Privacy policy

Who we are

“Datesly”, “we” and “us” mean the Datesly service, operated in Australia. You can contact us about privacy at any time at datesly.alerts@outlook.com.

Two kinds of information

Information about our customers. When you sign up, we collect information about you and your business so we can run your account.

Information our customers enter about their people. Employers use Datesly to record details about their staff and subcontractors. For that information, the employer decides what goes in and why, and we store and process it on their behalf. If you are a worker and want to access or correct a record, please contact your employer first. We will help them respond, and you can also contact us.

If you are an employer, you are responsible for having a lawful reason to collect your workers’ information and for telling them that you use Datesly to track their licences and send reminders.

What we collect

• Account details: your name, email address and password. Passwords are stored only as a salted one-way hash (scrypt); we cannot read them. If you use an emailed sign-in link, we store a single-use token that expires.
• Business details: business name, timezone, chosen plan, subscription status and your reminder settings.
• People records: names, email addresses, phone numbers, job titles, notes, ABNs and ABN check results, and the sites people are assigned to.
• Document records: the type of licence or certificate, document numbers, issue and expiry dates, issuing state, insurance details (insurer, policy number, named insured, sum insured), notes, and verification records (who checked, when, against which source and the result).
• Uploaded files: photos or PDFs of licences and certificates uploaded by you or by a worker using an upload link you sent. Text on uploads may be read automatically to suggest dates and numbers. That reading happens on our own servers; we do not send your files to an outside AI service.
• Site sign-ins: if a business uses QR site sign-in, we record who signed in or out at which site, when, and whether the sign-in was cleared or blocked (with the reason). The email or mobile number typed in is only used to find the matching record and is not stored with the sign-in.
• Email records: which reminders and notices were sent, to which address, when, and the delivery reference from our email provider.
• Billing information: handled by Stripe. We receive your Stripe customer and subscription identifiers and payment status. We never see or store full card numbers.
• Enquiries: if you use our contact form or email us, we keep your name, email, business, industry and message so we can reply.
• Website usage: aggregated, cookie-free page view and performance statistics from Vercel Web Analytics and Speed Insights (for example which pages are viewed, the referring site, country and device type). These are not used to identify you.

Datesly is not designed to hold sensitive information such as health information, criminal records or tax file numbers. Please do not enter it in notes or fields. Some documents (for example a police check or a working with children check) can show that a check exists; we recommend recording only the card number, status and expiry date rather than uploading anything that reveals the details of a record.

How we use it

• To provide the service: show your dashboard and reports, send expiry reminders and worker upload links, and run the checks you ask for.
• To run your account: sign-in, billing, support and service notices (for example a failed payment or a change to these terms).
• To keep the service secure and working: preventing abuse, investigating faults and measuring performance.
• To answer enquiries you send us.

We do not sell personal information, we do not use your people records for our own marketing, and we do not send marketing email without your consent. Service emails, such as expiry reminders you have set up, are part of the service. Workers who receive reminders can unsubscribe using the link in each email.

Who we share it with

We use a small number of service providers to run Datesly. Each only receives what it needs:

• Supabase: database and file storage, hosted in Sydney, Australia (AWS ap-southeast-2). This is where your records and uploaded files live.
• Vercel: hosts the website and application servers. Our application servers run in Sydney. Vercel’s network may route requests through edge locations outside Australia, and Vercel is a United States company.
• Stripe: payment processing and subscription billing. Stripe may process billing data in the United States and other countries.
• Brevo: delivers our emails (reminders, sign-in links and notices). Brevo receives the recipient’s email address and the content of the email, and is based in the European Union.
• People a business chooses to share with: if a business creates a client compliance pack, anyone with that link (usually a head contractor or client) can see the names, roles, document types, status, expiry dates and register checks in it until the link expires or is withdrawn. Licence numbers and ABNs are only included if the business turns that on. Emails, phone numbers and uploaded files are never included.
• Government registers: when you run an ABN check, the ABN is looked up with the Australian Business Register. Where the official NSW White Card check is connected, the card number is checked with the NSW Government. A Victorian building practitioner registration number you choose to check is looked up in the register the Victorian Government publishes on DataVic. A QBCC licence number you choose to check is looked up in the data the QBCC publishes on Queensland open data. Guided verification simply opens the official checker in your browser.

Because Vercel, Stripe and Brevo may handle some information outside Australia (mainly the United States and the European Union), we take reasonable steps under APP 8 by using established providers with published security and data protection commitments. Your main records and uploaded files are stored in Australia.

We may also disclose information where the law requires it, or to protect the safety of a person or the security of the service.

Cookies

We use one essential cookie to keep you signed in. It is HTTP-only and sent only over secure connections. We do not use advertising or cross-site tracking cookies.

How long we keep it

We keep your account information and records for as long as your account is open. If you cancel, you keep read access to what you entered. If you ask us to close your account, we delete your business, people, document records and uploaded files within 30 days, except where we must keep something by law (for example billing records). Email delivery logs and enquiries are kept only as long as we need them to run the service, handle support and meet our legal obligations.

How we protect it

Information is encrypted in transit and at rest, access is limited to your own business account, and uploaded files are kept in private storage. See our security page for detail. If we become aware of a data breach likely to cause serious harm, we will notify affected customers and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.

Access, correction and export

You can view and edit your records at any time in Datesly, and export them to CSV from the app. You can ask us for a copy of the personal information we hold about you, or ask us to correct or delete it, by emailing datesly.alerts@outlook.com. We will respond within 30 days. You can deal with us anonymously or under a pseudonym for general enquiries, but we need your real email address to run an account.

Complaints

If you have a privacy concern, email datesly.alerts@outlook.com and we will respond within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.

Children

Datesly is a business service and is not intended for people under 18.

Changes to this policy

We will update this page if the way we handle information changes, and change the date at the top. If a change is significant, we will email account owners before it takes effect.