Privacy policy

1.Who this policy applies to

This policy may apply to customers and prospective customers; users of an Onvoro Organization; workers, employees and contractors whose information is managed through Onvoro; managers, supervisors, finance users and administrators; people whose details appear in Jobs, Issues, Sites, Clients or evidence; website visitors; and people who contact us for support or sales.

2.Onvoro and your Organization

Onvoro is a business-to-business software platform. The business that gives you access to Onvoro, for example your employer, contractor or service provider, is referred to as your Organization.

For information an Organization enters into or manages through Onvoro, the Organization generally determines the operational purpose for which that information is collected and used, while Onvoro processes and stores it to provide the service.

Some privacy requests may therefore need to be handled by, or together with, your Organization. Onvoro separately manages information for its own purposes such as authentication, security, service administration, billing, support and compliance.

If you are unsure whether to contact Onvoro or your Organization, contact us, and we will help direct your request.

3.Personal information we collect

Depending on how Onvoro is used, we may collect or hold:

• name, email address, phone number and profile image;
• Organization, job title, team and account information;
• roles, permissions and access scope;
• employee or contractor identifiers and employment status;
• pay rates, and the per-visit prices agreed with contractors, where an Organization records what it pays;
• bills an Organization draws for the contractors it engages, and the statements it sends them, including the address a statement was sent to and when;
• date of birth, home address and emergency contact details, where a worker or their Organization has entered them;
• Site and Region assignments;
• qualifications, licences, credentials and work-right information;
• Shifts, scheduled work and availability information;
• sign-in and sign-out records for shifts;
• Jobs, Issues, tasks, checklists, notes and approvals;
• Timesheets and approved working time;
• Site and Client contact information;
• photos, documents, attachments and operational evidence;
• billing and invoice information, including payments recorded against an invoice in an accounting system an Organization has connected;
• links between Clients and workers in Onvoro and the matching records in that accounting system;
• support communications;
• IP address, device type, application version and diagnostic logs; and
• push-notification tokens and notification preferences.

Information about other people

An emergency contact is somebody else. If a worker or their Organization records one, we hold that person’s name, their relationship to the worker and a phone number, so that somebody can be reached if something happens at work. That person does not use Onvoro, was not shown this notice when the details were entered, and has no account with us.

We do not contact them for any other reason or use their details for marketing. The Organization that entered them is responsible for telling them it has done so. They can ask us to correct or remove those details using the contact details at the end of this policy.

What we deliberately do not hold

Onvoro is not a payroll, banking, superannuation or tax-record system. We do not collect or store tax file numbers, individual bank account details or superannuation information. Your payroll system already holds those and is the right place for them.

An Organization does record the bank account it asks its own clients to pay into, because that account is printed on the invoices it issues. That is the business account of the Organization, not an individual worker account.

Organizations should avoid uploading information that is not required for the services they use.

Paying for Onvoro

When an Organization pays for Onvoro, the payment is taken by Stripe, our payment provider. The card or bank details entered at checkout go straight to Stripe and are never sent to us or stored by us. We give Stripe the Organization’s name and its contact email address, or, where the Organization has none, the email address of the person setting up the subscription, and Stripe collects the billing address and, if one is given, the ABN or other tax identifier, which appear on the tax invoices it issues. We keep a reference to the Organization’s Stripe customer and subscription, the plan it is on, and when that plan renews.

Stripe sends receipts and tax invoices for Onvoro payments, and emails about a card that could not be charged or is about to expire, directly to the billing email address. Stripe handles this information under its own privacy policy.

How you sign in

Many people who use Onvoro have no password at all. Workforce accounts are signed in with a six-digit code emailed to the address on the account, so your email address is used to deliver that code. A code expires after ten minutes and is accepted at most three times before a new one has to be requested. Office accounts use an email address and a password, and can also use a code on the mobile application.

Where an account has no password, there is no password to forget, to reuse elsewhere, or to be exposed if it were ever guessed. Where an account does have one, we store it only as a one-way hash and never in a form we or anyone else can read.

Cookies and website analytics

The Onvoro application sets a cookie that keeps you signed in, and the mobile application stores a sign-in token securely on your device. Both are necessary for the service to work. A session lasts up to 90 days and is extended each day it is used, so somebody working regularly is not asked to sign in again; signing out, or having access revoked, ends it immediately.

