Privacy Policy

Last updated: 17 October 2026 · Terms of Service · Cookie Policy

  Plain-English summary: We collect the information needed to run your Rafter account. We do not sell your data or use it for advertising. We use a small set of trusted subprocessors (listed below). You can request a copy of your data or ask us to delete it at any time.

1. Who we are

This Privacy Policy describes how William John Thurlow, ABN 19 255 370 916, trading as Deep Green Sea ("Deep Green Sea", "we", "us", "our") collects, uses and discloses personal information in connection with the Rafter platform ("Rafter").

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). For questions or complaints about our privacy practices, contact us at info@deepgreensea.au.

2. Information we collect

2.1 Information you provide directly

Account information: your name, email address, and business name when you create a Rafter account.
Business details: your business logo, ABN, address, bank details, and contact information that you enter in your Rafter settings to appear on quotes.
Quote content: job descriptions, site addresses, materials, pricing, photos and any other information you include in quotes.
Customer information: names, addresses and contact details of your customers as entered in quotes. You are responsible for having a lawful basis to provide this information to us.
ServiceM8 connection (Pro plan): OAuth tokens that allow Rafter to create jobs and attach quotes in your ServiceM8 account on your behalf.
Payment information: collected and processed by Stripe. We do not store full card numbers or payment credentials on our systems.

2.2 Information collected automatically

Usage data: pages visited, features used, and errors encountered, collected to operate and improve the Service.
Log data: IP address, browser type, and timestamps, collected by Cloudflare as part of hosting the Service.
Session data: authentication session tokens managed by Clerk to keep you signed in.

Rafter does not use advertising trackers, third-party analytics SDKs, or behavioural profiling tools.

3. How we use your information

Purpose	Information used	Basis
Providing and operating the Service	Account info, business details, quote content, customer info	Contract performance
Authentication and security	Email, session tokens, device info	Contract performance / legitimate interest
Billing and payment processing	Email, subscription plan, payment method (via Stripe)	Contract performance
Transactional emails (quote delivery, account notices)	Email address, quote content	Contract performance
Improving the Service	Aggregated usage data, error logs	Legitimate interest
Legal compliance and fraud prevention	Account info, log data	Legal obligation / legitimate interest

We do not use your Customer Content (quote data, photos, business details) for any purpose other than providing the Service to you.

4. Subprocessors

We share personal information with the following subprocessors, which provide infrastructure and services that Rafter relies on. Each is engaged under contractual obligations regarding data protection.

Subprocessor	Purpose	Location	Privacy info
Cloudflare, Inc.	Hosting, CDN, edge computing, infrastructure	USA (global CDN)	cloudflare.com/privacypolicy
Clerk, Inc.	Authentication, user accounts, session management	USA	clerk.com/legal/privacy
Resend, Inc.	Transactional email delivery (quote emails, account notices)	USA	resend.com/legal/privacy-policy
Stripe, Inc.	Payment processing and subscription billing	USA (AU entity for AU payments)	stripe.com/au/privacy
ServiceM8 Pty Ltd	Field service management integration (Pro plan only, at your direction)	Australia	servicem8.com/privacy

5. Overseas transfers

Several of our subprocessors (Cloudflare, Clerk, Resend, Stripe) are based in the United States. By using Rafter you consent to your personal information being transferred to and processed in the United States and potentially other countries. We take reasonable steps to ensure these subprocessors handle your personal information consistently with the Australian Privacy Principles, including through reliance on their standard contractual protections.

6. Data retention

Active accounts: we retain your data for as long as your account is active.
Cancelled accounts: data is retained for 90 days following cancellation and then deleted, unless we are required to retain it for legal or compliance purposes.
Quote content: quote records and attached PDFs are retained as part of your account. On account deletion, these are deleted from our systems (deletion from Cloudflare CDN caches may take additional time).
Billing records: payment records are retained for 7 years as required for tax purposes.

7. Security

We implement reasonable technical and organisational measures to protect personal information from unauthorised access, disclosure, alteration and destruction. These measures include:

passkey-based authentication with no passwords stored by Deep Green Sea;
encryption in transit (TLS) for all data exchanges;
access controls limiting which systems and personnel can access customer data;
Cloudflare's enterprise-grade infrastructure security.

No method of transmission or storage is 100% secure. If you become aware of a security issue with your account, please notify us immediately at info@deepgreensea.au.

8. Your rights

Under the Australian Privacy Principles you have the right to:

Access: request a copy of the personal information we hold about you.
Correction: request correction of inaccurate or incomplete personal information.
Deletion: request deletion of your personal information (subject to legal retention obligations).
Complaints: lodge a complaint with us, or with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

To exercise any of these rights, email info@deepgreensea.au. We will respond within 30 days. There is no charge for reasonable access requests.

9. Cookies

Our use of cookies is described in our Cookie Policy. In summary: we use only essential cookies required for authentication and payment. We do not use advertising or analytics cookies.

10. Children

Rafter is not directed at children under 18 years of age. We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a child, please contact us at info@deepgreensea.au and we will delete it promptly.

11. Changes to this Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by updating the "Last updated" date at the top of this page. Continued use of Rafter after a change constitutes acceptance of the updated Policy.

12. Contact

Privacy questions, access requests and complaints:

Deep Green Sea
William John Thurlow t/as Deep Green Sea
ABN 19 255 370 916
info@deepgreensea.au
Victoria, Australia

If you are not satisfied with our response to a privacy complaint, you may contact the OAIC at oaic.gov.au/privacy/privacy-complaints.