Privacy Policy

Who we are

SafetyDocs is run by SafetyCulture Plus Pty Ltd (ABN 30 644 548 587), part of the Mitti group. We call ourselves "we" or "us". This policy covers safetydocs.app, the SafetyDocs app, the emails and texts we send, and the old SafetyDocs store's customer records. Other companies' sites that you open from SafetyDocs have their own policies.

We look after information in two different ways:

• Our own records, such as your account, billing, support requests, site use and marketing. We decide how that information is used.
• Information we hold for an organisation, such as its documents, jobs, crew, contacts, signatures and messages. Organisations such as builders and contractors decide what goes in and who sees it. We store and process it on their instructions, under our Data Processing Addendum, and we don't use it for our own marketing. That organisation's own privacy policy also applies.

For example, Mia works for a tiling subcontractor. She scans a QR code on a builder's site and signs the builder's SWMS. Her name, mobile and signature are held for the builder. If Mia later creates her own SafetyDocs account, her account details are ours to look after, while her signature on the builder's job stays part of the builder's records.

We follow the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Features on the way. We're still building some of what this policy covers: signing and sign-on registers, in-person signing, reading records, job documents and reminders, job activity messages and photos, sharing contacts between organisations, document approval and document requests, credentials, permits, AI drafting and review, and integrations and an API. This policy applies to them once they're available.

What we collect

You don't have to give us personal information, but some of SafetyDocs won't work without it. You can't have an account without a way to sign you in, for example, and you can't join a job without a name and a way to reach you.

About your account

Account. Your name, email, mobile number, job title and profile picture, whether they're verified, your organisation memberships and your roles. WorkOS runs sign-in and sessions. Codes sent to a mobile come from us, through Twilio. If you sign up with a mobile only, your account gets a placeholder email that we hide until you add your own.

Organisation. Its name and logo, and where someone adds them, its ABN or NZBN, address and phone. For a sole trader these can be a home address and personal phone. They're optional and stay off documents until someone switches them on. If you work from home, leave your address off or use a PO box. If it's switched on, anyone who can open the document sees it, and on Free, that's anyone with the link.

Billing. The organisation or person being billed, a name, an email, your plan and usage, and purchases. Stripe handles your card. We never see or store the full card number.

If you're on a job

Joining. Your name, your mobile or email, your company if you give it, how you joined (an invitation, a link, a QR code, a spreadsheet import, or signing on someone's device), and when you were invited, joined, or were taken off. If the host's plan requires it, when you confirmed a one-time code. We store a scrambled (hashed) form of the codes we check and of guest session tokens. Stored copies of emails we send can contain a code until it expires.

Signatures. Which document and version you signed, and when. How you were known at the time: signed in, matched to an invitation, or by the details you typed. If someone signed you on in person, whose device it was. The name, company, email and mobile you gave, and a copy of the document as you signed it. Your drawn signature. Technical details that help show the record is real, such as your IP address and device type. When a document's register asks for them, your job role, and your licences and tickets, with their numbers and expiry dates.

Reading. Which documents you opened, which version, and when.

Credentials. Tickets, licences and insurance you upload for a job, which can include a photo of the card, your name, a licence number and an expiry date. These are often issued by government. We don't use them as our own way of identifying you, and we don't check that they're genuine.

Permits. Your name and role on a permit to work, such as approver or fire watch, and when you approved it or signed on.

Job activity. Messages, photos and files people post, comments and issues raised on a document, and automatic entries such as invited, joined, signed and published. If a message is archived, who archived it and why.

What organisations add

People and jobs. Contacts and groups, jobs (name, site address, and whether they're public or private), the principal contractor's and client's company and contact details, who's on each job and their role, subbie passes, and invitations with the email or mobile they were sent to. Contacts builds itself from the people an organisation has worked with, and Admins can also add people by hand or from a spreadsheet.

Documents and files. Everything an organisation writes or uploads, and who did it, including document requests, approvals, comments and past versions. These can include names of people responsible for a hazard, licence numbers, emergency contacts, photos, and health, training or incident details.

Activity records. Audit entries showing who did what and when in a job or organisation, including, in some cases, the people affected with the email or mobile used, what changed, and every time contact details were shared.

We don't ask for health information or other sensitive information about you ourselves. If someone puts it in a document, message or photo, such as a photo of an injury, we hold it for that organisation and protect it the same way. Please only add what the work needs.

