Hachi Holdings Pty Ltd (ACN 703 589 075), trading as PackOffice, provides practice software to dog trainers. This policy explains what personal information we collect, why, and how we handle it. It is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we hold ourselves to them whether or not the small business exemption would apply to us.
PackOffice holds information about two groups. Trainers (our customers) and their team members, who sign up and use the app. Clients of trainers (dog owners), whose details trainers enter or who fill in a trainer's booking page. For clients' information the trainer is the one who decides what is collected and why; we hold it on the trainer's behalf and use it only to provide the service to that trainer.
| About | What | Why |
|---|---|---|
| Trainers | Name, business name, ABN, email, phone, postal address, bank account details for invoices, logo, login credentials (password hashed by our authentication provider), subscription and billing records | To run your account, print your tax invoices, bill you, and contact you about the service |
| Team members | Name, email, pay rate and pay records entered by the trainer, login credentials | To give them a login scoped to their sessions and pay |
| Clients of trainers | Name, email, phone, address, dog details (including vaccination dates, feeding, medication and care notes for daycare and stays), vet and emergency contact details the client gives for a stay, answers to intake questions, session notes, daily care logs and report cards, invoices and payment records, messages sent to them | To provide the practice software to the trainer |
| Everyone | IP address, browser type, pages used, error logs | Security, rate limiting on public forms, fixing faults |
We do not collect card numbers. Card payments are handled by Stripe, which sends us only the last four digits and the payment outcome. We do not collect government identifiers.
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, file storage, serverless functions | Sydney, Australia |
| Stripe | Subscription billing and client card payments | Australia / United States |
| Resend | Sending email | United States |
| ClickSend | Sending SMS | Australia (storage); message delivery via carrier partners in the EU, US and Philippines |
| Cloudflare | Hosting the web pages, DNS, DDoS protection | Global edge, data at rest in Australia where possible |
Some of these providers process data outside Australia. Where that happens we rely on their contractual commitments to handle it in a way consistent with the Australian Privacy Principles. We may also disclose information where the law requires it. We will update this list before adding or replacing a provider that handles personal information, and email trainers about the change.
Every trainer's data is separated by row-level security in the database, so one practice cannot read another's. Public forms and links use single-purpose tokens; only a hash of each token is stored. Traffic is encrypted in transit. Access to production systems is limited to the people who run the service. No system is perfectly secure; what we do if something goes wrong is set out below.
Trainers sign in with an email and password, with two-factor sign-in available and recommended for practice owners. Team members have their own logins and see only the sessions and pay records the trainer assigns to them. Clients of trainers sign in to the client portal with a one-time link sent to their email, and see only their own bookings, invoices and messages. Our own staff access production data only to support a trainer who asks, or to keep the service secure, and every such access is logged.
We keep a written data breach response plan. If we suspect a breach we contain it first, assess within 30 days whether it is likely to cause serious harm, and if so notify the people affected, the trainers whose clients are affected, and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires. We will tell affected trainers within 72 hours of confirming a breach that touches their data, whether or not the scheme requires notification.
Practice data is stored in Australia (Sydney). Some providers listed above process limited information overseas: Stripe (payment details and outcomes, United States), Resend (email addresses and the content of emails we send, United States) and Cloudflare (web traffic, global). We choose providers that commit by contract to protect personal information to a standard consistent with the Australian Privacy Principles, and we stay accountable for how they handle it.
Computer programs in PackOffice make or help make these decisions without a person in the loop: matching a bank transaction to an invoice and recording the payment (using the client's name, the amount and the payment reference, where the trainer has turned a matching rule on); confirming an instant booking and issuing its invoice (using the details on the booking form, where the trainer has set that service to book straight in); and sending scheduled reminders and overdue notices (using booking and invoice dates). Each of these can be reviewed, undone or turned off by the trainer, and you can query any of them with the trainer or with us. Other rules only suggest, and a person confirms them. This section is kept current as the Privacy Act's automated-decision transparency requirement (from 10 December 2026) asks.
Booking confirmations, reminders, invoices and receipts are service messages sent because a booking or invoice exists. Anything promotional, such as a newsletter or offer, is only sent to people who agreed to receive it, always identifies the sender and always includes a way to unsubscribe, as the Spam Act 2003 requires. Clients can ask their trainer to stop text reminders at any time.
Trainers decide what they collect about their clients. When they use PackOffice they agree to collect only what they need, tell their clients how their information is used (the booking page and forms show a privacy notice for this), get consent before sending marketing, and keep their own login secure. Health or other sensitive information about a person (for example a disability an assistance dog is being trained for) is only to be recorded with that person's consent, and only where it is needed for the training work. PackOffice gives trainers the tools to export, correct and delete client records when a client asks.
PackOffice is for adults running and using a dog training business. We do not knowingly collect information from anyone under 16; booking forms must be completed by an adult. If we learn a child's details were submitted we will delete them.
For as long as the trainer's account is active, then 90 days of read-only access so they can export it, then deletion, except records we must keep by law (our own tax records) and backups, which roll off within 30 days.
The app uses local browser storage to keep you signed in. We do not run advertising trackers and we run no analytics today. If we ever add analytics it will be a cookie-free tool that does not identify you, and this policy will name it.
We will update this policy as the service changes and note the date below. Material changes are emailed to trainers.
Version 1.0, effective 26 October 2026. Contact: support@packoffice.app, PO Box 3092, Newport VIC 3015, Australia.
