Carcasso (carcasso.com.au) is joinery design and planning software with PDF drawing export. Carcasso is a business name of Taha Kabbout (sole trader), ABN 62 912 909 739. NSW 2170 Australia.
We are a sole trader operating in Australia. Small businesses under $3 million annual turnover are generally exempt from the Australian Privacy Act 1988. We voluntarily comply with the Australian Privacy Principles (APPs) and the Privacy and Other Legislation Amendment Act 2024 because we collect personal information from our users and believe in handling it properly.
Account information: Your email address and name when you register for an account.
Job data: Room measurements, materials, door styles, and configurations you create and save in Carcasso. This is your professional work data, not sensitive personal information.
What you tell us about your project, and our notes: If you answer the optional "What are you working on?" card in the app, we keep your answers (the rooms you're working on, whether you're a homeowner, tradie or designer, your timeline, and the problem you want solved) so we can help you and decide what to build next. We also keep a short private note about each account — a status, notes from our conversations and when we last contacted you. Both are included when you download your data and deleted when you delete your account.
Payment information: When you subscribe to a paid plan, your payment is processed entirely by Stripe, Inc. We never see, store, or have access to your card numbers, bank details, or CVV codes.
Usage data: Pages visited, features used, errors encountered, and session duration — collected to improve the product. This is not linked to identifiable individuals beyond your account. We also keep anonymous daily counts — for example how many exports were started, finished or failed, how often an upgrade prompt was shown, which design-check rules were broken, how often the app crashed, and how many server requests failed on each part of the service. These counts carry no account, email, IP address or job content.
Bug reports and crashes: If you send a bug report, we keep your message and, if you give it, your email address, together with the page you were on (without anything after the "?" in the address, and never a share-link code), the app version, the id of the job you had open, a short summary of that job, your browser type and recent technical error messages. If the app crashes it shows you a short reference number; that reference is only linked to you if you choose to send a report. We do not take screenshots. We keep bug reports to fix problems, and they are deleted when you delete your account if they were sent while you were signed in.
Device and technical data: Browser type, operating system, and IP address — collected automatically in server logs as standard practice for any web application.
Designs you add to the public gallery: only if you choose "Add to gallery" on a design and tick the consent box. We then store a copy of that design's cabinets, sizes, door style and colours, a 3D picture of it, the room type and a size summary, plus the wording you agreed to and when. We never include the job or client name, an address, notes, prices or who you are. Each design is checked by us before it appears at carcasso.com.au/gallery, where anyone can see it and copy it as a starting point for their own design. You can remove it at any time from the same place; it is also removed when you delete your account, and it is included when you download your data.
People who are not account holders: homeowners and clients who approve a design on a share link, or who ask us to help get a design built. See section 5.
Emails we send comply with the Spam Act 2003 (Cth): we identify ourselves as the sender, and every marketing email has a working unsubscribe link that takes effect immediately.
We use Stripe for payment processing. When you purchase a subscription, Stripe collects and processes your payment information directly. We do not store payment card data.
The following disclosure is provided as required by Stripe's merchant requirements:
Approving a design on a share link. When someone opens a design an account holder has shared and approves it or asks for changes, we collect the name and email address they type, any note they add, the date and time, and the IP address the request came from. We also keep a copy of the design and any price they were shown at that moment.
Comments on a share link. If you leave a comment on a shared design, we store your name, your email (only if you give it), the comment, what it is pinned to, the time and your IP address, for the account holder who shared it. Your name and comment (never your email or IP address) show to anyone with that link; the IP address is kept only to stop abuse, the account holder is emailed about the comment through Resend, and it is kept and deleted on the same terms as approvals above.
"Get this built" form. If you ask us to help get a design built, we collect your suburb, postcode, email address, your timeline and, if you choose, your name, phone number and a note. We also receive your design: a summary of it (room types, cabinet count, overall size, door style and colour, and the job name), a link to view it and a copy of the design file.
"Design it for me" request. If you ask us to design your room, we collect what you type into the form (the room, its measurements, windows and doors, services, appliances, the style you want and any notes), your email address, postcode, timeline and, if you choose, your name, suburb and phone number, and the photos you add: photos of the room, inspiration images and your sketch.
Stripe, Inc. — payment processing — United States. stripe.com/privacy
Supabase — database and authentication — Sydney, Australia region. This is where your account and saved jobs are stored.
