensure those providers handle information consistently with the Australian Privacy Principles, but we're not always able to guarantee an overseas recipient will handle your information exactly as an Australian entity would under the Privacy Act.
8. Data security
We use industry-standard measures to protect information we hold, including encrypted connections (HTTPS), password hashing, and access controls limiting who can view customer data. Xero access/refresh tokens are stored server-side only and are never exposed to your browser or to any other subscriber's account. No online service can guarantee absolute security, but we take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
9. How long we keep information
We keep your account information and job history for as long as your account is active, so you can access past takeoffs. If you close your account, we'll delete or de-identify your personal information within a reasonable time, except where we're required to retain records for legal, tax, or accounting purposes (typically up to 7 years for financial records). Casual one-off job data is retained for a reasonable period to support the free correction re-run and any support requests, then may be deleted. Xero access/refresh tokens are deleted when you disconnect Xero or close your account.
10. Access and correction
You can access and update most of your account information directly from your account settings. You can also ask us to provide a copy of the personal information we hold about you, or to correct it if it's wrong, by contacting us using the details in section 13. We'll respond within a reasonable time and won't charge you for a reasonable request.
11. Complaints
If you think we've mishandled your personal information, contact us first using the details below and we'll investigate. If you're not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
12. Children
reoXapp is intended for business use by adults working in the construction/reinforcing steel trade. We don't knowingly collect personal information from children.
13. Contact us
For any privacy question, an access/correction request, or to opt out of analytics tracking, use the "Message us" widget available across the site, or contact us directly through your usual channel.
14. Changes to this policy
We may update this policy from time to time. We'll update the "Last updated" date above when we do. Significant changes will be highlighted on the site.