Privacy Statement

Effective 3 November 2026 · Version 2026-11-03.1 · Assureworx Labs Pty Ltd

1. Who we are

Assureworx Labs Pty Ltd (ACN 699 745 876, ABN 71 699 745 876) handles personal information when you use Assureworx. We are an Australian company registered in New South Wales. In this statement, "we" and "us" mean that company.

Assureworx is a work-compliance record for Australian construction and trades. A principal contractor, a trade business, a sole trader, or a worker uses it to keep a profile, documents, job and site information, and the result of an identity check.

Privacy contact: info@assureworx.com.au

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We do that whether or not a small-business threshold would otherwise apply to us.

2. The website and the phone apps

You get an account on the Assureworx website, or a business creates the account and invites you. The iPhone app and the Android app are free apps for a person who already has an account. They are another way to open that account. They do not open a new paying account, show prices, or take payment.

This statement covers the website at assureworx.com.au, the signed-in service at app.assureworx.com.au, and those two phone apps.

3. Whose information this covers

The people and businesses in the service are:

• principal contractors and their staff, who manage jobs, sites and trade networks
• trade businesses and the people who administer them
• sole traders with an ABN
• workers invited by a trade business or a principal contractor
• people who are not on Assureworx but who receive an invitation, an enquiry reply, or a secure link to a document

If a business asks you to use Assureworx for its jobs or its workforce, that business decides why it needs your work information. It remains responsible for its own privacy duties to you, including telling you why it collected the information. We remain responsible for the information we hold in order to run the service. That includes your account, our security records, our invoices, and the record that you agreed to an identity check.

If you open your own account and pay for it yourself on the website, we collect your information to provide that account to you.

You cannot use Assureworx without giving your name. The service exists to show who a person is and whether their work documents are current.

4. What we collect

Account and profile

• your name, email address, and phone number if you give one
• a business name, ABN, and ACN where they apply
• the business declaration you accept: the exact words, your name, your account email, the ABN and entity you selected, the time, your IP address, and the browser or app you used
• the suburb, postcode and region you enter for your work area, not your full home address
• a profile photo, if you choose to add one
• trade types, roles, and which businesses and jobs you are connected to
• if you enquire as a principal contractor before you have an account: your organisation name and ABN, your name, email address, mobile number, and the message you write. We use them to reply to you

Sign-in is provided by Microsoft. We do not store your password. Microsoft does. When a second sign-in step is needed, we email you a code.

Work documents

• documents a business uploads to show it is the business it claims to be, such as a registration record, an ATO document, or an insurance certificate. We keep the file. We take from it the business name and, where the document shows them, that business's ABN or ACN
• other work documents you upload, such as a White Card, a licence, or an insurance certificate, and the details we take from them: names, an ABN, a policy or licence number, and expiry dates
• a record of who opened a document for review, and when. When a principal contractor opens a document to decide on it, we keep that person's name, email address, IP address, the browser used, and which version of the file they saw
• if a document is shared by secure link: the email address the link was made for, and for each person who opens it, their email address, the time, their IP address and browser. Each page they see is stamped with their email address and the time

Remove tax file numbers, bank details, tax amounts, and unrelated personal information before you upload. We do not need them, and we do not use a tax file number as your identifier.

Identity check

An identity check is a separate step. We ask you to agree to it in the service before it starts. Accepting this statement is not that agreement.

The check is done by Didit, on Didit's own pages. You show Didit a photo identity document and a live photo of your face. Didit then sends our server a decision. That message can include a document number, a date of birth, and links to images. We use it only to take the fields below. We do not keep the document image, the face photo, a copy of your face data, the document number, or your date of birth.

We keep:

• whether the check passed, and when
• Didit's reference for that check
• the expiry date of the document you showed
• when the check session ends
• which steps finished, quality scores for the capture, a confidence score for the face match, a confidence score for the liveness check, and the type and country of the document

Those confidence scores are numbers about the check. They are not a copy of your face.

The agreement lasts 24 months. You can withdraw it in the service. If you withdraw it, we delete the identity-check result we hold, including the copy kept so a late message from Didit can be applied. We keep the record that you gave or withdrew the agreement, and a short note that the session ended. That note does not include the result.

