Privacy policy

Information about businesses

SubbieList lists building and construction businesses that hold a QBCC licence. About two thirds of them are sole traders, so a listing is often personal information about a real person. We build each listing from public sources:

• the QBCC licence register: licence number, holder name, grade and classes, and the business address on the register
• the Australian Business Register and ASIC: ABN, legal name and registration status
• the business's own website: phone, email, website address and a short description

To find a business's website we search Google Maps listings and the web using the business name and suburb. We don't publish anything we take from those results. We then read the business's own site, following its robots.txt, and use an AI service to pick the contact details and description out of the page text. Every published contact detail has to trace back to one of the sources above. More on this at data sources.

We show the suburb, never the street address of a sole trader.

A business can claim its listing for free. Once claimed, it can correct its details and choose whether its phone and email are public or shared on request. Any business can ask us to correct its listing or remove its contact details. See "Your choices" below.

Information about visitors

You don't need an account to use SubbieList. When you visit, we collect:

• Contact reveals. When you click "Click to reveal" on a listing, we record which business, which page you were on, the time, and a random browser ID. We use this to count how often each business is contacted and to stop people copying every number on the site. We don't store your IP address with it.
• Usage statistics. We use Google Analytics to see which pages people use, including page views, scrolling, clicks on links to other sites, searches, file downloads and form use. Google Analytics doesn't store IP addresses. It sets its own cookies.
• AI assistant connector. If you connect ChatGPT, Claude or another assistant to SubbieList, we log each request it makes: the tool it used, what it searched for and the time. We use this to run and improve the connector and to limit heavy use.
• Correction requests. If you use the "Correct or remove a listing" form, we keep your name, email, your connection to the business and what you asked for, so we can handle the request and reply. The request is also emailed to our corrections mailbox.
• SubbieList Pro enquiries. If you ask about Pro, we keep your name, email, company, role and what you'll use it for, so we can set up Pro and reply to you.
• Technical data. Our servers see your IP address and browser details, like any website. We use the IP address briefly, in memory, to limit how many contact reveals, corrections and connector requests one address can make. We don't keep it. If something breaks, our error reporting records technical details of the error, on our own server.

Why we use it

We use business information to publish an accurate directory of licensed trades that head contractors, builders and the public can search, and to let businesses control how they're contacted.

We use visitor information to run the site, keep it fast and secure, stop scraping and abuse, understand which pages are useful, and answer correction requests.

We don't sell personal information, and we don't use it to send you marketing.

Cookies

• sl_sid: a random browser ID used for contact-reveal counts and rate limits. Lasts 7 days.
• sl_flash: shows a one-off confirmation message after you submit a form. Lasts a minute.
• _ga and _ga_*: Google Analytics. You can block these in your browser or with Google's opt-out add-on.

Who we share information with

Listings are public. Anyone using the site, or an AI assistant connected to it, can see them, apart from contact details a business has set to "on request".

These services process information for us to run SubbieList:

• Hetzner, which hosts our servers and database in Finland
• Cloudflare, which carries all traffic to the site and protects it
• Google, for Google Analytics
• Microsoft 365, which holds our corrections mailbox, in Australia
• search services we use to find business websites, which receive business names and suburbs only
• OpenRouter and the AI model provider it routes to, which receive the text of business websites so we can pick out contact details. They never receive anything about visitors.

We may also disclose information if the law requires it.

Information stored or processed overseas

Our servers are in Finland. Cloudflare, Google and OpenRouter are based in the United States and may process data in the United States and other countries where they operate. The AI model provider OpenRouter chooses may be in another country again. Where we use an overseas service, we choose established providers and take reasonable steps to make sure they handle personal information consistently with the Australian Privacy Principles.

Security and how long we keep it

Information is stored in our own database on servers we manage, behind encrypted connections. The admin area is protected by a separate sign-in, and only we have access. Passwords and API keys are kept encrypted. No system is perfectly secure, but if we ever have a breach that's likely to cause serious harm, we'll tell the people affected and the Information Commissioner as the law requires.

We keep information only as long as we need it for the reasons above. When a business asks us to remove its contact details, we take them off the site.

Accounts

Accounts for head contractors (saved lists, notes, licence monitoring) and for businesses claiming a listing aren't open yet. When they open, we'll update this policy to say what we collect for them before anyone signs up.

Your choices

• Correct a listing. Use "Report an error" on the listing, or the correction form.
• Hide your phone and email. Claim your listing and set contacts to "On request", or email us and we'll do it.
• Remove a listing. Use the correction form or email us from an address linked to the business. Licence facts come from the public QBCC register, but we'll consider any request to remove a sole trader's listing.
• See what we hold about you. Email us and we'll tell you, usually within 30 days. It's free.

Complaints

If you think we've mishandled your personal information, email [email protected] and tell us what happened. We'll look into it and reply within 30 days. If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au ↗.

Changes

We'll post any changes here and update the date at the top.