When you use our site or contact us

AI features. When someone uses AI on a document: the file or text sent, the result, the model used, its usage and cost, and IDs for the organisation and person who asked. See AI features.

Messages. The emails, texts and in-app notices we send, whether they were delivered, opened or clicked, and your notification choices.

Early access and demos. Your email, company and role when you join the early-access list. Your name, email, company, phone and number of sites when you book a demo.

Help and feedback. Help requests and article feedback, with your name and email if you give them. Live chat, if you choose to use it, runs on HubSpot.

Reviews. If you review a template, the review and your name as you give it.

Using our site and app. Pages visited, clicks, video plays, and how you use the product. We don't run product analytics on job, invitation, claim or unsubscribe links. Device and browser details, IP address and approximate country, which we also use to show the right region. Error reports. Our Cookie Policy explains the choices you have.

On your phone. To save you typing, your browser can remember your details for a job, including the job role and licences you last gave, and that phone can reopen the job for 30 days. On a shared phone or tablet, use "Not your details? Change" before you sign.

We don't ask for your date of birth, or your precise location. Phone photos can carry where they were taken. We remove that data from photos when they're uploaded to a job.

Information from other sources

Sometimes we receive information about you from someone else:

• Your organisation, a colleague, or a company you work with, who may add you as a contact, invite you, put you on a job or in a document, or share your details with another organisation on a job. The first message you get is usually an invitation, which names the organisation that invited you and says why you got it.
• WorkOS and Stripe, which send us the results of signing in and paying.
• The old SafetyDocs store. If you bought from it, we hold your orders and contact details, your past emails, calls, chats and notes with our team (held in HubSpot), any store reviews you wrote, and abandoned carts.
• Our parent company, Mitti. We match on your email, and it tells us whether you use its products, and what you've bought on its marketplace. Mitti's staff don't get access to SafetyDocs or your organisation's information.
• Public sources. For old-store customers and their businesses: the Australian Business Register (entity type, ABN status, GST registration, address), business directory listings, and business websites.

We use old-store and public information to let you claim past purchases, and to send old-store customers emails that fit their trade and history. We work out things such as your likely industry, trade and type of organisation, whether a past support conversation suggests you asked for digital documents or weren't happy, and which templates to recommend. AI services in the United States help with this. We remove email addresses, phone numbers and links from notes first, but a sole trader's business name can be a person's name.

If you received an email from us because of this, you can unsubscribe at any time, and ask us what we hold and where we got it.

Why we use it

• To run SafetyDocs: sign you in, apply your role, show a job's documents and crew, store files, and send invitations, reminders and requests to sign again.
• To keep the records organisations rely on: the sign-on register, permits, credentials and the audit trail, which they may use as work health and safety records.
• To let organisations work together: manage Contacts, and share contact details for the work they're for.
• To bill: apply plans, allowances and offers, and keep financial records.
• To support you: answer questions, and improve the help centre.
• To keep it safe: prevent fraud and misuse, limit repeated requests, fix errors, and investigate problems.
• To improve it: understand how SafetyDocs is used, and check the quality of AI conversions and translations.
• To tell you about SafetyDocs: see Marketing.
• To meet the law: and to enforce our terms or respond to legal claims.

We'll ask for your consent or tell you before we use your information for a purpose you wouldn't reasonably expect.

Signatures and the register

A signature in SafetyDocs is a safety record. It shows the organisation, and if needed a regulator or a court, that you said you read a particular version of a document and would follow it.

• We keep the details you gave when you signed exactly as they were, so a later change can't rewrite the record.
• When an organisation changes a document significantly, people sign again. Earlier signatures stay on record, marked as being for an older version.
• Being taken off a job, or out of Contacts, doesn't delete your signatures. Past versions of a document still show who signed them.
• If something you signed is wrong, we can attach a note to it, rather than change what was signed.
• If someone signed as you, call or email us with your name, the site and the date. We'll check it's you another way, look into it, and tell the organisation.
• Signing shows you said you read this and will follow it. It doesn't prove you understood it, or that the site was safe. It doesn't take away your rights, including workers' compensation or your right to raise a safety concern. Ask for help first if you need it, including in your own language.
• We never use your drawn signature to check who you are automatically.
• If you signed on another organisation's job, your account keeps a reference to what you signed, for whom and when, and you can open that version, even after the job ends or that organisation is deleted.