Our public website and the Onvoro web application use Vercel Web Analytics to count page views. It sets no cookies and stores nothing on your device. It does not track you across other websites, and it does not build a profile of you. Visitors are counted using a value derived from the incoming request rather than an identifier stored on your device, and Vercel discards it after 24 hours.

For each page view, it records the time, the page address, the referring page, and approximate location, device type, operating system and browser version. Approximate location means country, region and city, worked out from the network connection. It is not the precise device location described in the section on location information below, and it is not linked to your Onvoro account.

Inside the Onvoro application, we remove information from the page address before it is sent. Record identifiers are replaced with a placeholder; everything after the question mark is discarded, so search terms and filters are never sent; and pages whose address is itself a security token, such as a shared quote link or a password reset link, are not counted at all.

We use this only to understand which pages are used and how people arrive at our website.

We also use PostHog, a product analytics provider, to understand how the Onvoro web application and our public website are used so that we can improve them. Unlike Vercel Web Analytics, PostHog stores an identifier in a cookie and in your browser’s local storage so that one visit can be connected to the next. It receives the IP address a request comes from, which it uses to estimate country and city, and it holds what it receives in the United States.

In the Onvoro web application, PostHog receives which screens are opened, which kinds of controls are pressed, and which actions are completed, such as a timesheet approved or an invoice issued. It is told who is using the application by an internal account identifier, their role and the Organization they are working in, and it keeps a profile under that identifier. It is not sent your name, your email address, the words on the screen or anything you type. Page addresses are shortened in the same way as for Vercel Web Analytics, so record identifiers, search terms and filters are never sent, and nothing is recorded on a page whose address is itself a security token, such as a shared quote or invoice link.

Our servers also tell PostHog when an Organization reaches a milestone in using Onvoro, such as adding its first Site, a worker signing in at a Site, a timesheet being approved or an invoice being sent. That includes milestones reached in the mobile app or through a shared quote link, because it is our servers that record them. Each one is recorded against the Organization rather than against any person, and carries only what kind of event it was, such as how a sign-in was verified or how many timesheets were approved. It does not identify the worker, client or user involved, and it carries no names, addresses, amounts, locations or anything anybody typed.

PostHog may also make session recordings of the Onvoro web application: a reconstruction of how a page was used, such as where the pointer moved and what was clicked. Every word on the screen and every field is hidden in your browser before a recording is sent, so a recording shows the layout of a page and not what it says, and the text of a click is never sent either. Recordings are not made of the quote and invoice pages a client opens without an account, and they are kept for 30 days.

On our public website, PostHog receives page views and clicks, and may record how a page was used. Visitors are counted but not identified, and no profile is kept of them. Anything typed into a form is hidden from recordings.

If we introduce any further analytics or tracking tool, we will update this policy first.

Our servers write technical logs of what the software did, and we send those logs to Axiom, a logging provider, so we can investigate faults. A log line records the address the request was made to, the name of the Organization it belonged to, the email address of the signed-in user who made it, and the IP address the request came from.

We remove information from that address before it is recorded, in the same way we do for analytics. Record identifiers are replaced with a placeholder; everything after the question mark is discarded, so search terms and filters are never recorded; and addresses that are themselves a security token, such as a shared quote link or a password reset link, are shortened so the token itself is not written down. A log line does not record passwords, session cookies, or the location captured at sign-in and sign-out. Axiom holds these logs for 30 days and then deletes them.

Sending us feedback

The account menu in the Onvoro web application has a Send feedback option. It opens a panel provided by UserJot, the service we use to collect suggestions and bug reports and to publish our roadmap and product updates. The panel is loaded only when somebody chooses Send feedback. Until then, nothing from UserJot is on the page, and once it has been opened, it stays available until the page is reloaded or closed.

We send UserJot nothing about who you are: not your name, your email address, your role or your Organization. If you want to post feedback, vote or follow a request, you sign in to UserJot inside the panel yourself, and UserJot handles that account under its own privacy policy.

