Privacy Policy
Effective date: 22 October 2026
1. About this policy
Weekly Job Map is operated by A LE & K NGUYEN, ABN 60 102 422 850, of Unit 314, 66 Manning Street, South Brisbane QLD 4101, Australia. In this policy, “we”, “us” and “our” mean that operator.
This policy explains how we handle personal information when you visit our website, use Weekly Job Map or contact us. It also covers personal information a subscribing business adds about its customers and other people.
Privacy enquiries can be sent to support@weeklyjobmap.com.
2. Information we collect
We collect information you give us directly, information your business enters into the app and information generated when the service is used. A business using Weekly Job Map may supply information about its customers without those customers having an account with us.
| Type of information | Examples |
|---|---|
| Account and business | Email address, business name, sign-in and business identifiers, access permissions, registration and account history. Passwords are submitted to Supabase Auth for authentication. |
| Customers and jobs | Names, phone numbers, addresses, suburbs, map coordinates, services, booking dates and times, duration, prices, status, notes, follow-ups and repeat-work dates. |
| Financial records | Income, outstanding amounts, payments, methods, dates, expenses, suppliers, fees, tax treatment, account labels, references, adjustments, reimbursement or other payment-recipient details and notes. |
| Subscription and guarantee | Billing identifiers, amounts and dates, trial and offer history, subscription status, payment outcomes, refund requests, review decisions and related evidence. |
| Support and communications | Your email address, message content and any attachments you choose to send, together with delivery and error information for service emails. |
| Technical and audit information | Request and device/browser information received by our services or providers, activity timestamps, access identifiers, operational errors and records of changes, voids or locked finance periods. |
| Optional marketing analytics | Only when analytics is enabled and after valid opt-in: public-page visits, coarse acquisition labels, analytics cookie/pseudonymous identifiers and ordinary technical information, as described in section 6.1. |
| Optional Meta advertising measurement | Only when separately enabled and after advertising opt-in: public-page visits, verified registration/trial events, pseudonymous browser/click identifiers and browser user agent. See section 6.2. |
Where a business’s messages are processed through a configured Facebook Messenger integration, we also handle the page and conversation identifiers, participant names and identifiers, message text, timestamps, labels and attachment/reply information supplied by Meta. This paragraph describes the handling of those messages; it does not mean Messenger integration is included in every subscription.
Subscription card details are collected by Stripe through its hosted checkout. Weekly Job Map’s subscription records store billing references and payment outcomes rather than full card numbers or card security codes.
You can browse the public website without creating an account. We need some information, such as an account email and the details required for billing, to provide a subscription. You may choose not to supply optional information, although this can limit the features available to you.
If you choose optional country detection, Geoapify receives your IP address and ordinary connection information to suggest your country. This uses approximate IP-based location without requesting GPS access. You can select your country manually instead. A suggestion changes your saved country only when you apply and save it.
Please do not put passwords, payment-card details, government identification documents or unrelated sensitive personal information in job notes or support messages.
3. Why we use information
We use information to provide the features you use, maintain your account and business workspace, manage subscription payments and access, respond to support requests, investigate faults and protect the service from misuse.
Separately consented Meta advertising measurement, when enabled, measures advertising effectiveness and verified registrations and trial starts. It is optional and is not needed to provide the product. Google Analytics acceptance does not authorize Meta advertising measurement.
We also use relevant billing and account history to apply trial, promotional-offer and guarantee rules, prevent duplicate claims, honour offers already made and meet recordkeeping or other legal obligations. If you believe an eligibility or access decision is wrong, contact us so we can review it.
We handle support messages and information you send us to answer your enquiry. We do not need your full customer list to answer a general question; please limit what you send to what is relevant.
Service communications can include account verification, password recovery, trial reminders and payment/access notices. Job follow-ups and repeating-work dates are stored to help the business manage work; they do not themselves send messages to that business’s customers.