Jobs, sites and attendance

• job and site details, including a site address you or your business enter
• invitations, requirements, and whether a profile meets them at the time of the check
• a map pin worked out from a site address
• induction packs and site documents: that you read or acknowledged one, which version, and when
• site attendance. Sign on needs a fresh, precise location reading that confirms you are at the site. If you do not share location, you cannot sign on. You can sign off without sharing location. That sign-off is recorded with location unconfirmed. We store a location only when it places you at the site, together with how accurate the reading was and the IP address of the phone at that moment. We do not track your location in the background, and we do not record which way you are facing
• site reports: the note you write and the photos you take or choose, for example of an incident or a hazard. An incident report may say that someone was hurt. Keep it to what happened on site. Do not add medical records or details that are not needed
• the activity log of each project and site: who did what and when, with the name, email and business of the person as they were at the time. Nobody can edit or delete an entry

Phone alerts, camera and passes

• if you allow alerts, a token for that phone, so we can send a message about your work. We do not use it for advertising. Messages about payment are not sent to the phone
• photos from the camera, if you take a profile photo, photograph a document to upload, or take a photo for a site report. You can also attach a photo you already have. The apps do not use the microphone
• a digital pass for Apple Wallet or Google Wallet, if you add one. The pass can show your name, ABN, licence, trade, region and a small profile photo. When a business scans your pass at a site, it sees your name, your photo and your status at that moment

Payment, messages and security

• payment records when someone pays on the website: who the payment relates to, the amount, any GST, whether it succeeded, and the invoice. For a subscription we also keep the billing day and a reference to the payment method saved with Stripe. Card details are entered into fields provided by Stripe, or through Apple Pay or Google Pay, and go straight to Stripe. We do not receive or store card numbers
• emails about the account, such as an invitation, a sign-in code, or an email change
• a text message about the account, if we send one
• support messages you send us
• security and operational records, which can include an IP address, the page or request, and the browser or app you used

5. What we do not keep

• identity-document images, face photos, or a stored copy of your face data
• the number on an identity document, or your date of birth, from the identity check. A Didit decision can include them as it arrives. We do not keep them
• card numbers or other card data
• your password
• advertising identifiers, or a record of your browsing on other websites
• your location in the background, or between Sign on and Sign off

Do not put medical details, tax file numbers, or photos of identity documents in a site report or a support message. A site report stores what the person writes and photographs.

6. Why we collect it

• to create your account and let you sign in
• to keep a work profile that can move with you between businesses on the network
• to record the result of an identity check you agreed to
• to check an ABN against the Australian Business Register when it is added, and once a day against the public list of cancelled ABNs
• to show a principal contractor or a trade business whether a profile meets the job's requirements at that time
• to record site attendance, inductions and site reports
• to put a pass on your phone, if you ask for one
• to take payment on the website, and to keep invoices
• to send you messages the account needs
• to answer a support request or an enquiry, to stop misuse, and to keep a security record
• to meet a legal duty, or to respond to a legal claim

We do not sell personal information. We do not send marketing email or marketing texts. Account texts are sent from a name, not a phone number, so a reply does not reach us. To stop those texts, email info@assureworx.com.au.

7. Who else sees it

We share personal information only as needed to run the service:

• Businesses you are connected to. A principal contractor can see the status of workers on its jobs, including when a connected business has a cancelled ABN. A trade business can see the people on its team and the work documents they hold. A principal contractor searching the trade directory sees a business's name, ABN and whether it is verified. Document files stay behind the access rules in the service. A wider share across the network, when that feature is on, asks for a separate agreement.
• People a document is shared with. A trade business can share a document inside the service with a principal contractor it is connected to. It can also make a secure link for one named email address. The person who opens that link enters their email and a code we send to it. We record who opened it, when and from where, and we stamp every page with their email address. The business can see that record and can turn the link off at any time.
• Providers who do a defined job for us. Microsoft hosts the service in Australia and runs sign-in, document reading, email delivery and our operational logs. Didit runs the identity check. Stripe takes website payments. Twilio sends a text message if we send one. Expo, Apple and Google deliver phone alerts. Apple and Google deliver a wallet pass if you add one. OpenStreetMap turns a site address into a map pin when our own Australian address register cannot, and supplies the map pictures on the website. If you open directions in the phone app, the phone opens Apple Maps or Google Maps with the site pin or the suburb. We do not send your own location to those map services. Google Analytics counts visits to the public website and to the pages for signing in, creating an account and setting it up.
• The Australian Business Register, when an ABN is first checked. The daily cancelled check uses a copy of the public cancelled list that we hold. We do not send our list of ABNs to the register for that check.
• Advisers, insurers, or a government authority, where the law requires it or allows it.

8. Outside Australia

Our own records are stored in Microsoft Azure in Australia (Sydney, Australia East). Account email is sent through Microsoft, with the email store set to Australia.

These providers are outside Australia, or have not given us one country to name:

We send each provider only what that step needs. Information you type on a provider's own pages or fields is also handled under that provider's terms. That includes card details at Stripe and identity documents at Didit. A provider's terms do not replace our duties under the Australian Privacy Principles for information we disclose.

Automated checks and their effects

Didit uses your identity document and live face capture to make an automated identity decision. Assureworx receives the limited result described above. An inconclusive or declined result can prevent Verified status. We do not manually approve identity checks. Contact info@assureworx.com.au if you cannot complete a check or think the result is wrong; we can investigate with the provider and explain the next steps. Do not send us identity documents, face photos or medical information by email.