UserJot receives the IP address and browser details of the requests the panel makes, and whatever you type into it or sign in with. If you choose to attach a screenshot of the page you are on, it is sent with your feedback and shows whatever was on your screen at the time, so check it before you send it. The panel keeps a note in your browser’s local storage of which UserJot project it belongs to and which product updates you have already seen. UserJot holds what it receives in the United States.

4.Location information

Location is used for specific operational workflows, principally signing in and signing out of a shift.

When location verification is required, Onvoro may collect:

• latitude and longitude;
• the accuracy of that reading;
• the time the reading was captured on the device, and the time our servers received it;
• the recorded position of the relevant Site;
• the geofence radius set for that Site; and
• the distance calculated between the reading and the Site.

We may use this information to verify attendance, identify exceptions, support supervisor review, preserve attendance evidence and help resolve operational questions such as a dispute about hours worked.

The Site position and geofence radius are stored as they were at the moment of the sign-in, rather than read again later. A recorded distance means nothing once the boundary has moved, and moving a geofence is itself an audited change.

No continuous worker tracking

Use location for accountability, not surveillance.

Onvoro does not continuously track a worker’s location through a shift. We do not create movement trails, route histories or continuously moving worker markers, and none exist to be handed over, subpoenaed or leaked.

Location is captured at specific actions only, such as signing in, signing out, or another feature where location verification is clearly required and disclosed at the time.

5.Attendance and work records

Onvoro may collect or generate information about:

• assigned Shifts;
• scheduled start and end times;
• attendance status;
• late or missing sign-ins;
• missing sign-outs;
• geofence verification results;
• reasons given for a correction;
• supervisor reviews and approvals;
• the hours a worker is paid for, which follow either the time they were signed in or the Shift they were rostered for, as their Organization chooses;
• Timesheets; and
• related activity and audit records.

Where an attendance record is corrected, Onvoro preserves the original evidence alongside the correction. The captured reading, the geofence it was judged against and the calculated distance are never altered. What is recorded is the adjustment, the reason given and the person who made it.

6.Contractors and their crews

Some Organizations engage contractors who supply their own workers. Where an Organization records that a worker’s hours are billed through a contractor, that contractor can see the information below about that worker, and about no worker who is not billed through them.

• on the statement the Organization sends the contractor: each worker’s name, and the hours and number of days they worked at each Site in the period; and
• where the Organization gives the contractor their own login: the Shifts, sign-ins and sign-outs, approved hours, Jobs and Issues of those workers, the Sites they work at, and their names and work contact details. The contractor does not see their pay rates, home address, date of birth or emergency contact details.

A statement is opened from a link that does not need a login, so anybody the link is passed to can read that statement. It stops working if the Organization voids the bill.

The Organization decides which workers are billed through which contractor, and whether that contractor has a login.

7.Jobs, Issues and evidence

Onvoro may hold information contained in Jobs, Issues, assignments, task and checklist completions, internal notes, updates, comments, priorities, due dates, completion records and approvals.

Users may upload photos, documents and other evidence. These files may contain personal information visible in Site photographs, incident evidence, credential documents, forms or attachments.

Users and Organizations should avoid capturing or uploading unnecessary personal or sensitive information.

8.Sensitive information

Some information entered into Onvoro is sensitive information under applicable law. Onvoro records worker credentials, and those include work rights and visa status, licences such as a security or driver licence, certifications such as a first aid qualification, and background checks such as a police check or a Working with Children Check.

Health or safety incident information may also appear in an Issue, a Job note or an uploaded document.

We only intend to collect sensitive information where it is reasonably necessary for an applicable function and where consent or another lawful basis permits the collection. Work-right information in particular is collected because it is an offence to let somebody work in breach of their visa conditions.

9.How we collect personal information

We may collect personal information directly from you; when you create or use an account; when you use the mobile application; when you sign in or out of a shift; when you complete Jobs or tasks; when you upload files; when you contact support; from your Organization or authorised users within it; from integrations your Organization has enabled; and automatically through application, device and security logs.

An account may be created for you by your Organization rather than by you. A workforce account is made from the record they already hold about you, using the name and email address on it, and it exists from the moment they create it. You are emailed to say so. There is nothing for you to accept, which means you may have an Onvoro account before you have used Onvoro at all.

