⚠ Draft — not yet reviewed by a lawyer. Treat this as a plain-English starting point, not a finished legal document, until it's been checked against Australian Consumer Law and the Privacy Act 1988 (Cth).
Terms & Conditions
Last updated 30 August 2026
1. Who this is with. Kept is provided by Lawn Envy Australia (ABN 19 863 392 800). By ticking the box to create an account, or by continuing to use the app, you agree to these terms on behalf of the business you're signing up.
2. The service. Kept is software for running a trade business — quoting, scheduling, invoicing, staff pay runs, and an optional job-request marketplace. It's provided as a web app you can install to your phone or computer; some features work offline.
3. Your account. One account per business. You're responsible for keeping your login and team passphrase secure, and for what happens under logins you create for staff. Tell us if you think an account's been compromised.
4. Plans and billing. New accounts start on the Free plan, which you can use for as long as you like within its limits — no trial, no credit card required. Current plans, features and pricing are shown in the app and on our pricing page and may change with reasonable notice. Fees for a paid plan are billed in advance from the day you upgrade; a missed payment may result in your account being suspended (your data is kept, not deleted) until it's resolved.
4a. Refunds and cancellation. The Free plan never charges you — there's no card on file until you choose to upgrade. Once you're on a paid plan, you can cancel any time from Settings → Plan or by emailing us; cancelling stops the next charge and you keep access until the end of the period you've already paid for. Part-months aren't refunded as a matter of course, since you keep that access, and mid-cycle plan changes are prorated automatically. If we charge you in error — a duplicate, a charge after you cancelled, or the wrong rate — tell us and we'll refund it in full. None of this limits your rights under the Australian Consumer Law: if the service has a major failure you're entitled to a refund or to cancel regardless. Payments you take from your own clients are governed by your own refund policy, not this one.
5. Your data. Your business data — clients, jobs, invoices, expenses and so on — belongs to you. Kept offers two storage modes, chosen per business in Settings → Account & sync: Standard (the default) stores it in ordinary, readable form on our servers, while Secure additionally encrypts it on your own device before it ever reaches us, using a password/passphrase only you and the people you invite hold. In Secure mode we cannot read your data, and cannot recover it for you if every device and passphrase is lost, unless you've separately opted in to the optional recovery-assistance feature described in the Privacy Policy below. Whichever mode you use, you can download a full backup of your data from Settings at any time.
6. The marketplace. Job requests from consumers are matched to nearby businesses on the relevant trade. Submitting a quote there doesn't guarantee you'll win the job, and we don't guarantee a minimum number of quotes will be available to a consumer. We may adjust matching, radius and fairness rules over time to keep the marketplace useful for everyone using it.
7. Acceptable use. Use the app for genuine trade-business purposes. Don't try to access another business's data, abuse the marketplace or demo sandbox, resell or share your login outside your own staff, or attempt to circumvent rate limits or plan restrictions. We can suspend an account that's actively abusing the service while we sort it out.
8. Availability. We aim to keep the service available and reliable but don't promise it will be uninterrupted or error-free — parts of it depend on third-party services (see the Privacy Policy) that are outside our control. There's no formal uptime guarantee unless we've separately agreed one with you in writing.
9. Estimates, not advice. Figures the app calculates for you — tax withholding, superannuation, GST, mileage deductions and similar — are estimates to help you plan, not professional tax, legal or financial advice. Always confirm real figures with your accountant or bookkeeper before relying on them, especially before lodging anything with the ATO.
10. Liability. To the extent the law allows, the service is provided as-is, and our liability to you is limited to the fees you've paid in the 3 months before a claim. Nothing here excludes any guarantee you're entitled to under the Australian Consumer Law that can't lawfully be excluded.
11. Ending your account. You can stop using the service at any time; download a backup first if you want to keep a copy. We may suspend or close an account for a serious breach of these terms, non-payment, or if we stop offering the service, and will give reasonable notice where we can.
12. Changes to these terms. We may update these terms from time to time; the current version is always available from Settings. Continuing to use the app after a change means you accept the update.
13. Governing law. These terms are governed by the laws of Queensland, Australia.
Privacy Policy
Last updated 30 August 2026
What we collect. Your login email, and basic business details (name, industry, phone, address) used for things like invoice headers and branding. Almost everything else you enter — clients, jobs, quotes, invoices, financials — is stored the way your business has chosen in Settings → Account & sync: in Secure mode it's encrypted on your device before it's stored, so we hold it only as unreadable ciphertext; in Standard mode (the default) it's stored in ordinary, readable form. If you use the marketplace, we also handle job-request details submitted by consumers (suburb, postcode, job description, contact details) so they can be matched to nearby businesses. Your device also computes and sends us a small set of operational numbers — revenue, expenses, profit, average job cost, quote win rate and client retention — plus your industry and service postcode, so we can show you Insights on your dashboard and how you compare to de-identified averages for similar businesses. This is on by default; you can turn it off any time in Settings → Account & sync, and it never includes client names, addresses, job descriptions or any other content — only the numbers themselves.
How your data is protected. This depends on which storage mode your business has chosen in Settings → Account & sync.
