Privacy Policy

Managing Disaster Australia (operating under CBKM.au, "we", "us") provides The MDAu Office web platform and the FieldClaim by MDAu mobile application — disaster-recovery claim evidence and management software used by Australian councils and their contractors. Contact: hello@cbkm.au.

Account information — your name, work email address, role and organisation, provided when your administrator invites you.

Evidence you capture — photos of disaster damage, asset descriptions, measurements, notes and crew hours you record in the app. Photos are GPS-tagged and timestamped at the moment of capture; this precise location data is core to the product — it is what makes claim evidence audit-defensible.

Photos from your library — only those you explicitly attach as evidence.

Technical data — authentication tokens and basic request logs needed to operate and secure the service.

We do not collect advertising identifiers, we do not track you across other apps or websites, and we do not sell any data.

Solely to deliver the service: compiling disaster-recovery claims (DRFA and related programs), evidencing works with location-verified photos, program reporting for your organisation, and account administration. AI features (such as damage-photo classification) process your content to produce claim outputs for your organisation — your content is not used to train third-party models.

Camera — to capture damage evidence photos. Location — to GPS-stamp each photo and asset while you use the app. Photo library — to attach existing photos as evidence. Each permission is requested in context and can be declined; related features simply won't function.

Data is stored encrypted in transit (TLS) and held in our production database. Access is role-based; field devices structurally cannot access commercial data. Your data is shared only with your own organisation's authorised users and, at your organisation's direction, with government funding agencies as part of a claim lodgement (e.g. NSWRA, QRA). We use trusted processors (cloud hosting, and Google APIs only if your administrator connects Google Drive/Gmail). We never sell or rent personal information.

Claim evidence is retained for your organisation for the audit life of the disaster program it supports. You may request deletion of your account and personal data at any time by emailing hello@cbkm.au; we will action requests within 30 days, subject to legal record-keeping obligations attached to lodged claims.

We handle personal information in accordance with the Australian Privacy Principles (Privacy Act 1988). You can request access to, correction of, or deletion of your personal information at hello@cbkm.au. If you are unsatisfied with our response you may complain to the OAIC (oaic.gov.au).

The service is a workplace tool for adult council staff and contractors and is not directed at children under 16.

We will post any changes to this policy on this page and update the date above. Material changes will be notified in-app.