4. Who receives information
We use service providers for the functions below. Some providers receive information directly from your browser, such as when you sign in, search for an address or open checkout.
| Provider | Purpose and relevant information |
|---|---|
| Supabase | Account authentication and storage of account, business, job, finance and related service records. |
| Replit | Hosting the website and server functions, including relevant requests, technical logs, account/billing references and information submitted to those functions. |
| Stripe | Subscription payments, billing management and refunds. Receives checkout/payment information and relevant account, offer and subscription references. |
| Resend | Delivery of service emails, including recipient address, message content and delivery identifiers. |
| Geoapify | Address suggestions, map display and optional country detection. Receives address text as you type sufficiently long searches, map-area requests and ordinary connection metadata, including your IP address. |
| OpenStreetMap Foundation | Fallback map images. Receives requests identifying the viewed map area and zoom level, plus ordinary connection metadata. |
| Meta/Facebook messaging | For the configured messaging integration: page, participant and conversation information needed to retrieve or handle those messages. Advertising measurement is a separate optional integration below. |
| Meta advertising measurement | Separately from Messenger, optional server-to-server advertising measurement when enabled and after valid advertising opt-in. Receives only the events and identifiers described in section 6.2. |
| Authentication and support email providers | Delivery of verification/recovery messages and handling email you send to support. |
| Google Analytics | Optional public marketing traffic measurement when enabled and after valid opt-in only. Public-page metadata, coarse acquisition labels, analytics cookie/pseudonymous identifiers and ordinary connection information; never private product/customer data. See section 6.1. |
Address-search information can be sent to the address provider before you save a job. Map-image requests reveal the geographic area being viewed; the app does not send a named customer list as part of those image requests.
Providers may also handle information for their own legal, security and fraud-prevention purposes as explained in their policies. Those policies do not replace our responsibilities for our own handling of your information.
People we authorise to operate and support Weekly Job Map may access information where needed for those duties. We may also disclose relevant information to professional advisers or authorities where reasonably necessary to meet legal obligations, establish or defend legal claims, or address unlawful activity, and where the disclosure is permitted by law.
A subscribing business controls the records it enters and may access, change and export those records through its authorised account. If you are that business’s customer, its own privacy practices also apply. We do not make business records public simply because they are stored in Weekly Job Map.
5. Overseas processing
Some service providers may process information outside Australia. This can include hosting, technical support, payment processing and the delivery of map or email services.
Optional Google Analytics involves possible processing outside Australia under Google's applicable terms when analytics is enabled and you consent. Its consent and collection limits are described in section 6.1; consent does not waive legal protections.
Optional Meta advertising measurement may also involve processing outside Australia, including in the United States, under Meta's applicable terms. Section 6.2 explains its separate consent and collection limits. We do not ask you to waive applicable overseas-disclosure protections.
Where Australian privacy law applies, we will take the steps it requires in relation to overseas disclosures. This policy does not ask you to waive protections that otherwise apply to those disclosures.
6. Browser storage and device information
The app uses browser storage to maintain sign-in sessions and support account-recovery navigation. It also caches basic application files such as the page shell and icon to support loading. This is not a promise of complete offline access.
If you are using a separately supplied local demonstration, job records may be held in that browser rather than a cloud account. We will identify that mode if it is made available to you.
Stripe and other provider-hosted services may use their own cookies or similar technology. You can control browser storage through your browser settings, but blocking necessary storage can prevent sign-in or other functions from working.
On a shared device, sign out when you finish and consider clearing the website’s stored data. Clearing browser storage can remove preferences and any records that have not been saved to your account. Downloaded exports are separate files on your device; deleting information in the app does not delete copies you have downloaded or shared.
6.1 Optional marketing analytics
We use Google Analytics with your consent.
Analytics collection is currently disabled. The practices below apply only when analytics is enabled and you have given valid consent. Publication of this policy does not enable analytics or constitute consent.
Optional Google Analytics 4 (GA4) is limited to the eight public marketing pages of Weekly Job Map: Home, Features, Pricing, About, FAQ, Support, Privacy and Terms. Its purpose is to help us understand public-page visits and coarse traffic sources. Declining does not affect access to the website or product.
