1. Who We Are
FoxTrak is operated by ACR Systems Pty Ltd ("we", "us", "FoxTrak"), a company incorporated in Victoria, Australia. We take privacy seriously and are committed to handling all personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
This Privacy Policy explains what personal information we collect, how we use and protect it, who we share it with, and what rights you have. It applies to our web application at app.foxtrak.com, our iOS mobile app, and all related services.
By using FoxTrak, you consent to the practices described in this policy. If you do not agree, please do not use the platform.
2. What Data We Collect
Data You Provide Directly
| Data | Source | Purpose |
|---|---|---|
| Business name, contact name | Account registration | Account identity, billing, communications |
| Email address | Account registration | Login, notifications, billing, support |
| Phone number | Account registration | Authentication, account recovery |
| Customer names, emails, phone numbers | Operator data entry | Job tracking, customer communications |
| Job details, step notes, descriptions | Operator data entry | Core platform functionality |
| Photos, files, attachments | Operator uploads | Job records, customer communications |
| Invoice and quote data | Operator data entry | Billing, customer records |
| Team member names and emails | Operator invitations | Team access and collaboration |
| Customer feedback and approval responses | End customer input | Job progress records |
Photos and files uploaded by users - including payment receipts and job attachments - are stored securely and shared with the relevant business to support job tracking and communication.
Data Generated Automatically
| Data | Purpose |
|---|---|
| Login timestamps, session data | Security, account activity monitoring |
| Device type, OS version, app version | Technical support, compatibility |
| IP address | Security, fraud prevention |
| SMS and email delivery logs | Communication records, support, disputes |
| In-app activity (job updates, step changes) | Platform improvement, analytics |
| Error logs and crash reports | Bug fixing and platform stability |
| Push notification tokens (iOS) | Delivering push notifications |
| Pages visited and how you arrived (campaign tags, referring website, landing page) | Understanding how people find FoxTrak and measuring our marketing (see Section 13) |
| Email opens and link clicks for messages sent through FoxTrak | Showing Operators whether their customers have seen an update; delivery troubleshooting |
| Approximate location derived from IP address | Showing prices in your local currency |
| Tracking page view counts (per job, not per person) | Showing Operators when a job's tracking page has been opened |
We collect only the data necessary to operate, improve and market the platform. We do not sell personal data.
Note on business address and tax ID: FoxTrak does not directly collect or store your business address or ABN/tax ID. If you connect Stripe, Square, or Xero, those providers may collect this information independently as part of their own onboarding and compliance requirements, governed by their respective privacy policies.
3. How We Use Your Data
We use personal information for the following purposes:
- Providing the service - operating FoxTrak, processing jobs, sending communications, and enabling integrations
- Account management - creating and maintaining your account, authenticating logins, and managing team access
- Billing - processing subscription payments, issuing receipts, and managing plan changes
- Communications - sending you transactional emails (receipts, notifications, security alerts) and, where you have opted in, product updates
- Customer communications on your behalf - sending SMS and email messages to your end customers when you trigger them through the platform
- Support - responding to your queries, resolving issues, and providing technical assistance
- Security - detecting, investigating, and preventing fraud, abuse, or unauthorised access
- Product improvement - analysing aggregate usage patterns to improve platform features and performance
- Marketing measurement - measuring which ads, campaigns and channels lead businesses to visit our website and sign up, as described in Section 13
- Legal compliance - meeting our obligations under applicable law
We do not sell or rent personal information. We do not use end customer data, job content or messages for advertising. Apart from recording that a new account was created, our advertising measurement tools do not run in the logged-in platform, and they never run on job tracking pages or in emails.
4. SMS & Email Communications Data
What We Log
When an Operator sends a communication through FoxTrak, we log:
- The recipient's phone number (for SMS) or email address (for email)
- The message content (SMS body, email body, push notification body - stored per channel)
- Sender identity (which Operator account sent the message)
- Timestamp of the send event
- Delivery status returned by the sending provider (Twilio or SendGrid)
- The job or context the message was associated with
Open and click tracking. For some emails, our email provider (SendGrid) records when an email is opened and when links in it are clicked. We use this to show the Operator whether their customer has seen an update, and to troubleshoot delivery. It is not used for advertising.
