1. Who We Are

ComPassport is a digital competency licensing platform operated by Dion Porter (ABN: 45642791533) as a sole trader, trading as ComPassport, based in Victoria, Australia.

ComPassport provides a platform that allows construction workers to store and share their competency licenses digitally, and allows businesses to manage workforce compliance. References to "ComPassport", "we", "us" or "our" in this policy refer to this business.

2. Information We Collect

2.1 Workers

When you register as a worker and use ComPassport, we may collect:

• Full name, email address and phone number
• Trade, employer and work location (Victoria, Australia)
• Competency license details — license type, license number, issuing body, issue date and expiry date
• Uploaded license documents — photographs or PDF copies of your certificates
• Your unique QR code identifier and public verification link
• Account credentials (email and encrypted password)

2.2 Registered Training Organisations (RTOs)

When an RTO registers to issue credentials through ComPassport, we may collect:

• RTO business name, national RTO code, and contact details
• Name and email of the account administrator
• Website and landing page links displayed to workers and verifiers
• Records of the credentials the RTO has issued through the platform
• Billing details for issuance fees, once payment processing is implemented (processed securely via Stripe — we do not store card details)

2.3 Technical Information

We automatically collect certain technical information when you use our platform:

• IP address and general location (city/state level only)
• Device type, operating system and browser
• Pages visited and features used within the platform
• Time and date of access

3. How We Collect Your Information

We collect information in the following ways:

• Directly from you — when you register an account, upload a license, fill in your profile or contact us
• From an RTO — when a Registered Training Organisation issues a competency credential directly to your wallet
• Automatically — when you use the platform, certain technical data is collected through standard web technologies

4. How We Use Your Information

We use the information we collect to:

• Create and manage your ComPassport account
• Store and display your competency licenses in your digital wallet
• Generate and operate your unique site check-in QR code
• Allow anyone with your QR code or verify link to check your credentials, without needing an account of their own
• Send you expiry alerts and renewal reminders for your licenses
• Allow RTOs to issue competencies directly to your wallet
• Automatically extract licence details from photos you choose to scan, using a third-party AI service, to save you re-typing them
• Process payments from RTOs for credentials they issue, once payment processing is implemented
• Improve and develop the ComPassport platform
• Respond to your enquiries and provide support
• Comply with our legal obligations

5. Who We Share Your Information With

5.1 When you present your QR code

When a site supervisor scans your ComPassport QR code, they will see your name, trade, and the details of your competency licenses including license numbers, expiry dates and issuing bodies. You control when and to whom you show your QR code.

5.2 Anyone with your QR code or verify link

Your public verification page shows your name, trade, state, profile photo and competency licence details to anyone who scans your QR code or opens your verify link — in the same way a physical licence card can be shown to anyone on request. Do not share your QR code or link with anyone you do not want to see this information.

5.3 RTOs and training providers

If an RTO or training organisation issues a qualification directly to your wallet, they will have a record that they have done so. They will not have ongoing access to your other license data.

5.4 Service providers

We use a small number of trusted third-party services to operate the platform. These providers only access your data to perform services on our behalf and are bound by confidentiality obligations:

• Supabase — secure database and file storage (data hosted in Seoul, South Korea)
• Anthropic — if you choose to scan a licence card to auto-fill your details, the photo is processed by Anthropic's AI service to extract the information. This data is not used to train Anthropic's models and is not retained beyond what is needed to process your request
• Stripe — payment processing for RTO issuance fees, once implemented (we never see or store your card details)
• Vercel — platform hosting and delivery
• Resend — sending transactional emails such as expiry reminders and verification records

5.5 Legal requirements

We may disclose your information if required to do so by law, court order or a regulatory authority, or if we believe disclosure is necessary to protect the safety of any person.

6. How We Store and Protect Your Data

Your data is stored securely using industry-standard encryption both in transit (SSL/TLS) and at rest. Our database is hosted by Supabase in Seoul, South Korea data centres. We use Supabase's Row Level Security (RLS) to ensure that users can only access their own data. Uploaded license documents are stored in a private, encrypted storage bucket and are not publicly accessible.

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access. However, no method of internet transmission or electronic storage is 100% secure, and we cannot guarantee absolute security.

7. How Long We Keep Your Data

We retain your personal information for as long as your account is active or as needed to provide you with our services. Specifically:

• Active accounts — we retain your data for the duration of your account
• Deleted accounts — when you delete your account, we permanently delete your personal data immediately, including all licence records (whether self-added or issued by an RTO) and any uploaded documents or photos, except where we are required by law to retain it. If you create a new account later, this data cannot be restored — any RTO-issued credentials will need to be reissued to your new account by the relevant RTO.
• Billing records — retained for 7 years as required by Australian tax law

8. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate or incomplete information
• Deletion — request deletion of your account and personal data
• Portability — request an export of your license data in a standard format
• Complaints — lodge a complaint with us or with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au

To exercise any of these rights, contact us at compassportsupport@gmail.com. We will respond within 30 days.

9. Cookies and Tracking

ComPassport uses essential cookies to keep you logged into your account and to maintain your session. We do not use advertising cookies, tracking pixels or third-party analytics that share your data with advertisers.

You can disable cookies in your browser settings, but this may prevent you from logging in or using certain features of the platform.

10. Third-Party Services

Our platform may contain links to third-party websites such as WorkSafe Victoria, the VBA, or VicRoads for reference purposes. These sites have their own privacy policies and we are not responsible for their content or practices. We encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

ComPassport is not intended for use by persons under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology or legal requirements. When we make material changes, we will notify you by email or by displaying a prominent notice on the platform. The updated policy will take effect from the date shown at the top of this page.

We encourage you to review this policy periodically.

13. How to Contact Us

If you have any questions, concerns or complaints about this privacy policy or how we handle your personal information, please contact us:

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.