In Secure mode, business data is encrypted client-side with a key derived from your own password (and, for team accounts, a shared team passphrase) before it ever leaves your device. We don't hold that key, so we genuinely cannot read the encrypted copy of your jobs, clients or invoices — including if legally compelled to hand over what we store, since what we store is ciphertext. Two specific features are a narrow, deliberate exception: sending an invoice or quote stores the client's email address and that document's line items and amount in plain, readable form, so our client portal can show it to them without needing your encryption key; and booking a job against a client's phone number stores that client's name, phone, address and the job date in plain form, to power the automated "your appointment is tomorrow" text reminder. Both are limited to exactly what those two features need — never your full client list or job records. If you've lost every device and passphrase, recovery is only possible if you've opted in to the optional operator-assisted recovery feature (Settings → Account & sync), which uses a private key kept entirely offline by the operator and never stored on any server.
In Standard mode (the default), business data is stored in ordinary, readable form, protected the same way the rest of our systems are: access controls restricting who and what can read it, and encryption in transit and at rest against outside interception or a stolen disk. Unlike Secure mode, we are technically able to read this data ourselves, and would produce it in readable form if legally compelled to.
How your Insights numbers are protected. The Insights & benchmarking numbers described above are handled separately from the rest of your business data: they aren't end-to-end encrypted — even for a Secure-mode business — because we need to hold them in readable form to show you a comparison. They're encrypted in transit and at rest, and access to them is restricted to what our systems need to compute and display them. If you turn this off in Settings, no further numbers are sent from that point on.
Who we share data with. We use a small number of service providers to run the platform, each only for what they need to do their job: Supabase (database hosting and login/authentication), Vercel (hosting the app, marketing site and client portal), Stripe (subscription billing for your Kept plan, and Stripe Connect where you take card payments from your own clients — Stripe handles card details directly, and we never receive or store them), Xero (receives invoices you choose to sync, including client names, amounts and line items), your connected email provider (for sending invoice and quote emails — Google/Gmail, Outlook/Microsoft 365, Zoho Mail, iCloud Mail, GoDaddy Workspace Email, or another mail server you specify yourself, whichever you've set up in Settings → Sending; until you connect one, a shared Kept Gmail account is used as the fallback), ClickSend (SMS, only when a client has no email on file), and Google Maps (route directions, only if you use that feature). The current list, with what each one can see and where it operates, is kept at keptsoftware.com.au/subprocessors. None of them get access to more of your business data than what's needed to perform their specific function (e.g. the email service sees an invoice you're choosing to send, and Xero sees invoices you've chosen to sync) — see "How your data is protected" above for what Supabase itself, as our database host, can see, which depends on your business's chosen mode.
Where your data is stored. Our primary database and login system run in Sydney, Australia. Some of the other providers above store or process information overseas — Stripe, Google and ClickSend process information in the United States and other countries where they operate, and Vercel serves the app from whichever of its data centres is closest to you. For a Secure-mode business, because your business data is encrypted on your device before it reaches us, any overseas provider holding that data holds only unreadable ciphertext. Information that isn't encrypted — your login email, business name and contact details, marketplace job requests, and, for a Standard-mode business (the default), its business data too — may be stored or processed overseas in readable form. By using Kept you consent to that overseas disclosure; we choose providers we consider reputable and rely on their own contractual privacy commitments.
Marketplace sharing. A consumer's job request (suburb, postcode, description) is shown to businesses matched by trade and service area. Once they accept a quote, the winning business's name and quote amount are shared with the consumer. We don't sell this data or share it outside of matching a job to a business.
Staff accounts. If you invite staff, their login is a separate Supabase account tied to your business, restricted to job/schedule information by default. They're bound by your own acceptance of these terms as part of using an account you've set up for them.
Retention and deletion. Your data is kept for as long as your account is active. A live-demo sandbox is automatically deleted within 48 hours regardless of how it was created. If you close your account, contact us to request deletion of your stored data; suspending an account (e.g. for non-payment) keeps data intact in case you come back.
If something goes wrong. If a data breach occurs that's likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. For a Secure-mode business, because your business data is encrypted on your device with a key we don't hold, a breach of our servers would expose ciphertext rather than readable client, job or invoice records — which substantially limits the harm such a breach could cause. For a Standard-mode business (the default), business data would be exposed in readable form, the same as any other unencrypted information we hold — login emails, business contact details and marketplace job requests — and would be assessed case by case.
Your rights. Under the Australian Privacy Principles, you can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it (subject to what we're required to keep for legal or accounting reasons). One practical limit worth knowing: if your business uses Secure mode, we can't produce the encrypted copy of your business data in readable form, because we can't decrypt it either — but that data is already fully in your hands, and you can export it any time from Settings. (The narrow exception described under "How your data is protected" above — client portal and appointment-reminder records — we can produce, for either mode.) What we can produce is the information we hold in readable form: your login email, business details, billing records, any marketplace requests connected to you, and, if your business uses Standard mode (the default), your business data as well. Contact us using the details below. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
Children. This service is for businesses and their staff, not children, and isn't directed at or knowingly used to collect information from anyone under 18.
Changes to this policy. We may update this policy from time to time; the current version is always available from Settings.
Contact. Questions or requests about your data: support@keptsoftware.com.au.