SMS replies. FoxTrak SMS messages are not designed for two-way conversation, and recipients should contact the business directly. If a recipient replies to a FoxTrak SMS, we store the reply (the sender's phone number, the message text and when it arrived). Where we can match it to a recent message, we show it to that business's team on the related job. Replies are never shown on job tracking pages or in the customer app. We do not download or store pictures sent with a reply; we only record how many were attached.
SMS opt-outs. If a recipient replies STOP, or our SMS provider tells us they have opted out, we record that their number has opted out of SMS from that FoxTrak number and stop sending them SMS until they reply START. We keep the dates of opt-outs and opt-ins. When an SMS is not sent because of an opt-out, the business can see this in their Sent Messages.
Why We Log This
Communication logs exist to allow Operators to review their sent message history, to support dispute resolution between Operators and their customers, to detect misuse of the communication features, and to comply with applicable telecommunications and spam laws.
Recipient Data
When a message is sent, the recipient's phone number or email address and the message content are transmitted to Twilio or SendGrid (as applicable) for message delivery and, for email, open and click tracking as described above. These providers act as data processors on our behalf and are contractually bound to process this data only for these purposes.
Operator Responsibility
Operators are responsible for ensuring they have a lawful basis to communicate with each recipient and that all communications comply with applicable spam and telecommunications laws. See our Terms of Service, Section 6, for Operator obligations.
5. Customer Data (End Customers)
Two Distinct Roles
FoxTrak operates with two types of users whose data we handle differently:
- Operators - businesses who sign up for FoxTrak accounts. ACR Systems Pty Ltd is the data controller for Operator account data.
- End Customers - the customers of those businesses, whose data is entered into FoxTrak by Operators. For end customer data, the Operator is the data controller and ACR Systems Pty Ltd acts as a data processor on the Operator's behalf.
What End Customer Data We Process
End customer data typically includes: name, phone number, email address, job history, approval responses, feedback, and any files or notes added to their jobs by the Operator.
Our Role
We process end customer data only as directed by Operators and only for the purpose of delivering the FoxTrak service to that Operator. We do not independently use, market to, or share end customer data for our own purposes.
End Customer Rights
If you are an end customer of a FoxTrak Operator and wish to access, correct, or delete your personal data, you should contact the Operator directly, as they are the data controller for your information. If you are unable to reach the Operator, you may contact us at hello@foxtrak.com and we will assist where we reasonably can.
6. Payment Data
FoxTrak Subscription Payments
Subscription payments from Operators to ACR Systems Pty Ltd are processed by Stripe. We do not store full credit card numbers, CVV codes, or other sensitive card data on our servers. Stripe handles all payment card data in accordance with PCI DSS compliance standards.
All payment processing is handled by Stripe. FoxTrak does not directly process or store payment card information.
We retain records of payment transactions (amounts, dates, plan changes) for accounting and billing purposes.
Customer Payments via Operator Stripe or Square Accounts
When an Operator's end customer makes a payment for a job or invoice through FoxTrak, the payment is processed directly through the Operator's own connected Stripe or Square account. In these transactions, FoxTrak passes payment-relevant data (invoice amount, job reference, customer contact details) to the Operator's Stripe or Square account solely to facilitate the transaction.
ACR Systems Pty Ltd does not store end customer payment card details and is not a party to these transactions. Stripe's privacy policy governs how Stripe handles this data, and Square's privacy policy governs how Square handles this data.
7. Data Storage & Location
Your primary data is stored in Australia. FoxTrak uses Google Firebase infrastructure located in the australia-southeast1 region (Sydney, NSW) for primary data storage: Firestore (database) and Cloud Storage (files and media).
This means your data - and your customers' data - does not leave Australia for primary storage purposes.
Exceptions
The following scenarios may involve data processing outside Australia:
- SMS delivery - recipient phone numbers are transmitted to Twilio (US-based) for message routing and delivery. Twilio is bound by our data processing agreement.
