Privacy notice

This notice explains how PUMPS & ELECTRICAL PTY LTD (ABN 29 680 127 379), trading as StarPower Advance Solar Technology ("StarPower", "we", "us" or "our"), handles personal information through StarPower Passport. It applies to Passport accounts and features, not to separate retail transactions or other StarPower services that display their own privacy information.

Information we collect and hold

Depending on how you use Passport, we may collect and hold:

• account information, including your name, email address, optional phone number, account role and authentication records;
• passport and setup information, including setup names, use cases, installation-location descriptions and notes;
• product and ownership records, including product names, models, serial numbers, purchase and warranty dates, order or invoice references, retailer details, manuals and status information;
• content you submit for support, maintenance reminders or upgrade planning, including questions, descriptions and selected products;
• subscription and billing records, including your selected plan, billing interval, subscription status and provider references (we do not store complete payment-card details);
• retailer-workspace and marketplace information, including team membership, invitations, product claims, partner-service requests, lifecycle requests and battery-health readings you choose to record;
• questions submitted to Passport AI, the relevant passport and product context supplied with the question, generated answers and safety logs;
• images and files you choose to upload, such as product, installation or support-evidence photos; and
• technical and security information generated when the service is used, including necessary authentication-session data, timestamps, record-change audit events and hosting logs that may contain an IP address, browser or device information.

Please do not upload sensitive personal information or images of people unless it is genuinely necessary for your support request or record.

How we collect information

We collect information directly from you when you create an account, add or update a passport, record a product, upload a file, create a reminder or submit a support request. We also generate limited account, security and audit information as you use the service. When you request an order import, we query the connected Shopify store and match the order reference against your signed-in email address before returning or recording order items.

Why we handle personal information

We handle personal information where reasonably necessary to:

• create, authenticate, secure and administer your account;
• provide your digital passports, product records, private files, reminders, support requests, subscriptions, retailer workspaces, marketplace requests and authorised app features;
• show your records to you and to authorised StarPower staff who need access for administration or support;
• protect customers and the service, investigate misuse, maintain an audit trail and diagnose technical problems;
• respond to requests, complaints, legal processes and regulatory obligations; and
• maintain and improve the reliability and safety of the service using operational information that is reasonably necessary for that work.

Passport does not currently use personal information for advertising profiling or make solely automated decisions that significantly affect your rights or interests. Passport AI and deterministic upgrade planning provide general information only: they do not determine warranty, payment, compliance or legal rights, and do not place an order.

Cookies and similar technologies

Passport uses cookies or equivalent browser storage that are necessary to create, maintain and refresh a secure signed-in session. The current standalone release does not use advertising pixels, behavioural advertising cookies or third-party analytics.

Who receives information

We may disclose relevant personal information to:

• authorised StarPower staff who require it for administration, security or customer support;
• Supabase, which provides the configured authentication, database and private file-storage services;
• Render, which hosts and operates the Passport web application;
• Stripe, when you open hosted checkout or manage a subscription, for payment processing, billing and fraud prevention;
• Resend, to deliver account invitations and reminders, support confirmations or other optional operational messages you enable;
• Freshworks (Freshdesk), when a support request is transferred into the external support queue;
• Shopify, when an authorised catalogue sync runs or you request an order lookup or claim;
• OpenAI, when you choose to submit a question to Passport AI, to process that question and the limited passport context needed to produce a safety-filtered answer;
• authorised retailer-workspace personnel and reviewed marketplace partners associated with a workspace or service request, who receive only the records made available through their role and tenant;
• professional advisers, insurers, auditors or technology specialists where reasonably necessary and subject to appropriate obligations; and
• courts, regulators, law-enforcement bodies or other parties where required or authorised by law, or where reasonably necessary to protect rights, safety or the service.

Optional integrations receive information only when the relevant feature is enabled and used. Recycling and trade-in requests create a review request or marketplace lead; they do not automatically book a service, transfer ownership or approve a valuation.

We do not sell personal information. We do not make customer files public.

Overseas processing

The production database and private file-storage project is configured in Australia. Application requests are processed using Render infrastructure in Singapore. Email delivery through Resend may involve storage or processing in the United States. Stripe, Shopify, Freshworks, OpenAI and their subprocessors may process information in the United States and other countries in which they operate. Provider locations can change. Where Australian privacy law applies, we take reasonable steps required by law in relation to overseas disclosures and update this notice when likely countries materially change and it is practicable to do so.

Security

We use measures designed to protect personal information, including authenticated access, database row-level security, owner-scoped records, a private file bucket, temporary signed file links, restricted administrative roles, server-side credentials and audit logging. No online service can guarantee absolute security. Please use a strong, unique password and tell us promptly if you suspect unauthorised access.

Retention and account closure

We retain personal information while your account is active and for as long as reasonably necessary to provide Passport, maintain security and audit records, resolve support matters or disputes, and comply with legal, accounting and regulatory obligations. Retention may vary by record type. When information is no longer required, we take reasonable steps to delete or de-identify it, subject to lawful retention needs and routine backup cycles.

Archiving a passport or product hides it from active use but does not delete it. To request account closure or deletion, contact us using the details below. Some information may need to be retained where permitted or required by law.

Access and correction

You can view key account and Passport records while signed in. You may ask for access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. You may also ask for a copy in another accessible form. Contact us below. We may need to verify your identity and will respond as required by applicable law. If access or correction is refused, we will explain why where the law requires us to do so.

Your choices

You can change operational email preferences in your account, choose whether to use Passport AI, order import and marketplace features, and manage or cancel a paid subscription through the billing portal. Turning off optional email does not prevent essential account, security or legal communications. You may also request account closure as described above.

Privacy questions and complaints

Send access, correction, deletion or privacy complaints to sales@starpoweradvancesolartechnology.com, call (02) 5761 0297, or write to PUMPS & ELECTRICAL PTY LTD, 34 Castlereagh Street, Coonamble NSW 2829, Australia. Please describe the issue and provide enough information for us to investigate. We aim to respond within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner through oaic.gov.au.

Changes to this notice

We may update this notice when the service, providers or legal requirements change. We will publish the updated notice with a new effective date and provide additional notice where a change is material and it is reasonable to do so.