Where practical, you may browse our public website without identifying yourself. Most product functionality requires an identifiable account, because Onvoro provides operational accountability, permissions and audit history, and none of those mean anything without knowing who did what.

10.Why we use personal information

We may collect, hold, use and disclose personal information to:

• create and manage accounts;
• authenticate users;
• provide the Onvoro platform;
• manage Organizations, roles, permissions and access;
• manage workforce records, Shifts, Jobs and Issues;
• verify attendance and review exceptions;
• provide operational dashboards and Site status;
• create activity and audit history;
• send notifications;
• manage Timesheets, billing and invoices;
• operate integrations an Organization has enabled;
• provide customer support;
• investigate errors and security incidents;
• prevent fraud, misuse and unauthorised access;
• maintain and improve our services;
• comply with legal obligations; and
• establish, exercise or defend legal claims.

11.Notifications

Onvoro may send in-app, push and email notifications about assignments, Shift changes, Jobs, Issues, attendance exceptions, approvals, credential expiry, integration failures, security events and other operational matters.

You can control optional notification preferences in Onvoro or through your device settings. Turning a category off stops the notification from reaching your phone; it does not delete the underlying record, which remains available in the application. Essential security and account communications may not be optional.

Push notifications may be visible on a locked device, so we aim to limit sensitive detail in the push itself and to load the rest only after you have signed in.

12.Artificial intelligence features

Onvoro does not currently provide AI-assisted features, and no personal information held in Onvoro is sent to an AI service provider.

We may introduce AI-assisted features such as operational summaries, natural-language search, drafting or summarising Jobs and Issues, suggested classifications, document retrieval and recommended next actions. Where we do, relevant information may be supplied to an AI service provider to generate the requested result, and we will update this policy before that begins.

If we introduce such features, we will:

• send only information reasonably necessary for the feature;
• apply your existing permissions and access scope before information is made available to it;
• prevent AI tools from bypassing normal Onvoro authorisation; and
• require confirmation for higher-risk actions that change records.

AI would not become the operational source of truth

Onvoro authoritative records and deterministic rules remain the source of truth for permissions, geofence verification, invoice calculations, attendance evidence and audit history.

Unless clearly disclosed otherwise, Onvoro does not intend to rely solely on an AI model to make final decisions about a person’s employment, disciplinary outcome, pay, legal rights or access to essential services.

If Onvoro introduces automated decision-making that uses personal information to make, or substantially assist in making, decisions that could reasonably be expected to significantly affect an individual’s rights or interests, we will update this policy and any required notices to describe the personal information and the kinds of decisions involved.

13.Who we disclose personal information to

We may disclose personal information to:

• the Organization administering the relevant Onvoro account;
• authorised users within that Organization, according to their permissions and access scope;
• a contractor who supplies workers to the Organization, limited to the workers billed through that contractor, as described in the section on contractors and their crews;
• cloud hosting and application platform providers;
• database and cache hosting providers;
• email delivery providers;
• our payment provider, Stripe, which takes payment for an Organization’s Onvoro subscription;
• push-notification delivery providers;
• mobile app update delivery providers, which the Onvoro app asks for a newer version of its own code when it opens, sending the app and device details needed to choose the right version but nothing you have entered into Onvoro;
• file and object storage providers;
• address search and mapping providers, used when an Organization sets up a Site and to show Sites and their geofences on maps in the web app;
• website and product analytics providers, which receive page addresses with identifiers, search terms and security tokens removed, and in the web application an internal account identifier rather than a name or email address;
• monitoring, logging and error-reporting providers;
• our feedback provider, UserJot, which receives what you type or attach in the feedback panel in the web application, and is sent nothing about who you are;
• Xero, where an Organization has connected its own Xero account, as described in the section on third-party integrations, and any other integration an Organization has enabled;
• professional advisers;
• regulators, courts, law-enforcement agencies or government authorities where required or authorised by law; and
• a purchaser, investor or successor in connection with a genuine business transaction, subject to appropriate confidentiality and privacy protections.

Authentication is handled by software we run ourselves. There is no third-party identity provider: no password is disclosed to one, and no sign-in code is issued or checked by one. The code reaches you through the email delivery provider listed above, in the same way as any other message Onvoro sends you.