While analytics is disabled, or without a valid saved acceptance, this integration does not load any Google Analytics tag, make any requests to Google, set analytics cookies or send even cookieless analytics pings. When analytics is enabled, you opt in through the separate Website analytics — Google Analytics choice in Tracking preferences; a valid saved choice also applies on later eligible visits in that browser. This Google Analytics integration does not use advertising pixels, remarketing, personalised advertising, Google Signals or product conversion reporting. Separately controlled Meta advertising measurement is described in section 6.2.
When analytics is enabled and after acceptance, Google receives public page names and canonical addresses without query strings or fragments, the previous eligible public-page address when available, and vetted non-personal campaign/source/channel labels. Where available, we classify an approved search-engine referrer hostname as an inferred organic source or an approved website hostname as a referral source. Only coarse labels are sent, never the external referrer URL, hostname, path, query or fragment. Unavailable or unrecognised acquisition information remains unknown and is not assumed direct. Restricted labels and missing referrers limit attribution. This does not link visits to actual accounts, trials or paid subscriptions.
For consented analytics when enabled, Google uses analytics cookies and pseudonymous identifiers to measure visits, sessions and visitors, and may generate standard session and engagement measurements. It receives ordinary technical and connection information, such as IP address and browser/device information, which can reveal approximate visitor geography. This is not anonymous processing. Granular location/device collection, Google Signals and advertising personalisation are configured off; this does not prevent ordinary technical metadata from reaching Google during consented collection. Google may process information outside Australia under its applicable terms.
This integration does not send account/business IDs, sign-in details, email addresses, phone numbers, customer/job information, customer/job addresses or coordinates, job notes, Finance data, payment details or checkout return parameters. Private app, sign-in and callback routes are not measured. Free-form campaign text, hashed emails, customer identifiers and advertising click IDs are not forwarded. Acquisition labels are held temporarily within the accepted public-page runtime, not stored by us as a customer or cross-device attribution profile. Measurements already sent may remain with Google after that runtime ends.
The saved accept/reject preference lasts up to 180 days, unless changed or browser storage is cleared sooner. Saving a new choice starts a new preference period. Separately, analytics cookies are configured for a 180-day lifetime without automatic rolling extension; browser restrictions may shorten their availability. Google's user/event-level data-retention setting is 2 months. That separate setting does not apply to standard aggregated reports and is not the preference or cookie lifetime, nor a promise that all provider-held information disappears after two months.
When analytics is enabled, you can open Tracking preferences and decline Website analytics — Google Analytics to withdraw. This stops the tag runtime and attempts to remove this integration's readable first-party analytics cookies without clearing sign-in or product storage. It stops subsequent collection but does not erase information already received by Google. Clearing browser storage resets the saved choice. Expired, missing or unreadable consent keeps analytics off once detected; checks run on navigation, window focus, cross-tab changes and a 30-second timer subject to browser scheduling. Leaving an eligible page stops the runtime but does not by itself withdraw saved consent.
For access, correction or deletion enquiries about this information, contact support@weeklyjobmap.com. Requests are assessed under applicable law and available provider processes. Google's privacy information is available at Google Privacy Policy.
6.2 Optional Meta advertising measurement
Meta advertising measurement is available only after you separately opt in to advertising measurement. Publication of this policy does not itself provide consent. Declining either advertising or analytics does not affect access to Weekly Job Map, and accepting one category does not accept the other.
When enabled, our server sends explicitly selected PageView, CompleteRegistration and StartTrial events to Meta using its Conversions API. PageViews cover the eight public website pages listed in section 6.1, not private application browsing. CompleteRegistration requires verified email/account creation and initial workspace provisioning. StartTrial requires server verification of an actual new Stripe trial activation; clicking a button or returning from Checkout is not enough. Conversion delivery is attempted while the consenting browser is present and may be missed if it closes, changes device or cannot complete verification.