- Email delivery - recipient email addresses and message content are transmitted to SendGrid (US-based). SendGrid is bound by our data processing agreement.
- Payment processing - payment data is transmitted to Stripe and/or Square (both US-based) as described in Section 6.
- Xero integration - if you connect Xero, invoice and business data is shared with Xero in accordance with Xero's privacy policy.
- Push notifications - device notification tokens are transmitted to Apple (APNs) or Google Firebase Cloud Messaging (FCM) for push notification delivery.
- Web hosting - our web applications (foxtrak.com and app.foxtrak.com) are hosted on Vercel, whose infrastructure may process request data outside Australia.
- Analytics and advertising measurement - usage data from our website and web application is processed by Google (Google Analytics) and Meta (Meta Pixel), which may process it outside Australia. See Section 13.
- Sign-in providers - if you sign in with Google, Apple or Microsoft, that provider processes your sign-in.
- Crash reports - crash reports from our iOS app are processed by Google (Firebase Crashlytics).
- Account sign-in - your login details (such as your email address, and phone number if you use it for sign-in or two-factor authentication) are managed by Firebase Authentication, which may store them outside Australia.
In all cases where data is transmitted internationally, we ensure appropriate safeguards are in place through contractual arrangements with our providers.
8. Third-Party Services
We work with the following third-party providers to operate FoxTrak. Each receives only the minimum data necessary for their specific function.
We do not sell personal data to any of these providers or any other third parties. Except as described in Section 13, these providers are authorised to process personal data only for the specific functions described above and are contractually required to maintain appropriate security standards.
Some providers, including Meta and Google, may also use data they receive under their own privacy policies. See Section 13 for details and how to opt out.
9. Data Sharing & Disclosure
We do not sell, rent, or trade personal information. We disclose data only in the following circumstances:
- Service providers - to the third-party providers listed in Section 8, strictly for the purposes described, and as described in Section 13 for analytics and advertising measurement
- Within your account - team members within your FoxTrak account can access data appropriate to their assigned role (Admin, Editor, or Viewer)
- Legal obligations - when required by applicable law, court order, or lawful request from a government or regulatory authority
- Protection of rights - where we reasonably believe disclosure is necessary to protect the rights, property, or safety of ACR Systems Pty Ltd, our users, or the public
- Business transfer - in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections. We will notify affected users in advance.
In all other cases, we will seek your consent before disclosing your personal information to any third party.
10. Data Retention
Active Accounts
We retain your data for as long as your FoxTrak account is active and as long as reasonably necessary to provide the service.
Account Closure
When an account is closed, we retain your data for 90 days to allow for data export and to handle any post-closure queries. After 90 days, your data is permanently and irreversibly deleted from our systems, unless we are required by applicable law to retain it for longer.
Communication Logs
SMS and email communication logs, including SMS replies, are retained for 24 months from the date of the communication. This retention period supports dispute resolution, spam law compliance, and delivery record requirements. SMS opt-out records are kept for as long as needed to keep honouring the opt-out.
Billing Records
Transaction and billing records are retained for 7 years in accordance with Australian tax and accounting law requirements.
11. Security
We implement industry-standard security measures to protect your data, including:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Firebase security rules with role-based access controls limiting data access to authorised users
- Secure secret management for API keys and credentials (Firebase Secret Manager)
- Two-factor authentication (2FA) available for all Operator accounts
- Regular security reviews of Firestore and Storage access rules
- Automated security scanning of the codebase
No method of data transmission or storage is completely secure. While we take reasonable precautions, we cannot guarantee absolute security. If you believe your account has been compromised, contact us immediately at hello@foxtrak.com.
In the event of a data breach that is likely to result in serious harm to individuals, we will notify affected users and, where required, the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.
12. Your Rights
Under the Australian Privacy Act and applicable law, you have the following rights in respect of your personal information:
- Access - request a copy of the personal information we hold about you
- Correction - request that we correct inaccurate, incomplete, or outdated information
- Deletion - request deletion of your personal data (subject to our retention obligations)
- Data portability - export your job and customer data in CSV or PDF format at any time from within the platform
- Opt-out of marketing - unsubscribe from non-transactional marketing emails at any time using the unsubscribe link in any such email, or by contacting us
- Complaints - lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) if you believe we have handled your data improperly
How to Exercise Your Rights
To make any request, email hello@foxtrak.com with "Privacy Request" in the subject line. We will respond within 30 days. We may need to verify your identity before processing the request.
