How EMBlaze handles your information

What we collect

• Account details: your name, email address, password (stored hashed), and, if you enable it, your mobile number for login codes, authenticator app secrets, passkeys and a record of trusted devices.
• Building records: building names, addresses, National Construction Code class, installed fire safety systems, checklist answers, notes, corrective actions and reminders.
• Documents you upload: Occupier Statements, evacuation plans, maintenance records (including contractors' Form 71 and Form 72), certificates and evidence photos, plus the summaries generated from them.
• Activity records: who created, changed, shared, downloaded or deleted buildings and documents, and when. These are kept for audit purposes.
• Technical data: login times, IP addresses and browser details used for security, and error reports if something goes wrong.

Why we collect it

To run your account securely, to help you assess and record your building's fire safety obligations under the Building Fire Safety Regulation 2008 (Qld), to remind you of upcoming deadlines, to produce reports you ask for, and to fix problems with the service. We do not sell personal information or use it for advertising.

Where your information is stored

Your account, building records and uploaded files are stored on servers located in Australia. Email from EMBlaze is sent from those same servers.

Services we use that receive some of your information

Some features rely on specialist providers. Only the information needed for that feature is sent, and these providers may process it outside Australia:

• AI analysis (Anthropic): when you upload an Occupier Statement, use the compliance assistant, or generate an Occupier Statement draft, the document contents or your question together with your building's profile are sent to Anthropic's Claude API to produce the summary or answer. Under Anthropic's commercial terms this information is not used to train their models.
• Login codes (Twilio): if you choose SMS as your second factor, your mobile number and the one-time code are sent through Twilio.
• Address lookup (Google): the address you type when adding a building is sent to Google's Places service to fill in the suburb and postcode.
• Error monitoring (Sentry): if the application encounters an error, technical details about the request may be sent to Sentry so we can fix it. Personal details are not deliberately included.

Who can see your buildings

Only you and the people you share a building with can see its records. Emcorp Group staff who administer EMBlaze can access accounts and records to provide support, and every such access is logged.

How long we keep it

Fire safety records are kept while your account is active so you can show your compliance history. If you delete a building, its records are retained but hidden and can be restored on request. If you close your account, we delete your personal information within 90 days unless we are required to keep it longer.

Security

Every account uses two-step login. Data travels over encrypted connections. Access is restricted to the people you share with, and administrative access is logged. If a data breach is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Your choices

You can view and update your details from your profile at any time, download the documents you have uploaded, remove people you have shared with, and ask us to correct or delete your information. To make a request or a complaint, email itsupport@emcorp-group.com. If you are not satisfied with our response you can contact the Office of the Australian Information Commissioner at oaic.gov.au.