The initial integration does not load Meta's browser Pixel script, tracking images or automatic form/button detectors, and does not use automatic advanced matching. It sends only the event name, actual event time, a random event identifier, the website action source, an approved query-free/fragment-free public or application address, browser user agent, and consented pseudonymous browser/click identifiers (`fbp` and `fbc`, where available). A click identifier is derived only from a valid Meta advertising click parameter, not invented when absent. We do not send raw referrer URLs, free-form campaign text, names, emails (including hashes), phone numbers, account/business IDs, Stripe identifiers, customer/job records or addresses, job notes, financial amounts, payment details, passwords or authentication/Checkout tokens.
These events and identifiers are not anonymous. Meta may associate them with its own information for advertising measurement and optimization. Our server links only the necessary consented browser context to verified registration/trial evidence; it does not export the associated account identity or business records to Meta. Missing consent, identifiers or cross-device continuity limits attribution. See Meta's Privacy Policy and cookie information.
The first-party `wjm_meta_consent` cookie is an opaque, HttpOnly preference-session handle, lasting up to 180 days. The separate saved advertising choice also lasts up to 180 days; editing only Google Analytics preferences does not renew it. Preview choices do not authorize live collection. Browser/click identifiers are stored server-side, not in authentication or Checkout URLs; identifiers are eligible for use for up to 90 days. A new browser identifier may be generated during a later visit within valid saved acceptance, without extending consent or recreating an expired click identifier. Event delivery/deduplication records are eligible for cleanup after 7 days. Expired preferences and identifiers are cleaned on subsequent preference requests; a deletion may therefore occur later than its eligibility time. These are our storage limits, not promises about Meta's own retention, and are unrelated to Google's two-month retention setting.
Use Tracking preferences on the public website or in the app to decline Advertising measurement — Meta. Withdrawal immediately stops new browser dispatch, revokes the server preference when the request reaches us, and removes the stored advertising identifiers. We also attempt to remove readable first-party `_fbp`/`_fbc` cookies left by prior integrations, without clearing authentication or Google preferences. Our initial integration does not itself create those two cookies. If offline, the browser remains off and retries preference synchronization when it reconnects; no unattended conversion-delivery worker runs. Requests already dispatched cannot be recalled, and our website cannot delete Meta-domain cookies or information already received by Meta. Use the provider's controls or contact us about applicable access/deletion processes. Clearing storage resets the local choice; a later preference check suppresses an unmatched server acceptance before new delivery.
6.3 Optional Microsoft Clarity public-website analytics
Microsoft Clarity is enabled on eligible public marketing pages only after you explicitly accept optional analytics in Tracking preferences. It helps us understand public-page interaction through session recordings and heatmaps, including page visits, clicks, scrolling, interaction timing and device/browser information. These recordings and pseudonymous identifiers are not anonymous. Publication of this policy alone does not provide consent. Google Analytics remains separately disabled.
Clarity uses the existing analytics preference independently of Meta advertising. Eligible pages are the eight canonical public marketing pages listed in section 6.1. We do not load Clarity on logged-in app screens, sign-in/sign-up, account, billing, Checkout, callbacks, unknown routes or pages with query strings/fragments or unsafe referring addresses. Private application screens open in a separate, non-recording document. Authenticated visitors are excluded. Declining or withdrawing optional analytics does not affect service access.
The project uses Strict masking, with explicit masking on public marketing content and no unmask rules. Our integration does not supply custom user identification, names, emails, submitted form values, customer/job records, financial information or authentication tokens. Masking is not anonymisation and does not hide all interaction, browser or network information. Microsoft receives requests directly and may process information outside Australia under its applicable terms. See Microsoft's Privacy Statement and Clarity's data retention information.
Clarity's project-default cookie setting is OFF, but an explicit analytics-storage grant can create first-party `_clck` and `_clsk` cookies. Microsoft advertising storage remains denied. The existing saved analytics choice lasts up to 180 days, independently of provider cookie lifetimes. Use Tracking preferences → Analytics — Microsoft Clarity to reject or withdraw. On withdrawal, expiry or invalidation detected by our consent checks, we attempt to expire readable first-party `_clck`/`_clsk` cookies and reset the public document. A per-tab hold prevents automatic recording resumption in that tab. Authentication and other providers' cookies are not cleared by Clarity cleanup.
