Privacy Policy

KAOS ("we", "us", or "our") is a business management platform operated by Kaos. This Privacy Policy explains how we collect, use, store and protect information about you when you use our platform at kaos.app and any associated services.

By creating a KAOS account, you agree to the collection and use of information in accordance with this policy.

We collect information you provide directly when you:

• Create an account — name, email address, phone number and password
• Set up a workspace — business name, ABN/ACN, address and contact details
• Use the platform — clients, jobs, invoices, purchase orders, and related business records you create
• Contact us — any correspondence you send to our support team

We also collect limited technical data automatically, including IP address, browser type, device information and usage patterns, to ensure the platform runs correctly and securely.

We use the information we collect to:

• Provide, operate and improve the KAOS platform
• Send transactional emails such as invoices, quotes and work orders on your behalf
• Authenticate your identity and maintain account security
• Respond to support requests and communicate about your account
• Comply with legal obligations and resolve disputes

We do not sell your personal data to third parties. We do not use your business records for advertising purposes.

KAOS uses the following third-party services to operate the platform:

• Supabase — authentication and database hosting. Your data is stored on Supabase-managed infrastructure.
• Resend — transactional email delivery. Email content and recipient addresses are processed through Resend to deliver emails on your behalf.
• Basiq — bank feed integration (optional). If you connect a bank account, Basiq processes your banking credentials and transaction data under their own privacy policy.

Each of these providers maintains their own privacy and security standards. We select providers that comply with applicable data protection laws.

Your data is stored on servers located in Australia and/or the United States, depending on the service provider. We implement reasonable technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction.

While we take security seriously, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

We retain your account data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, unless we are required to retain it by law (for example, for tax or accounting purposes).

Business records such as invoices and purchase orders may be retained for up to 7 years to comply with Australian tax law requirements.

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Export your data in a portable format
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at privacy@kaossystem.com.au.

KAOS uses a small number of cookies to run the platform. We do not use advertising, marketing or third-party tracking cookies, and we do not sell any information collected via cookies.

The cookies we set fall into two categories:

• Authentication cookies — set by Supabase Auth to keep you signed in and maintain your session securely. Without these, you cannot log in to the platform.
• Preference cookies — remember settings like your active workspace, so you don't have to reselect it on every visit.

All cookies we set are strictly necessary for the platform to function — there is no separate consent banner because we don't use any non-essential cookies. You can block or delete cookies in your browser settings, but doing so will affect your ability to log in and stay signed in to KAOS.

Some third-party services we use — Stripe (payments) and Basiq (bank feeds, if you connect an account) — may set their own cookies when you interact with their hosted pages (for example, Stripe Checkout or a bank connection flow). Those cookies are governed by Stripe's and Basiq's own cookie policies, not this one.

KAOS is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via a notice on the platform. Your continued use of KAOS after changes take effect constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or how we handle your data, please contact us:

• Email: privacy@kaossystem.com.au
• Company: Kaos
• Country: Australia