Messages about a job

Invitations, reminders and requests to sign are sent for the organisation running the job, by email or text. They say which organisation they're from, hold factual information about the job and what to do next, and have no advertising. Your details may be shared with the organisations you work with on the job.

Photos and files on a job

A photo can show people who aren't on the job. Please post only what the job needs, and avoid faces, injuries and personal documents.

A message can be archived by its author, or by the job's managers and Admins, for example because it holds personal information. Archiving hides it from everyone else, but it's kept for the job's managers and the organisation's Admins as part of the job's record. To ask for something about you to be removed, contact the organisation or us.

AI features

AI only works on a document when someone in the organisation asks, or an organisation turns on a step that does. Nothing is converted, translated, drafted or reviewed on its own otherwise.

Where it goes. The file or text goes through OpenRouter, in the United States, to the company running the AI model. Today, that's Anthropic's Claude to convert files, TypeSafe AI's Jev to sort files and pictures before converting, and DeepSeek's open model to translate. We require providers that keep no copy of what we send and don't train on it (zero data retention), and we tell OpenRouter to refuse any other. Those hosts can change, and can be outside the United States, which we can't always list in advance. Other companies host DeepSeek's model, and we tell OpenRouter never to use DeepSeek's own service. The request carries IDs, not your name or email, but a document itself can contain people's names and details.

What we keep. We keep each request and response, the text read from a file, and any file uploaded only to be converted, in Convex and Cloudflare R2, for 30 days, so we can check and improve quality. Then we delete them. The document made stays, and so does a record of the credits and cost each run used. Only our staff with administrator access to AI records can read them, and each time they open one, it goes in your audit log. See How long we keep information.

We don't train AI on your content, and we don't let the providers do it either.

Decisions made by computers

We don't use computer programs to make decisions about you that significantly affect your rights or interests, such as your job or your right to work. SafetyDocs works some things out automatically, from what it holds:

• whether a signature is current, whether a change looks significant enough to need signing again, and how many people have signed. These use signatures and document versions.
• whether a credential has expired. This uses the expiry date given.
• whether an AI step finds a document complete and clear. This uses the document's content, which can name people.
• whether a plan allows an action, and limits on repeated requests or wrong codes. These use account and usage details.
• which email lists old-store customers go on. This uses purchase history, email engagement and company details, and people on our team review the results.

These are records and flags. Decisions about people, such as whether someone may start work on a site, are made by the organisation they work with, not by SafetyDocs. An organisation that relies on these flags in its own decisions is responsible for those decisions.

Marketing

We email people about early access, the launch, demos they book, and templates they can claim, and we may email account holders and customers about SafetyDocs features and offers. Customer.io sends these emails. It holds your email and name, your company and what we know about your business and past purchases, when you last signed in, and whether you opened or clicked our emails. It receives these details for everyone with an account who has signed in.

We don't use what we hold for organisations for our own marketing. That includes crew lists, Contacts, signatures, licences and messages. Joining or signing on a job without an account doesn't add you to our marketing list. If you create an account, even to join a job, Customer.io receives your name and email, and we may email you. You can unsubscribe.

Every marketing email has an unsubscribe link, and you can also ask us to stop at any time. If you unsubscribe, we keep your email on a do-not-email list, so we can respect that choice. We'll still send you messages about your account, your jobs and your payments.

We measure our ads with Meta and LinkedIn, but only if you allow advertising cookies. They can link that activity to your accounts with them.

Who can see your information

People in your organisation see what their role allows. Admins can see members and invitations, and every job the organisation hosts. People who can open the audit log see the entries in the plan's window, including emails and mobiles in them. Other staff see names and companies in Contacts, and the email and mobile of colleagues and people invited to the organisation. Admins, and the managers of a job, can also see the email and mobile of people from other companies on it.

On a job. The job's managers and the host's Admins see everyone on the job, their contact details, and who has signed what. Other people on the job don't see each other's email or mobile. Only the job's managers and the host's Admins see the client's email and mobile, if the job has them. Guests without an account see only their own record and how many people have signed. Crew who are signed in see the crew list and activity, and who has signed and when, but not anyone else's signature.

