Privacy Policy

Last updated: July, 2026

This Privacy Policy describes how StationOne collects, uses, discloses, and protects information in connection with the Service, and explains Your privacy rights.

We use Personal Data to provide and improve the Service. By using the Service, You agree to the collection and use of information in accordance with this Privacy Policy.

1. Interpretation and Definitions

For the purposes of this Privacy Policy:

Account means a unique account created for a User to access the Service.
Company (“the Company”, “We”, “Us”, “Our”) refers to FireHouse Labs Pty Ltd, Victoria, Australia.
Cookies are small files placed on Your Device by a website to store information such as browsing history and login state.
Country refers to Victoria, Australia.
Device means any device that can access the Service, such as a computer, phone, or tablet.
Member/Personnel Data means personal information about brigade members, cadets, or personnel that an Organisation or Unit enters into the Service, including individuals who do not themselves hold a login Account.
Organisation and Unit have the meanings given in Our Terms of Use — the customer entities that control what data is entered into the Service and who has access to it.
Personal Data is any information that relates to an identified or identifiable individual.
Public Access Feature means a feature of the Service accessible via a public link, QR code, or access token without an Account (e.g. public inspections, public brigade portals, public bookings).
Service refers to the StationOne platform, including the Website and any associated native applications.
Service Provider means any third party that processes data on Our behalf to help operate or improve the Service.
Usage Data means data collected automatically through use of the Service or its infrastructure.
Website refers to StationOne, accessible from https://stationone.com.au.
You means the individual or entity using the Service.

2. Our Role: Who Controls Your Data

StationOne is a business-to-business platform used by Organisations (fire brigades and emergency service bodies) to manage their operations. This means two different relationships apply to Personal Data in the Service:

Your Organisation or Unit as data controller: When an Organisation or Unit administrator enters Member/Personnel Data (such as names, contact details, licence classes, appointments, attendance, or inspection sign-offs) about its members — including members who never log in themselves — that Organisation or Unit determines what is collected and why. Individuals with questions about data held about them in this context should generally contact their brigade or Organisation administrator in the first instance, who can also raise the matter with Us.
StationOne as service provider/processor: We process that data on the Organisation’s behalf, in accordance with this Policy and Our agreement with the Organisation, solely to provide, secure, and support the Service.
StationOne as controller for account-level data: For data relating directly to Your use of the Service as an individual (e.g. Your login credentials, session activity, and communications with Us), We act as the relevant party responsible for that data.

3. Information We Collect

Account and Registration Data

When You register, are invited, or log in via a passwordless magic link, We collect information such as Your name, email address, phone number, assigned roles, appointments, and licence/endorsement details (e.g. driving licence classes) where entered by an administrator.

Member/Personnel Data

Organisations and Units may enter Personal Data about brigade members who do not hold their own login, for rostering, licensing, training, and compliance purposes. This data is controlled by the Organisation or Unit, as described in Section 2.

Operational and Inspection Data

The Service stores records generated through Your use of it, including inspection responses and scores, vehicle and equipment records, driving logs, hydrant records, training/event attendance, and photos attached to inspections (stored via Our cloud storage provider).

Location and Geospatial Data

To support hydrant mapping and sync features, Organisations may configure response area boundaries (geographic polygons), and hydrant records include geographic coordinates. Where sourced from third-party datasets (e.g. state fire authority ArcGIS feeds), this data is subject to the accuracy and terms of that third-party source.

Public Access Feature Data

Where a Public Access Feature is used (e.g. a QR-based public inspection or booking), We may collect information voluntarily provided by the person using the link — such as a name entered for “conducted by,” photos, or booking details — without that person holding an Account. Because access is via a shareable token rather than authentication, anyone with a valid link can submit or view the corresponding information; Organisations and Units are responsible for controlling distribution of their public links.

Payment Data

Subscription payments are processed by Our third-party payment processor, Stripe. We do not store full payment card details ourselves; Stripe’s handling of payment data is subject to Stripe’s own privacy policy and PCI-DSS obligations.

Usage Data

We automatically collect Usage Data when You use the Service, including IP address, browser type and version, device identifiers, pages/features visited, and time spent, via Our analytics tooling.

Error and Diagnostic Data

We use third-party error tracking and monitoring services to detect and diagnose issues with the Service. These tools may incidentally capture technical context (such as request metadata) at the time an error occurs.

4. Cookies and Tracking Technologies

We use Cookies and similar technologies for:

Necessary/Essential Cookies (Session) — required to authenticate Users and maintain login sessions; without these, the Service cannot function.
Functionality Cookies (Persistent) — remember preferences such as login state, so You are not required to re-authenticate unnecessarily.
Analytics Cookies — help Us understand how the Service is used so We can improve it.

