Privacy and security

The short version of how this product handles data. The binding version is the privacy policy; where the two differ, that one wins.

What is stored

• Public business information — name, category, address, rating, website — as returned by Google Places.
• Audit results: measured checks, the issues that were verified, the score and the evidence for each rule.
• Your own work: notes, stages, drafts, briefs, saved views, searches.

Halfbuilt does not scrape email addresses and does not buy contact databases. Business photos come from Google Places when the business has one and it is creditable, and are retained no longer than Google’s caching terms allow.

Who can see it

Your workspace is isolated at the database level: every table is behind row-level security keyed to the organisation you belong to, so one workspace cannot read another’s rows even if a query tries.

The only thing that leaves is what you publish. A shared brief link is high-entropy, stored as a hash rather than as the link itself, expires on the schedule you chose, and can be revoked at once. It carries no notes, no phone numbers, no pipeline and no outreach copy.

How outbound requests are handled

Every request the product makes to a site it does not own — measuring a business’s website, fetching a photo — goes through a guard that checks each redirect hop against private address ranges, drops credential headers when the origin changes, and stops reading at a byte ceiling. This is what keeps a hostile website from using our servers to reach something they should not.

Your data, back or gone

• Export from Settings, whenever you like, without asking.
• Delete from Settings. Seven-day recovery window; requesting it pauses new processing immediately and revokes every public brief link.

Cookies and analytics

Essential storage keeps authentication and security working. Analytics are optional and off until allowed; advertising tracking stays off unless you explicitly turn it on. Change any of it in Settings or on the cookies page, not only at the banner.

Reporting something

Security issues go to security@halfbuilt.com.au and are read before anything else. Eligible data breaches are assessed and notified under Australian law. The terms and acceptable use policy cover the rest.