Privacy Policy
Last updated: 22 February 2026
1. Introduction
Australian Credit Solutions Pty Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, store, and disclose your personal information when you use our website, client portal, staff portal, and booking system (collectively, the "Services").
2. Information We Collect
We may collect the following types of personal information:
- Identity information: Full name, date of birth
- Contact information: Email address, phone number, residential address
- Financial information: Credit report data, details of defaults or listings, creditor information relevant to your case
- Account information: Login credentials (securely hashed), account preferences
- Booking information: Appointment dates, times, consultation notes
- Communication data: SMS messages, emails, internal messages, and notes exchanged through our portal
- Usage data: Browser type, IP address, pages visited, and interaction patterns (for service improvement)
- Google Calendar data: When staff members connect their Google Calendar, we access calendar event data to synchronise appointments (see Section 5 for details)
3. How We Use Your Information
We use your personal information to:
- Provide credit repair and financial advocacy services
- Manage your client account and case progress
- Schedule and manage consultation appointments
- Communicate with you about your case via SMS, email, and our portal
- Correspond with creditors and credit reporting bodies on your behalf
- Process payments for our services
- Comply with legal obligations and regulatory requirements
- Improve our services and user experience
4. Third-Party Services
We use the following third-party services to operate our platform:
- Supabase: Secure database hosting and user authentication
- Twilio: SMS messaging and communication services
- Google Calendar API: Calendar synchronisation for staff appointment management (see Section 5)
- Vercel: Website hosting and deployment
Each third-party service has its own privacy policy. We only share the minimum data required for each service to function.
5. Google Calendar Integration
Our staff portal integrates with Google Calendar to help consultants manage their appointment schedules. This section describes how we handle Google user data in compliance with Google API Services User Data Policy.
5.1 What We Access
When a staff member connects their Google Calendar, we request access to the calendar scope, which allows us to:
- Read calendar events to check for scheduling conflicts
- Create new calendar events for booked client consultations
- Delete calendar events when bookings are cancelled or rescheduled
5.2 How We Use Google Calendar Data
- We only use Google Calendar data to synchronise appointment bookings between our portal and the staff member's personal Google Calendar
- We create events containing the client's name, email, phone number, and appointment time
- We check existing events to prevent double-booking
- We do not share Google Calendar data with any other third parties
- We do not use Google Calendar data for advertising or marketing purposes
5.3 Data Storage
- Google OAuth access tokens and refresh tokens are stored securely in our encrypted database
- Tokens are only used to maintain the calendar connection and are automatically refreshed
- Calendar event IDs are stored to enable event updates and cancellations
5.4 Revoking Access
Staff members can disconnect their Google Calendar at any time through the Calendar Settings panel in our staff portal. You can also revoke access via your Google Account settings at myaccount.google.com/permissions. Upon revocation, we will delete the stored tokens from our database.
6. Data Security
We take the security of your personal information seriously and implement appropriate technical and organisational measures to protect it, including:
- SSL/TLS encryption for all data in transit
- Encrypted database storage (AES-256) for sensitive data
- Role-based access controls for staff members
- Regular security audits and monitoring
- Secure authentication with hashed passwords and session management
7. Data Retention
We retain your personal information for as long as necessary to provide our services and comply with legal obligations. When your data is no longer required, we securely delete or de-identify it. Specific retention periods include:
- Active client data: retained for the duration of your case plus 7 years
- Communication records: retained for 3 years after case closure
- Google Calendar tokens: deleted immediately upon disconnection
8. Your Rights
Under the Privacy Act 1988, you have the right to:
- Access the personal information we hold about you
- Correct any inaccurate or outdated information
- Request deletion of your personal information (subject to legal obligations)
- Withdraw consent for any optional data processing
- Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)
9. Cookies & Tracking
Our website uses essential cookies required for authentication and session management. We do not use tracking cookies, third-party advertising cookies, or analytics services that share data with external parties.
10. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your rights, or want to make a complaint, please contact us:
11. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this page periodically to stay informed about how we protect your information.