System Policy

This System Policy governs the operation of IWILLBUILD's platform systems, including AI-assisted tools, automated features, data handling, security controls and the Image Safeguard Protocol. It supplements the Terms of Use, Privacy Policy and Fair Use Policy.

This Policy applies to all users of the Service and to IWILLBUILD's own operation of platform systems.

IWILLBUILD provides AI-assisted tools (including Dazza AI) to help authorised users search, draft, extract, classify, summarise and analyse information they are already authorised to access.

What AI tools do:

• Generate suggestions, summaries, drafts and analysis based on information in the user's workspace.
• Assist with document creation, form completion, safety record review and job management tasks.
• Operate within the user's existing role permissions — AI tools cannot access data the user cannot access.

What AI tools do not do:

• Make final decisions on safety, legal, financial, employment or compliance matters without human review.
• Replace professional advice from qualified lawyers, accountants, engineers or safety professionals.
• Guarantee accuracy, completeness or suitability of any output.
• Access data outside the user's authorised workspace.

User obligations:

• A competent person must review all AI-assisted outputs before relying on them for any consequential decision.
• AI-generated safety documents, SWMS and risk assessments must be reviewed and approved by a qualified person before use on any worksite.
• Users must not use AI tools to generate content that would breach the Fair Use Policy or applicable law.

IWILLBUILD does not use automated tools alone to make decisions that could significantly affect a person's legal rights or interests, including decisions about employment, credit, discipline or legal entitlements.

Where the platform uses automated processes (such as subscription status checks, access controls or security rate limiting), these are operational system functions, not decisions about individual rights.

From 10 December 2026, Australian privacy law requires additional disclosures where a computer program uses personal information to make, or do something substantially and directly related to making, a decision reasonably expected to significantly affect a person's rights or interests. If IWILLBUILD introduces such a use, this Policy and the Privacy Policy will be updated before that use begins.

IWILLBUILD does not use customer job records, photos, SWMS, field data or other customer content to train public AI foundation models.

Where a third-party AI provider is used to deliver a platform feature, IWILLBUILD seeks contractual terms that prevent the provider from using customer content to train its general models unless the customer has clearly agreed otherwise.

Aggregated, de-identified usage data (such as feature interaction patterns) may be used to improve platform reliability and features. This data does not identify individual users or organisations.

The Image Safeguard Protocol is a periodic, bounded review process initiated manually by an authorised IWILLBUILD platform owner. It is not a continuous automated surveillance system.

How it works:

• A platform owner manually initiates a bounded scan of a selected set of uploaded job photos.
• Software analyses images to detect the apparent presence of a face and records a neutral privacy signal.
• Signals are reviewed by authorised IWILLBUILD support personnel before any action is taken.
• Temporary working copies of images are deleted after processing.

What the system does not do:

• Identify, name or profile any person.
• Determine age, ethnicity, emotion, health status, legality or appropriateness of content.
• Automatically delete, quarantine, report or block images based on a signal alone.
• Disable user accounts or block ordinary photo capture based on a signal alone.
• Operate continuously or without manual initiation by an authorised platform owner.

Data retained: internal asset reference, company and user identifiers where reliably known, timestamps, detector version, approximate face count, outcome and review record. Records are retained only as long as reasonably needed for security, accountability, dispute handling and legal obligations.

The automated signal alone is not treated as proof of any breach and does not itself trigger a report to authorities. Where review identifies a credible concern, access is limited to authorised personnel and any further action follows applicable law and internal procedures.

IWILLBUILD operates the following security controls as part of normal platform operation:

• Authentication controls — password hashing (scrypt for new accounts), optional two-factor authentication (TOTP and SMS), backup codes, and session management with configurable expiry.
• Rate limiting — automated rate limits on login attempts, API calls and sensitive operations to reduce brute-force and abuse risk.
• Audit logging — sign-in history, key account actions and administrative operations are logged for security and accountability purposes.
• File validation — uploaded files are validated for type, size and content before storage. Magic-byte detection and upload policies are applied per namespace.
• Access isolation — each organisation's data is isolated. Users can only access data within their authorised organisation workspace and role permissions.
• Least-privilege storage — cloud storage credentials are scoped to minimum required permissions. Storage operations are routed through a single validated chokepoint.
• Encrypted transport — all web and app traffic uses HTTPS/TLS. Data at rest is protected by cloud provider encryption.

IWILLBUILD uses Cloudflare R2 (or equivalent cloud object storage) for file, photo and document storage. Data is stored using industry-standard security controls and is isolated per organisation.

The platform is hosted on cloud infrastructure that may be located outside Australia. See the Privacy Policy (section 11) for overseas processing and disclosure details.

IWILLBUILD does not provide a silent local storage fallback. If cloud storage credentials are unavailable or misconfigured, file operations will fail rather than silently store data in an insecure location.

The platform integrates with third-party services to deliver features. Current integrations include:

• Stripe — payment processing (PCI-DSS compliant; IWILLBUILD does not store card numbers or CVV).
• Twilio — SMS delivery for two-factor authentication and notifications.
• Xero / QuickBooks — accounting integration (enabled by authorised user; data synced at user direction).
• Google Maps — mapping and location features (enabled by authorised user).
• OpenAI — AI-assisted features (customer content is not used to train general models under our terms with the provider).
• Cloudflare — cloud storage, CDN and security infrastructure.

Each integration is activated only when enabled by an authorised user or as required to operate the Service. Third-party terms and privacy policies apply to their services.

IWILLBUILD aims to provide a reliable, available Service but does not guarantee uninterrupted operation. Planned maintenance, security patching, infrastructure updates and third-party outages may affect availability.

Where planned maintenance will cause significant downtime, we will provide reasonable advance notice where practicable. Emergency security work may require immediate action without prior notice.

IWILLBUILD maintains procedures for detecting, assessing and responding to security and privacy incidents. In the event of a suspected breach:

• We will assess the nature, scope and likely impact of the incident.
• Where a breach is likely to cause serious harm and notification is legally required, we will notify affected users and the relevant regulator (OAIC in Australia; Office of the Privacy Commissioner in New Zealand).
• We will take reasonable steps to contain and remediate the incident.
• We will document the incident and our response for accountability purposes.

To report a suspected security vulnerability or incident, contact [email protected] immediately.

The IWILLBUILD iOS and Android applications are distributed through the Apple App Store and Google Play Store respectively. Use of these applications is also subject to the applicable app store terms of service.

The applications request device permissions (camera, location, notifications, file access) only where required for specific features. Permission requests are explained in context before being requested. Users may manage or revoke permissions through their device settings at any time.

The applications do not collect data beyond what is described in this Policy and the Privacy Policy. Data collected through the applications is handled consistently with data collected through the web portal.

We may update this Policy when the Service, law, providers or security practices change. We will identify the version and effective date at the top of this page. Material changes will be communicated by email or in-product notice where appropriate.

IWILLBUILD
Queensland, Australia
ABN 89 791 350 823
[email protected]
www.iwillbuild.com