Privacy policy

Only what the app needs to roster crew, record time, and bill work:

• Your details — name, mobile number, email, role, and any licences or tickets your employer records against you (type, number, expiry).
• Work records — jobs, bookings, the shifts you're rostered on, timesheets, pour records, site diary entries and the forms you fill in.
• Location, only at clock-on and clock-off. When you tap Clock on or Clock off the app records a single GPS reading at that moment, so your employer can confirm the shift was started on site. SiteWise does not track your location continuously, and it records nothing while you're off the clock or the app is closed. If you decline the location permission you can still clock on — the punch is saved without a position.
• Photos you take or upload for site records and forms, and the caption and job you attach them to.
• Push notification token, if you turn notifications on, so job pings can reach your phone. Turning notifications off removes it.
• Client and money records your office enters — client contacts, quotes, invoices and payments.

We do not collect advertising identifiers, we do not build advertising profiles, and we do not sell personal information to anyone.

To run the service your employer signed up for: putting the right crew on the right job, recording hours for payroll, keeping the compliance records a construction business is required to keep, and issuing quotes and invoices. We also use it to keep the service secure and working, and to support your employer when something goes wrong.

Inside your business, office staff (admin and foreman) can see crew records and work records; crew see their own hours, their rostered jobs and the site records they create. Nothing is shared with another business — every record is scoped to your employer's account at the database level.

We use these providers to run the service, and only for that purpose:

• Supabase — database, login and file storage (Sydney, Australia).
• Vercel — application hosting.
• Anthropic — the assistant features. Job and schedule details are sent when someone asks the assistant a question. It is not used to train models.
• Resend — transactional email (invites, confirmations).
• Twilio — SMS confirmations, where your employer has enabled it.
• Stripe — payment links on invoices. Card details go straight to Stripe; SiteWise never sees or stores them.
• Xero — accounting sync, where your employer has connected it.

We'll also disclose information if the law requires it — a court order, or a regulator acting within its powers.

Data is stored in Supabase's Sydney region. Some providers above process data overseas; where that happens we rely on their standard contractual protections.

Records are kept while your employer's account is active. Employment and safety records often have to be kept for years under Australian law — for example, time and wages records for seven years under the Fair Work Act — so your employer may be required to retain them even after you leave. When an account closes, data is deleted within 90 days unless a law requires it to be kept longer.

You can ask to see the personal information we hold about you, ask for it to be corrected, or ask for it to be deleted. Because your employer controls the account, start with them — they can correct most records directly in the app. If they can't help, contact us and we'll act on a verified request within 30 days.

Deleting your login yourself. You don't have to ask anyone: office users have Delete my account under Settings, and crew have it at the bottom of the crew screen. It deletes your login, your password and any devices registered for notifications, and removes your email and mobile from the crew record.

What it does not delete is your work history — timesheets, dockets, site records, forms and invoices. Those belong to your employer, who is required to keep them (time and wages records for seven years under the Fair Work Act), and they are the evidence if there is ever a question about your pay or a safety incident. Your name stays on those records so they still say whose they are. If you believe a record about you is wrong, ask your employer to correct it — that right is real and they can do it in the app.

If you think we've mishandled your information you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Access is controlled per business at the database level, so one business's records cannot be read by another. Files — including site photos — are held in private storage and served through short-lived links, never public URLs. Traffic is encrypted in transit. Sign-in uses your email and password or a one-time link; session cookies are http-only.

If personal information is lost or accessed by someone who shouldn't have it, and it's likely to cause serious harm, we will contain it, assess it promptly, and notify the affected people and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. Account holders will be told what happened, what was involved, and what to do about it.

SiteWise is a workplace tool and isn't intended for anyone under 16.

If this policy changes we'll update the date at the top, and tell account holders about anything significant.

Questions about this policy, or a request about your information: privacy@sitewise.au.