The fresh document does not load Clarity without the eligibility and consent checks. Document replacement is not instantaneous: an old public document may initiate or finish a request during withdrawal/navigation, and requests already dispatched cannot be recalled. Our website cannot remove Microsoft-domain, HttpOnly or otherwise inaccessible cookies, or information already received by Microsoft. Contact us about applicable access/deletion requests and provider processes.
7. Security
We use account authentication and access controls to help protect information and separate business workspaces. We take reasonable steps to protect personal information from misuse, loss and unauthorised access, alteration or disclosure.
No online service can guarantee complete security. If you suspect a security issue, contact support@weeklyjobmap.com. We will assess suspected breaches and notify affected people and authorities where required by applicable law.
8. Retention and deletion
The optional analytics preference, cookie and Google user/event retention periods are separate from the account, billing and operational-record rules below; see section 6.1.
For ordinary cancellation, full access continues until the paid subscription period ends. This is followed by 90 days of view/export access, with normal editing disabled. The 90 days start when paid access ends, not when you first request cancellation. The Terms of Service explain other access-ending circumstances, including an approved guarantee refund.
If you resume your subscription before the 90-day view/export period ends, you keep your existing operational business records.
Once that period ends, those records become unavailable and are queued for permanent deletion. Returning afterwards does not cancel deletion or restore those records; you start with fresh operational records.
We schedule the first deletion attempt for one hour after the period ends. Processing delays or technical failures may delay completion, but they do not extend your access or create an additional recovery period. Export the records you need before the 90-day period ends.
This covers the business workspace’s operational job and customer records and customer-entered Finance data.
We retain limited account/profile information and trial and guarantee history to support returning account holders and apply the once-per-business eligibility rules. We also retain records of subscription invoices, payments, refunds and related tax or legal evidence for the period required by applicable law. These are records of payments to Weekly Job Map, rather than a reason to retain all job or Finance records you entered for your own business.
Limited security or dispute records may also be retained where necessary and lawful. We restrict retained information to what is reasonably needed for its purpose and review whether it remains necessary. Cancellation does not itself delete the retained account profile or those limited records.
You can contact us to request account closure or deletion of personal information. We assess your authority and any information that must or may lawfully remain, then explain the outcome. Export records you need before requesting earlier deletion. Deleting an individual record or voiding a Finance entry does not erase the entire account; voided entries remain identifiable in the full-history export while those operational records remain stored.
Provider backups may retain deleted information until the applicable backup expires or is overwritten. Provider-held transaction records may also remain under that provider's legal retention obligations. These are separate from active workspace records and are not an additional customer recovery period.
9. Access, correction and privacy requests
You can use the app’s available controls to review and update your information and export supported records. You can also ask us to access or correct personal information we hold about you, or ask about deletion, by contacting support@weeklyjobmap.com. A privacy request does not require an active paid subscription.
We may reasonably verify your identity and authority before providing information or making changes. We will not require more identifying information than is reasonably needed. If a request concerns records held for a subscribing business, we may need to involve that business, without disclosing more than necessary. You can still contact us directly about our handling of your information.
We aim to respond to privacy requests, including access, correction and deletion requests, within 30 days. If more time is reasonably needed, we will explain why and give you an expected response date. If we cannot grant a request, we will explain the reasons where lawful and tell you how to raise a complaint. We will not charge you to make a request or to correct information.
10. Privacy complaints
Tell us what happened, when it happened and the outcome you are seeking. We will assess your complaint, investigate as appropriate and aim to provide a response within 30 days. If we need more time, we will keep you informed.
If you are not satisfied with our response, or we have not responded within 30 days, you can contact the Office of the Australian Information Commissioner where your complaint is within its jurisdiction. You may also have rights to contact another relevant privacy regulator.
11. Changes to this policy
We will update this policy when our practices change and show the effective date at the top. For material changes, we will provide a prominent notice or contact affected account holders where appropriate. If a new use of information requires consent, we will seek it rather than treat publication of an updated policy as consent.