Privacy Policy

This Privacy Policy explains how Audit4me ("Audit4me", "we", "us") collects, uses, stores and shares personal information when you use the Audit4me app, website and related services (the "Service"). We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, where they apply to us. By using the Service you acknowledge this policy.

1. Who is responsible for the information

Audit4me is used by organisations (for example employers, contractors and their clients). The organisation that sets up your account decides what is recorded in it, who can see it and how long it is kept. In most cases we hold and process inspection content on that organisation's behalf and in line with its instructions, and we are responsible for our own account, security and billing information. If you use Audit4me through your employer or another organisation, contact them first about their records.

2. What we collect

• Account details: name, email address, role, organisation, assigned sites and sign-in details.
• Content you or your organisation add: inspections, answers, scores, notes, corrective actions, signatures, attachments, reports and photos. Photos and notes may show people, premises or other personal information.
• Location information: site addresses and, where you allow it on your device, your location while using location features.
• Device and usage information: device identifiers, browser and device type, IP address, sign-in history, security events and basic diagnostics.
• Notifications: a push notification token if you turn on notifications.
• Billing information for paid plans. Card details are handled by our payment provider and are not stored by us.
• Communications: messages you send to support and the emails the Service sends you.

3. How we use information

• To provide, operate, support and improve the Service, including inspections, actions, reports, notifications and offline features.
• To secure the Service, verify users, prevent fraud and misuse, and investigate incidents.
• To manage accounts, plans and billing, and to contact you about the Service.
• To comply with the law and to establish, exercise or defend legal claims.
• To produce de-identified or aggregated information to understand and improve the Service.

We do not sell personal information and we do not use it for third-party advertising.

4. Who can see information

Information in an organisation's account is visible to that organisation's users according to their role and site access. It is not shared with other organisations through the Service. Our authorised personnel may access information only as needed to provide support, maintain and secure the Service, or investigate misuse, and are required to keep it confidential.

5. Photos and reports

Inspection and corrective-action photos are stored in a protected, private area, separate from public website files. Each organisation's photos are kept in their own folder with randomly generated file names.

• Sign-in required. A photo can only be opened by a signed-in user of the same organisation, or by our authorised personnel for support and security purposes. Someone who is not signed in, or who belongs to a different organisation, cannot open it, even with the address.
• Integrations. Where an organisation uses our API or another approved integration, photo addresses may carry a secure signature so that integration can retrieve them. Treat these addresses like a password.
• Reports. PDF reports are generated when requested or scheduled and are not left in a public folder. Reports can contain photos and personal information, so share them only with people who should see them.
• Deleting. When your organisation deletes a photo, action or inspection, it is removed from the Service. Copies may remain in backups until they are replaced in the normal backup cycle.

Only photograph people where you have the right to do so, and let them know. Do not photograph people who are not connected to the inspection.

6. Service providers and overseas storage

We use reputable service providers to run the Service, including for hosting and infrastructure, email delivery, payment processing, push notifications, maps and address lookup, and cloud backup storage. They may only use information to provide their services to us. Some providers are located, or store information, outside Australia, including in the United States and the European Union. We take reasonable steps to make sure they handle information consistently with the Australian Privacy Principles.

7. Optional automated and AI features

Some features, such as automatic summaries or importing a template from a file, may send the relevant text or file content to a third-party AI provider to produce the result. We limit what is sent to what the feature needs and do not send photos or email addresses for summaries. Automated output can be wrong and should be checked before you rely on it. Where a feature is available, your organisation decides whether it is used.

8. Security

We use access controls, signed-in access checks (including for photos and reports), device limits, sign-in monitoring, browser security protections and regular backups, and we take reasonable steps to protect information from misuse, loss and unauthorised access or disclosure. No system is completely secure, so please use a strong, unique password, keep it private and tell us straight away if you suspect unauthorised access. If a data breach is likely to cause serious harm, we will notify affected people and the Office of the Australian Information Commissioner as required by law.

9. How long we keep information

We keep information while an organisation's account is active and for a reasonable period afterwards, unless the law requires us to keep it longer or we need it to resolve a dispute or enforce our terms. Organisations can ask us to export or delete their data. Backups are kept for a limited period and deleted information can remain in them until they are replaced. When information is no longer needed, we delete or de-identify it.

10. Your choices and rights

You can ask to access or correct the personal information we hold about you. Where an organisation controls the content, we may refer your request to that organisation. You can turn off push notifications and device location in your device settings. To make a request, contact us using the details below. We may need to confirm your identity first.

11. Cookies and local storage

The Service uses essential cookies, local storage and a service worker to keep you signed in, protect your account, remember settings and let the app work offline. We do not use them for advertising. Turning these off in your browser may stop parts of the Service from working.

12. Children

The Service is for workplace use and is not directed at children. We do not knowingly collect personal information from children.

13. Complaints

If you have a privacy concern, contact us first and we will respond as soon as reasonably possible. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

14. Changes to this policy

We may update this policy from time to time. The version number and date at the top show the current version. If a change is significant we will notify you in the app or by email. Continued use of the Service after a change means you accept the updated policy.

15. Contact

Audit4me. Email: [email protected]