Railway Corporation — hosts the Carcasso application servers. Your requests pass through these servers, including job data when it is turned into PDFs and other exports. Railway is a US company and its servers may be located outside Australia.
Cloudflare, Inc. — domain name (DNS) and network services for carcasso.com.au. Traffic to the site may pass through Cloudflare's global network. Cloudflare is a US company.
Resend — sends our emails (sign-up, account and billing emails) — United States. Resend processes the email address and content of every email we send you. We also use Resend to send ourselves a weekly backup copy of the Carcasso database (see below).
Google (Gmail) — the mailbox that receives our weekly database backups — Google's servers may be located outside Australia.
Telegram — if you send us a bug report or feedback from inside the app, it is forwarded to us on Telegram, sometimes through an automation server we run ourselves. A report can include your message, your email address, a summary of the job you had open, the page you were on, the app version, a crash reference, and recent technical error messages. We also send ourselves service alerts on Telegram (for example "the database is not answering"); these contain no personal information. Telegram's servers are located outside Australia.
Sentry (Functional Software, Inc.), error reporting, data stored in the European Union. When the app or our server hits an error, Sentry receives a technical report: the error message, the page, your browser type and a reference number. We switch off sending IP addresses and personal details to Sentry.
PostHog, Inc., product analytics and session replay, data stored in the European Union. App sessions may be recorded to improve the product, with everything typed hidden. PostHog records how the app is used (which screens and buttons) and a replay of the screen so we can find and fix the places people get stuck. Everything you type and all text on screen is masked in the replay, so your names, emails, notes and job details are not visible to us or to PostHog. We do not record the public design link your clients open.
We do not sell your personal information to any third party. We do not share your data with advertisers. We do not use your job designs or measurements for any purpose other than providing the service to you.
Stripe (USA): Payment processing data is transferred to and stored in the United States by Stripe, Inc. By using Carcasso and subscribing to a paid plan, you consent to this transfer.
Your account and saved jobs are stored in Australia, on Supabase's Sydney infrastructure. They do not stay only in Australia, though. Copies or parts of them are sent overseas in these cases:
By using Carcasso you consent to these transfers. Each provider is used only to run the service for you.
Active account: Retained for the lifetime of your account.
Cancelled subscription: If you cancel Pro, your account moves to the Free tier and we keep your account and saved jobs so you can keep exporting. We do not delete them automatically. You can delete your account yourself from Settings, or ask us to delete your data at any time by emailing [email protected].
Backups: Deleting your account removes it from our live database straight away. Weekly backup copies made before the deletion can still contain your data until those backups are deleted. If you want them deleted too, email [email protected].
On your device: Carcasso also keeps a copy of your jobs, business profile and settings in your browser, so the app works offline. Signing out removes this copy from that browser.
Payment records: Retained for 7 years as required by the Australian Taxation Office.
Server logs: Retained for up to 90 days for security and debugging purposes, then automatically deleted.
You have the following rights in relation to your personal information:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure:
No system is completely secure. In the event of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.
Carcasso uses session cookies for authentication only — these are required for the service to function and cannot be opted out of while using the app. We do not use advertising cookies or tracking pixels, and we do not use Google Analytics. Inside the app we use PostHog (EU) for product analytics and masked session replay, as described in section 6; it does not follow you to other websites and is never used for advertising.
Carcasso is a professional trade tool for use by adults in the building and joinery industry. We do not knowingly collect personal information from persons under 18 years of age. If you believe a minor has provided us with personal information, contact [email protected] and we will delete it promptly.
Carcasso uses automated calculation to produce drawings, sizes, a rough sheet count and PDF drawings from the measurements you enter. These calculations are tools to assist your workflow — no automated decisions are made about you as a person. You remain fully in control of all outputs.
If you have a complaint about how we have handled your personal information, please contact us first:
Email: [email protected]
Carcasso is a business name of Taha Kabbout (sole trader), ABN 62 912 909 739, NSW 2170 Australia.
We will acknowledge your complaint within 5 business days and respond fully within 30 days.
If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
Website: oaic.gov.au
Phone: 1300 363 992
We may update this Privacy Policy from time to time. When we make material changes, we will notify all registered users by email at least 14 days before the changes take effect. The date at the top of this page reflects the most recent update. Continued use of Carcasso after notification constitutes acceptance of the updated policy.