OAIC Contact
If you are unsatisfied with our response to a privacy complaint, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
13. Cookies, Analytics & Advertising
Job tracking pages
The pages your customers use to follow their job do not use analytics or advertising tools and do not set tracking cookies. Your browser keeps a short-lived marker for the current session so that a single visit is only counted once.
Web application
Our web application uses cookies and browser storage to keep you signed in, remember your preferences, and keep a local copy of your dashboard data so it loads quickly. These are necessary for the platform to work.
Analytics
We use Google Analytics (through Firebase) in the web application to understand how the platform is used, such as which pages are visited and for how long. Google Analytics sets cookies (such as _ga) and receives your IP address and device information. It does not run on job tracking pages or sign-in link pages, and we do not send it your name, email address or job details. Our marketing website does not use Google Analytics.
Advertising measurement
We use the Meta Pixel on our marketing website (foxtrak.com) and on the FoxTrak sign-up page to measure which of our ads lead people to visit and sign up. It records page visits, when you enter your email to get started, and when a new business account is created. Meta receives your IP address and browser information and may set a cookie (such as _fbp). Meta may use this data under its own privacy policy, including to show and measure ads. Apart from recording that a new account was created, the Meta Pixel does not run in the logged-in platform. It never runs on job tracking pages or in emails, and we do not send Meta your name, email address, or any customer or job data. The only identifier we send is an internal account ID, so a sign-up is not counted twice.
How you found us
When you first visit foxtrak.com or app.foxtrak.com, we set a first-party cookie (ft_attr) that records how you arrived: campaign tags in the link (such as utm_source), the referring website, and the page you landed on. It lasts 90 days and is not overwritten by later visits. If you create a FoxTrak account, this information is saved to your business account so we can understand which channels bring new customers. Our marketing website also keeps similar information in your browser's local storage for 30 days.
Your choices
You can block or delete cookies in your browser settings or use a browser extension that blocks trackers. You can opt out of Google Analytics using Google's opt-out browser add-on, and manage how Meta uses your data in your Meta ad preferences. Blocking these does not affect your ability to use FoxTrak.
Embedded content
Our help and feedback pages may include YouTube videos in privacy-enhanced mode, which does not set YouTube cookies until you play a video.
14. International Users
FoxTrak is designed for businesses operating in Australia, the United Kingdom and the United States. Primary data is stored in Australia (Google Cloud australia-southeast1) and processed in accordance with Australian privacy law.
United States
For US-based Operators and their customers, FoxTrak's SMS communications are subject to the Telephone Consumer Protection Act (TCPA) and CAN-SPAM Act. Operators are responsible for compliance with these laws when using FoxTrak to communicate with US customers.
UK and European Users
FoxTrak is available to businesses in the United Kingdom. If you are in the UK or the European Economic Area, you have rights under the UK GDPR or the GDPR, including the right to access, correct and delete your personal data, and to object to its use for marketing measurement. Contact us at hello@foxtrak.com and we will respond within 30 days. Your primary data is stored in Australia, with the exceptions described in Section 7.
15. Changes to This Policy
We may update this Privacy Policy as the platform evolves or as legal requirements change. We will notify you of significant changes via email and/or in-app notice at least 14 days before they take effect. The current version is always available at foxtrak.com/privacy.
Continued use of FoxTrak after an updated policy takes effect constitutes your acceptance of the changes.
16. Contact & Complaints
For all privacy-related queries, requests, or complaints:
ACR Systems Pty Ltd
ABN: 88 691 470 890 · ACN: 691 470 890
Melbourne, Victoria, Australia
hello@foxtrak.com
Subject line: Privacy Request
We aim to acknowledge all privacy requests within 5 business days and resolve them within 30 days.
If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.