You can configure Your browser to refuse Cookies, but some parts of the Service may not function correctly without them.

5. How We Use Personal Data

We use Personal Data to:

provide, operate, and maintain the Service, including authentication and multi-tenant access control;
enable Organisation/Unit administrators to manage rosters, inspections, licensing, and compliance records;
process Subscription payments and manage billing;
send operational notifications (e.g. inspection reminders, overdue actions, trial expiry notices), subject to Your notification preferences where configurable;
maintain the security and integrity of the Service, including detecting fraud or unauthorized access;
analyse usage trends to improve the Service; and
comply with Our legal obligations.

We do not sell Personal Data.

We may share Personal Data:

With Service Providers who help Us operate the Service, including cloud hosting and storage (Amazon Web Services), payment processing (Stripe), email delivery, error tracking, and analytics providers — under contractual obligations to protect that data;
With third-party data sources where an Organisation enables integration with external geospatial datasets (e.g. state hydrant data providers), to the extent necessary for that integration;
Within Your Organisation or Unit hierarchy, since role-based access is a core feature of the Service — administrators may see data for Units and members within their scope of authority;
Via Public Access Features, where the Organisation or Unit has enabled a public link — information submitted or displayed through that link is accessible to anyone with the link;
For legal reasons, where required to comply with a legal obligation, protect the rights, property, or safety of the Company, Our Users, or the public, or investigate wrongdoing;
In connection with a business transfer, such as a merger, acquisition, or asset sale, subject to notice as described below; and
With Your consent, for any other purpose You agree to.

7. International Data Transfers

The Service may be hosted using infrastructure and Service Providers located outside Your jurisdiction, including outside Australia. Where Personal Data is transferred overseas, We take reasonable steps to ensure it continues to be protected consistently with this Policy and applicable law, including the Australian Privacy Principles.

8. Data Retention

We retain Personal Data only for as long as necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce Our agreements. Operational and compliance records (such as inspection history) are often retained for extended periods at the direction of the Organisation, reflecting the ongoing compliance value of that data. Usage and diagnostic data is generally retained for shorter periods unless needed for security or legal purposes.

When an Organisation or Unit’s Account is closed, We retain or delete associated Content in line with Our data retention practices and any applicable legal requirements, and in accordance with Our agreement with that Organisation.

9. Your Rights and Access to Your Data

Subject to applicable law (including the Australian Privacy Principles under the Privacy Act 1988 (Cth)), You may have the right to request access to, correction of, or deletion of Personal Data held about You. Where the data is Member/Personnel Data controlled by Your Organisation or Unit (see Section 2), please direct requests to your Organisation/Unit administrator in the first instance; We will assist them as needed. For Account-level data We control directly, You may update certain details via Account settings or by contacting Us.

We may need to retain certain information where We have a legal obligation or legitimate business reason to do so, even after a deletion request.

If You believe Your privacy rights have not been respected, You may lodge a complaint with Us or, in Australia, with the Office of the Australian Information Commissioner (OAIC).

10. Security of Your Personal Data

We use reasonable administrative, technical, and physical safeguards designed to protect Personal Data, including encrypted credential storage and access controls scoped to Organisation/Unit hierarchies. However, no method of transmission or storage is completely secure, and We cannot guarantee absolute security. In the event of a data breach likely to result in serious harm, We will act in accordance with applicable notifiable data breach obligations.

11. Children’s and Junior Member Data

The Service is designed for use by adult Organisation and Unit administrators managing brigade operations. Some brigades operate junior or cadet programs and may record Personal Data about members under the age of 18 for legitimate rostering, training, and safety purposes. Organisations and Units entering such data are responsible for ensuring they have an appropriate legal basis and, where required, parental or guardian consent to do so. If You believe a junior member’s data has been provided to Us without appropriate authority, please contact Us or the relevant Organisation so it can be addressed.

12. Public Access Features: Additional Notice

Because Public Access Features do not require an Account, individuals using a public link or QR code should be aware that information they submit (such as a name or photo) may be visible to the Organisation or Unit that issued the link, and that access to the link itself is not restricted to any particular person. If You were directed to a StationOne public link by a brigade or organisation, that entity is responsible for how the link is distributed and for informing you of its purpose.

13. Links to Other Websites

The Service may contain links to third-party websites not operated by Us. We recommend reviewing the privacy policy of any third-party site You visit. We have no control over, and assume no responsibility for, the content or privacy practices of third-party sites.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and revise the “Last updated” date. For material changes, We will make reasonable efforts to notify You, such as via email or a prominent notice within the Service, prior to the change taking effect. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

15. Contact Us

If you have any questions about this Privacy Policy, You can contact Us by email.