In a sign-on register. The job role and licences you gave are shown next to your name, on screen and when the register is printed, to you, the job's managers, and the host's Admins. So are your drawn signature and any ticket photo you uploaded. Others who can see who has signed see your job role, but not your licences, signature or photo. Your own employer sees these only if it's the host, or if the host shares them. Treat printed registers with care, and keep them locked away.

Anyone with the link. Free plan jobs are public. Anyone with the link, code or QR code can open them and the documents shared there. Don't put anything on a public job that you wouldn't want seen.

People who open a document. Anything in a document can be seen by everyone who can open it, including on printed copies. That includes names of people responsible for a hazard, the principal contractor's and client's contacts, and, if an organisation switches them on, its ABN, address and phone.

Other organisations on a job. A host's Admins can share your contact details with the organisations you work with, for that work. Every share is recorded, and a list sent by email is a link that stops working after seven days.

Connected systems. On Enterprise, an organisation can connect SafetyDocs to its other systems, which then receive information as it directs.

Our staff. Only SafetyDocs staff who need it have access, under limited roles for support, billing and content. Some staff can sign in as a customer to fix a problem you've raised or to deal with a security issue. Each sign-in goes in the organisation's audit log, and its Admins are told.

Service providers. Our sub-processors list names each one we use to run SafetyDocs, what it does, and where it is. They can only use your information to provide their service to us, except where the list says they act for themselves.

Others, where needed. We may disclose information where the law requires or allows it, such as to a regulator or court, or to protect someone's safety or our legal rights. If we sell or restructure our business, we may share information with the people involved, under confidentiality. We'll tell you before your information moves to a new owner or a different privacy policy.

We don't sell your personal information for money. We may publish or share combined statistics that don't identify anyone.

Information sent overseas

Most of our service providers are overseas, so your information will be stored or handled outside Australia. Most is held in the United States, including our main database (Convex, on AWS). Uploaded files are stored with Cloudflare R2, where we prefer the Oceania region, though that isn't a guarantee of location. File conversion runs on AWS in Sydney.

Need it held in a particular country? We don't offer a choice of hosting region today. If your organisation needs its information held in a particular country, email support@safetydocs.app and tell us where. It helps us decide what to build next.

Our sub-processors list shows the country for each provider. Depending on the provider, information may also go to other countries where it or its own suppliers work, including AI hosts. An organisation can also send information overseas itself, such as by sharing contact details with a company in New Zealand. That's its decision and its responsibility.

We take reasonable steps to make sure overseas recipients handle your information consistently with the Australian Privacy Principles, including through contracts. If you're not happy for your information to go overseas, tell us before giving it to us, but you may not be able to use SafetyDocs.

How long we keep information

We keep personal information for as long as we need it for the reasons above, or as the law requires. When we no longer need it, we delete it or remove what identifies you. Some records don't yet have an automatic time limit. For those, you can ask us to delete them, and we'll do it unless we have to keep them.

When an organisation is deleted, its jobs, crew, groups, contacts, passes, job and organisation invitations and audit history are removed shortly afterwards. Its documents, files and contact invitations are not yet removed by that action. Email privacy@safetydocs.app and we'll delete them within 30 days.

When your account is deleted, we remove your account and memberships, and take you off the organisation's jobs and groups. Documents you added stay with the organisation, and signatures you made stay on the records of the organisations you signed for.

Organisations may need to keep safety records for years. A SWMS, for example, generally has to be kept until the high-risk construction work is finished, and for at least two years after a notifiable incident. So an organisation may decide to keep records that name you. Deleted information can also stay in the backups of our providers for a short time.

How we protect information

We encrypt information in transit and at rest, limit who can reach it, scan uploaded files for known malware, and record important actions. Our Security page has the details, including what we don't have yet.

No system is completely secure. If a data breach is likely to cause you serious harm, we'll tell you and the Office of the Australian Information Commissioner, as the law requires, and New Zealand's Privacy Commissioner where its law applies. If it involves information we hold for an organisation, we'll tell that organisation as our Data Processing Addendum describes.

