VarioClaim Privacy Policy

Last updated 3 November 2026

VarioClaim is an iPhone app that helps trade subcontractors raise variation claims with their head contractor: supervisors capture photos and a description of extra work on site, and the business owner prices it and sends a purchase-order request. It is operated by Aydan John Bonaccorsi ("we", "us"). Contact: [email protected].

VarioClaim is sold to businesses. Each business that uses it (the "customer business") has its own separate server database, hosted in Sydney, Australia. No customer business can see another's data.

1. Who can use it

A business owner can set up their business in the app. Staff accounts are created by the owner (or by us at the business's request); staff cannot sign themselves up. The app is not directed at children.

2. What we collect and why

Data	Why	Where it is kept
When an owner sets up a business: their email, password (stored only as a secure hash), name, business name, trade, main builder's name and the words they use for jobs	To confirm the email and build the business its own server	Our central setup server (Sydney, Australia), and then the business's own server
Your name, work email address and password (stored only as a secure hash)	To sign you in and show who sent what	The customer business's server
Business details: company name, ABN, owner's name and mobile number, email wording	To write the business's emails	On the owner's iPhone, in the business's server settings, and in its register backups
Photos, descriptions of work, lot/unit numbers and time estimates that supervisors submit	To pass the work to the business owner	The customer business's server
Site Diary entries (notes and photos). Diary photos keep their original photo metadata, which may include the location where the photo was taken	A time-stamped evidence record the business can rely on in a dispute. Diary entries cannot be edited or deleted from the app, by design	The customer business's server
The business's register: claims, prices, PO numbers, dates, and the names and email addresses of the head contractor's staff the owner sends requests to	The claim-tracking the app exists for, and a daily backup so a lost phone doesn't lose it	On the owner's iPhone, with daily backup snapshots on the business's server
Purchase-order documents (PDFs) the owner shares into the app or forwards to it	To read the PO number and match it to claims	On the owner's iPhone and, if forwarded, the business's server
A push-notification token for your device	To notify the owner of new submissions	The customer business's server
Crash reports: the error, where in the app it happened, and the device model and iOS version. No names, emails, photos or job details	To find and fix crashes	Sentry (our crash reporting provider)
Whether your business's App Store subscription is active (Apple handles the payment; we never see card details)	To unlock the app for a paying business	The customer business's server

We do not use advertising, we do not track you across other apps or websites, and we do not sell or rent anyone's data.

3. Voice input

When a supervisor dictates, the audio is turned into text by Apple's speech recognition, which may run on the iPhone or on Apple's servers under Apple's privacy terms. VarioClaim never stores the audio. The resulting text is sent to the business's server to fill in the form (see §4).

4. AI processing

To draft a description of works, read a purchase order, or fill in a form from dictated text, the relevant photos, text or PDF are sent from the business's server to Anthropic's Claude API for processing. Anthropic acts as our service provider under its commercial terms. The result is returned to the app; we do not use your content to train AI models.

5. Service providers

Supabase — database, file storage and server functions, hosted in Sydney, Australia.
Anthropic — AI processing, as described in §4.
Expo and Apple — delivery of push notifications.
Apple — subscription payments through the App Store.
Sentry — crash reports, with personal details removed before they leave the phone.
GitHub — runs the automated setup of a new business; it handles the business name, owner's name and email while doing so.
Resend — sends sign-up codes and password-reset emails.
Postmark — only for businesses that turn on automatic PO forwarding: receives the forwarded PO emails.

Emails to the head contractor are sent by the owner from their own Mail app and email account — VarioClaim does not send email on anyone's behalf.

6. How long we keep it

For as long as the customer business uses VarioClaim. When a business stops, it is given an export of its data and its server database is deleted 30 days later.

7. Deleting your account

In the app, supervisors tap the account button on their home screen → Delete account; the sign-in is deleted straight away. An owner's account is the business itself, so owners use Settings → Account → Close my business and delete my account: we email an export, then delete the business, its accounts and its data within 30 days and confirm by email. Some records you submitted may be kept by the customer business you worked for — in particular Site Diary entries, which are evidence records the business relies on. You can also email [email protected].

8. Your rights

You can ask for access to, or correction of, your personal information by emailing us. We handle personal information in line with the Australian Privacy Principles. If you are unhappy with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au).

9. Changes

We will update the date above when this policy changes.