Privacy policy

Last updated: 20 September 2026

Who we are

Elite OS is business-management software for trade businesses. This policy explains what information the app handles and why. Each business that uses Elite OS is the controller of the data it enters. If you are a worker or customer of one of those businesses, contact that business about your data.

What we collect

  • Account details for people who log in: name, phone number, email and role.
  • Business records you enter: clients, leads, estimates, jobs, invoices, photos and worker names.
  • Time-clock data: when a worker clocks in or out, the time, the job, their device location at that moment, and the required clock-in or clock-out photo.
  • Estimate photo details: when a member uses Take site photo, the label includes their first name plus the device time and precise device location when the file is added to Elite OS. This does not establish the image file's original creation time or location. An image selected as an existing upload is marked GPS NOT VERIFIED.
  • Basic technical data needed to run the service, such as your session.

Location and camera

The app asks for location when a worker clocks in or out, and when a logged-in member uses Take site photo. The label records the time and location supplied by that device when the file is added. The app asks for the camera for these photos and when you add photos to a job. You can decline a permission, but the action requiring those details cannot be completed. Estimate photos selected from the device do not claim the file's original time or location: they are visibly marked with their upload time and “GPS NOT VERIFIED”. Estimate photos selected as “On quote” are shared with the customer in their portal and PDF, including the visible first name, time and location label.

How we use it

To provide the service you signed up for: scheduling, quoting, invoicing, and timesheets. We do not sell your personal information, and we do not use it for advertising.

Connecting Google and Gmail

Connecting Gmail is optional. You choose the Google account and grant access on Google's consent screen. Elite OS receives your verified email address and authorisation tokens, not your Google password. We use your email address to identify the connected mailbox and prevent a reconnect from switching to a different mailbox.

Sending email: Gmail send access lets Elite OS send messages you request through the app, including customer correspondence and quotes, with their recipients, subject, message content and attachments. Sent messages are recorded in the relevant client conversation.

Collecting replies:Gmail read access lets Elite OS check message headers and identifiers in the background to find replies to existing Elite OS conversations. This can include older messages. For matching replies, we retrieve and store the sender and recipients, subject, timestamps, thread identifiers, message body and supported attachments so your team can read them in the client's Emails and Timeline. Messages are not imported just because the sender matches a client's email address. We do not use this access to change or delete messages, labels or settings in your Gmail mailbox.

Team visibility and service providers: Saved client correspondence is a business record, not a private inbox. Authorised teammates in your organisation can see it according to their role and record access. Your mailbox connection credentials are not shared with teammates. Google handles mailbox access and mail delivery; our application infrastructure providers, including Vercel and Supabase, process or store the information needed to provide this feature. Google processes mailbox data on its own infrastructure.

Protection and permitted use: OAuth refresh tokens are encrypted before storage. Stored email records have per-business access controls, and stored email attachments use private storage. Connections to Google use HTTPS. We use Google user data to provide the email features you enable, not for advertising, sale to data brokers, credit decisions or training general-purpose AI models. Elite OS follows the Google API Services User Data Policy, including its Limited Use requirements.

Disconnecting and deleting data: You can disconnect in Settings → My email. This removes the stored connection credentials; it does not delete emails from Gmail or erase correspondence already saved in Elite OS. You can also revoke Google access in your Google Account connections. Saved email content and attachments follow the business-record retention rules below, not the 30-day clock-photo rule. To request deletion of imported email data, contact your business administrator or support@3md.com.au. Requests are handled subject to applicable record-keeping obligations.

Where it is stored

Primary app data is hosted in Australia using our infrastructure providers, including Supabase and Vercel. Connected services such as Google may process data on infrastructure outside Australia. Access to app records is protected by per-business security rules so one business cannot see another business's data.

Sharing

We share data only with the service providers that run the app on our behalf, and only as needed to operate it. We may disclose information if required by law.

Retention and your choices

Business data is kept while the account is active and as required for legal, accounting, security and record-keeping obligations. Hosted clock-in and clock-out photos are deleted after 30 days; the shift time, job, GPS and audit details remain. Estimate site photos are business/quote records and do not use that 30-day clock-photo rule. Some issued business records and their evidence are preserved as immutable history rather than edited or immediately deleted. To request access to, correction of, or deletion of your information, contact the business you work with, or us at the address below. Requests are handled subject to those obligations. You can initiate deletion of your Elite OS account in Settings → My profile → Delete account, or at Delete your account. Account and associated personal-data deletion requests are processed within 7 days, with an email confirming completion and explaining any records retained by law.

Contact

Questions about this policy: support@3md.com.au.