Your choices and rights

• See your information. Your account page shows your details, and we can give you a copy of what we hold.
• Correct it. Update your details in your account, or ask us to. A signature keeps what you gave at the time, but we can attach a note.
• Delete it. Email us to close your account or delete information. We'll tell you if there's something we have to keep.
• Stop marketing. Use the unsubscribe link in any marketing email.
• Control cookies. Choose what you allow in site settings. See our Cookie Policy.
• Stop product analytics. Turn it off in your account settings. This stops browser analytics in that browser. A few events we record on our servers, such as a new account, still reach PostHog.
• Choose your messages. Your account lets you choose which notifications you get by email or text.
• Stay anonymous. You can ask a general question without giving your name, but we usually can't help with your account without knowing who you are.

Email privacy@safetydocs.app, with or without an account. It's free. We'll check it's you, for example by sending a code to the email or mobile you used, and we'll respond within 30 days. If we can't do what you ask, we'll tell you why and how to complain.

If you're on a job or in someone else's organisation, they control your details and documents on it. You can ask them, or come straight to us, and we'll work with them on your request. We may need to refer you to them. Your signature usually stays with the job's record, but you can ask for your licence, photo and mobile to be removed when they're no longer needed.

Complaints

Tell us first at privacy@safetydocs.app, with enough detail for us to look into it. We'll respond in writing within 30 days. If it's about information we hold for an organisation, we'll work with that organisation.

If you're not satisfied, or you haven't heard back within 30 days, you can complain to the Office of the Australian Information Commissioner on 1300 363 992. Outside Australia, see below.

Young people

SafetyDocs is for work, and it isn't directed at children. Young workers such as apprentices can join a job and sign documents as part of their work. We don't ask for ages. If you're under 18, your supervisor should explain what you're being asked to give, and you can ask us at any time to delete details the job doesn't need. If you think a child under 13 has given us personal information, tell us and we'll delete it.

Changes to this policy

The date under the title shows the latest version. If we make a change that materially affects you, we'll tell you by email or in the app before it takes effect. You can ask us for earlier versions.

Contact

Privacy Officer, SafetyCulture Plus Pty Ltd

• Email: privacy@safetydocs.app
• Phone: 1300 306 604 (within Australia)
• Post: PO Box 578, Townsville QLD 4810, Australia

If you need this policy in another format, ask us.

Outside Australia

New Zealand

The Privacy Act 2020 applies when we're doing business in New Zealand, and for information we hold for a New Zealand organisation, for which we act as its agent. You have rights to see and correct your information. If an organisation got your details from someone else, such as your employer, it must take reasonable steps to tell you, and the invitation you receive helps it do that. If we collect information about you from someone else, this policy and our emails tell you we've done so. You can complain to the Privacy Commissioner if you're not happy with how it's been handled.

United Kingdom and European Economic Area

If UK GDPR or EU GDPR applies, we're the controller of our own records and the processor of information we hold for an organisation.

Why we can use your information. We rely on:

• A contract, to provide SafetyDocs and take payment.
• Legitimate interests, to keep SafetyDocs secure, improve it, understand our customers, and send business customers relevant marketing, where those interests aren't overridden by yours.
• Consent, for optional cookies and where the law requires it for marketing. You can withdraw consent at any time.
• Legal obligations, such as tax records.

Transfers. We're based in Australia, and your information also goes to the United States and elsewhere. Where the country doesn't have an adequacy decision, we rely on safeguards such as the European Commission's standard contractual clauses and the UK's addendum to them, or a provider's Data Privacy Framework certification. Ask us for a copy.

Your rights. You can ask for access, correction, deletion, restriction and a portable copy of your information, and you can object to how we use it, including for direct marketing. You can complain to the Information Commissioner's Office in the UK, or your local authority in the EEA.

United States

If a US state privacy law applies to us, you may have rights to know, access, correct and delete your information, and to opt out of the sale or sharing of it or of targeted advertising. We won't treat you differently for using them.

We don't sell personal information for money. If you allow advertising cookies, the Meta and LinkedIn tags could count as sharing or selling under some state laws. You can turn them off at any time in site settings. They stay off until you allow them. If your browser sends a Global Privacy Control signal, we treat it as refusing them, even if you've allowed them.

Canada

We handle personal information under PIPEDA and provincial privacy laws where they apply, including Québec's. You can ask to see or correct your information, and withdraw consent, subject to legal limits. Our Privacy Officer is named above. You can complain to the Office of the Privacy Commissioner of Canada, or in Québec, the Commission d'accès à l'information.