We use the selected business name, available ABR details and fields read from registration evidence to accept clear matches automatically. Uncertain matches go to platform review. Uploaded compliance documents may be accepted automatically using the extracted fields, confidence and validation findings. This does not confirm authenticity with the issuer. Document status, expiry, required inductions, principal decisions and payment entitlement feed the status shown for a person or placement. These statuses can affect whether a business considers someone ready for its site; the business remains responsible for that decision.

Site sign-on automatically compares a fresh location reading, accuracy and any mock-location flag with the site's map pin. Missing, inaccurate, mocked or out-of-range readings can prevent digital sign-on. Ask the site contact for help if the location check is wrong. You can request access to or correction of personal information using section 13.

Invitations and message preferences

A business may supply your name, email address and mobile number before you create an account, so it can invite you to its workspace or a job. We use those details to deliver the invitation and help you respond. The invitation identifies the business. You can contact us for access, correction or a complaint even if you never join.

Invitation and requirement-reminder emails have a stop link. SMS has a separate stop link that stops all Assureworx SMS. You do not need an account. We retain a hash of the recipient address or number, the channel, source and time of the opt-out to honour it across businesses and queued messages. We treat this as personal information; it is not anonymous. Essential account, security and payment emails continue. Contact us to change a preference.

9. Cookies and the phone

On the website we use cookies that are required to sign you in and to keep the session secure. On the public website at assureworx.com.au, and on the pages for signing in, creating an account and setting it up, we also use Google Analytics cookies. They count visits and show where people stop during sign-up. We do not use them anywhere else in the service, and we do not use advertising cookies. We do not show a cookie banner.

The browser may also keep short-lived notes on the device for a half-finished form or a display preference. Those are not cookies. Microsoft, Didit, Stripe, Apple and Google may set their own cookies when you are on their pages.

The phone apps keep the same sign-in cookie so you stay signed in. They do not use Google Analytics or an advertising tracker. To stop Google Analytics in your browser, block its cookies in the browser settings or use Google's opt-out add-on. The website works the same either way.

10. How long we keep it

On 25 September 2026 we paused the scheduled job that deletes or de-identifies records after the periods in this table. The pause is so that job cannot destroy project and site history while we decide how long that history must be kept. It covers retired files, the name and email due to be cleared 90 days after account closure, identity-check results at the end of the 24 months, consent records after 7 years, and security records after 24 months. It does not stop the steps that run when you close the account or withdraw an identity check. We will review the pause by 5 January 2027. Until that review lifts it, information in those categories can remain longer than the table says. The pause is not a decision to keep that information once it is no longer needed.

A status in the service is the result at the time of the check. Keeping an old document is not a promise that we keep watching it, and it is not a clearance to enter a site.

11. Security

We limit who can see information inside the service. We encrypt it while it travels and where it is stored. We keep identity-document images and card numbers off our systems. Those images stay with Didit. Card numbers stay with Stripe. No method of storage or transmission is perfect.

If a breach is likely to cause serious harm, we will tell the people affected and the Office of the Australian Information Commissioner.

12. Closing your account

You can close your account in the phone app under Account, then Close your account. On the website, use Settings, then Erase my personal details, or open app.assureworx.com.au/account/delete. You can also email info@assureworx.com.au if you cannot sign in. A business account is closed by writing to us.

When you close the account we email a confirmation to the address on the account. That email says sign-in has stopped, and whether we removed the Microsoft sign-in, the identity-check session at Didit, and any payer record at Stripe. If one of those steps does not complete, the email says so, and you can write to us to finish it.

Sign-in stops straight away. We then remove the photo, phone, work area, identity-check result, trade tags, and placements on a network. We retire work documents. Clearing your name and email after 90 days, and deleting retired files after 30 days, are in the pause in section 10, so they do not run yet.

We do not delete everything. We keep invoices and payment records (generally 7 years), the record that you gave or withdrew an identity-check agreement (generally 7 years), and security records (generally 24 months). Entries about you in a project's activity log stay as they were written. We keep those so we can meet tax and legal duties, and so we can show that we handled the request. A business that had you on its team still sees a label that you withdrew your information. It does not keep your documents, photo, or identity-check result.

13. Access, correction and complaints

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing info@assureworx.com.au. We will respond within 30 days. If we refuse, we will tell you why, unless the law says we should not.

If you are unhappy with how we handled your information, write to us first. If we cannot resolve it, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

14. People under 18

Assureworx is for people 18 years or older, for work and business. We do not knowingly open an account for a child.

15. Changes

We may update this statement. When we do, we change the date and the version at the top. If a change matters to how we use personal information, we will give you a reasonable notice where we can, by email or in the service.

Related: Terms of Use