We do not sell personal information to advertisers.

14.Third-party integrations

An Organization may choose to connect Onvoro with third-party services. Where information is sent to or received from an integrated service, that service’s own privacy terms also apply.

Xero

An Organization can connect Onvoro to its own Xero account. Xero is a separate accounting service that the Organization chooses and has its own agreement with. Somebody at the Organization connects it by signing in to Xero and granting Onvoro access there; Onvoro never sees their Xero password.

Once Xero is connected, Onvoro sends it:

• each invoice the Organization issues, with its lines, amounts, GST, dates and reference;
• the Client each invoice is for: the business name, billing email address, ABN and billing address, used to find or create the matching contact in Xero;
• each bill the Organization draws for a contractor, as a draft bill: its number, dates, amounts and GST, with a line for each Site giving the visits or hours charged. A bill names the contractor and no worker in their crew;
• the contractor each bill is for: their name, email address and ABN, used to find or create the matching supplier contact in Xero; and
• where the Organization sends hours to Xero Payroll, each worker’s approved working hours for a pay period, one figure for each day.

Onvoro reads from Xero, and keeps only what is described in the next paragraph:

• the sales invoices in the Xero account that have changed since it last looked, with their status and the payments, credit notes and other amounts recorded against them. Onvoro uses only those for invoices it sent, so that an invoice shows as paid in Onvoro, and ignores the rest;
• the bills in the Xero account that have changed since it last looked, with their status and the payments recorded against them. Onvoro uses only the bills it sent for contractors, so that a contractor’s bill shows as approved or paid in Onvoro, and ignores the rest;
• contact names, email addresses and ABNs, to match a Client or a contractor to a contact already in Xero;
• the list of employees in Xero Payroll. Xero returns each employee’s summary details, which can include their date of birth, gender and phone number. Onvoro uses only the name, email address and pay calendar to match a worker to their Xero Payroll employee and to work out pay periods; and
• the timesheets already in Xero Payroll for a pay period, for every employee in it, each time hours are sent for that period, so that Onvoro replaces its own drafts rather than adding to them and does not change a timesheet Xero has already approved.

Onvoro keeps a link between each Client, worker or contractor and the matching Xero record, with that record’s name, the payments recorded against the invoices it sent, the status and payments of the contractor bills it sent, and when hours were last sent for each pay period. It does not keep the rest of what Xero returns.

Xero grants access to employees as a whole, so the access Onvoro holds for Xero Payroll would also reach an individual employee’s full record, which is where Xero keeps tax file numbers, bank account details and superannuation information. Onvoro never requests an individual employee’s record, and does not read or store any of those details. They stay in Xero Payroll.

The access Xero grants is held encrypted. An Organization can disconnect Xero at any time from the Integrations page. Disconnecting asks Xero to end Onvoro’s access, deletes the access Onvoro held and stops anything further being sent or read. Onvoro keeps the links between Clients and workers and their Xero records, with each record’s name, so that reconnecting the same Xero account matches the same records again; an Organization can remove a link from the Client or person it belongs to. Information already sent to Xero stays in the Organization’s Xero account and is governed by its agreement with Xero.

Organizations are responsible for choosing which optional integrations they enable.

15.Overseas storage and disclosure

Some service providers may store, process or access personal information outside Australia.

The Onvoro database, which holds the information Organizations and the people working for them enter into Onvoro, is hosted with Railway in Singapore. The servers that run the Onvoro API and its background processing, the files uploaded to Onvoro such as photos and documents, and our backups of the database are held there too.

The Onvoro web application and our public website are served by Vercel, which runs the code that prepares their pages in the United States. Information you view or enter in the web application passes through those servers on its way to and from the database, and is not stored there.

Requests to the Onvoro API, including those from the mobile app, reach it through the network of Railway, our hosting provider, which may receive them at a location near the person making them before passing them to the servers in Singapore. That network carries the requests and does not store the information in them.

Our technical logs are held in the United States.

Feedback sent through the panel in the web application, and any account you make with UserJot there, is held by UserJot in the United States.

Other providers we use, such as those that send email and push notifications and that deliver updates to the mobile app, may process personal information in the United States and other countries in which they or their subprocessors operate.

Billing information for Onvoro subscriptions is handled by Stripe, which may process it in the United States and other countries in which it operates.

Where an Organization connects Xero, the information described in the section on third-party integrations is sent to the Organization’s own Xero account, which Xero may process in the United States and other countries in which it operates.

Where required by applicable law, we take reasonable steps in relation to the overseas handling of personal information.

Because infrastructure and providers change, we may publish a separate Subprocessors page listing key providers and their processing locations. Where we do, it will be linked from this policy.

16.Security

We use technical and organisational safeguards designed to protect personal information against misuse, interference, loss, unauthorised access, modification and disclosure.

Measures include authentication, role-based and scope-based access control applied on every request rather than only in the interface, encryption in transit, secure cloud infrastructure, audit logging, restricted administrative access, monitoring, backups, secrets management and incident-response procedures.

Files are uploaded directly to secure storage and retrieved through links that expire, rather than through long-lived public URLs.

Where we rate-limit sign-in attempts against a particular account, we store a one-way hash of the email address rather than the address itself, so that the protective record cannot become a list of our customers’ addresses.

No internet or storage system is completely secure, and we cannot guarantee absolute security.

17.Data breaches

We maintain processes for responding to suspected or confirmed data breaches.

Where the Notifiable Data Breaches scheme or another applicable law requires notification, we will take the steps required by law, which may include notifying affected individuals and the Office of the Australian Information Commissioner.

18.Retention and deletion

We keep personal information only for as long as reasonably necessary to provide Onvoro, maintain operational and audit records, meet legitimate retention requirements, comply with law, maintain security, resolve disputes and enforce agreements.

Retention periods differ depending on the information involved. Operational history such as attendance, timesheets and invoices is retained rather than deleted when a worker leaves, because it is the record that settles questions about pay and billing after the fact.

An account that is created and never used stops working after 30 days. Because an account can be created for you by your Organization, an address entered incorrectly would otherwise be a working account belonging to whoever holds that mailbox, for as long as the Organization existed. Access can be restored by the Organization if the account was a real one that simply had not been used yet.

When personal information is no longer required and we are not legally required to retain it, we take reasonable steps to delete, destroy or de-identify it.

Some information may remain temporarily in secure backups until those backups are rotated or deleted.

19.Access and correction

You may request access to personal information we hold about you, or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Depending on the information, we may handle the request directly or work with the Organization that administers your Onvoro account.

We may need to verify your identity before providing access or making a correction.

20.Account and information deletion requests

You can delete your Onvoro account yourself in the mobile application, under Profile and then Your details, using Delete my account. Our support page at onvoro.io/support explains what deleting an account removes and what your Organization keeps. You can also ask us to delete your account or other personal information by contacting Onvoro, or ask your Organization administrator.

Deletion may be subject to your Organization instructions, legitimate operational record requirements, contractual obligations, security requirements, applicable retention laws, and information required to establish or defend legal claims.

Where deletion is appropriate, we will take reasonable steps to delete or de-identify the relevant information.

21.Marketing communications

We may send product, service or business communications where permitted by law.

You can unsubscribe from optional marketing emails using the unsubscribe link in the message, or by contacting us.

Operational, security, billing and account-related messages may still be sent where necessary to provide the service.

Alert emails, such as a flagged sign-in or a quote a client has accepted, carry an unsubscribe link too. Using it stops all alert email from that Organization at once. The alerts still appear in the app, and you can choose email and phone notifications separately for each kind of alert in your account settings.

22.Privacy complaints

If you believe we have mishandled your personal information or breached an applicable privacy obligation, please contact us with enough information for us to understand and investigate your concern.

We will review the complaint, request further information if needed, and respond with the outcome or next steps within a reasonable period.

If you are not satisfied with our response and the Australian Privacy Principles apply, you may be able to make a complaint to the Office of the Australian Information Commissioner.

23.Changes to this Privacy Policy

We may update this policy when our products, integrations, providers, information practices or legal obligations change.

We will publish the updated version on our website and update the date shown at the top.

Where a change is significant, we may provide additional notice through Onvoro, by email, or through another appropriate channel.

24.Contact us

For any privacy question, including a request for access, a correction, a deletion request or a complaint, contact us and we will help direct it.