01Who we are
Anchorlog Pty Ltd (ACN 698 324 006, ABN 32 698 324 006 — a proprietary company limited by shares registered in New South Wales, Australia, commenced 22 May 2026), referred to in this policy as "Anchorlog", "we", "us", or "our", operates the Anchorlog platform.
When you use our platform — whether you are a worker completing an induction or signing on to a site, a visitor signing in to a site, a site administrator managing inductions, or a subcontracting company associated with a worker — we are the APP entity responsible under the Privacy Act 1988 (Cth) for the personal information we collect through the platform.
We collect and hold the information of workers and visitors on behalf of the builder (our customer) running each site, to provide the platform to that builder. The builder is responsible for its own use of those records. We remain responsible for keeping the information secure, for this policy, and for our own uses described in §3.
Our customers may have their own privacy notices that apply to their own handling of your information outside our platform; this policy describes our handling.
Questions about what information is held about you, or how to access or correct it, can be directed to us at privacy@anchorlog.com.au, or to the site administrator who invited you, who we will cooperate with in responding.
We are an APP entity under the Privacy Act 1988 (Cth) and are bound by the Australian Privacy Principles (APPs). This policy explains how we manage personal information under APP 1.
02What personal information we collect
We collect personal information directly from workers (at induction, sign on and sign off), from visitors (at site sign-in), from site administrators and subcontracting companies (our customers and the people they invite), and automatically from devices using the platform.
| Category | What it includes |
|---|---|
| Identity | Full name; preferred name; date of birth and residential address (collected on every site using the standard Anchorlog induction; otherwise where an operator's form requests them); photo ID images (driver licence or passport, front and back) collected for identity verification on standard-induction sites. |
| Contact | Mobile number; email address. |
| Emergency contact | Name and mobile of the worker's nominated contact, and, if the worker gives them, the relationship (e.g. "spouse") and the contact's address. Third-party personal information — see the note below this table. |
| Employment & credentials | Employer or subcontractor for a given site, with the employer's phone number, the worker's role or trade, employment type and how long they have worked there; who inducted the worker, where the site lists inductors; WHS credentials (number, issue date, expiry date, issuing body); uploaded credential images. |
| Signature | Captured signature image for induction and SWMS acknowledgement. |
| Health — allergies and health conditions | Sites using the standard Anchorlog induction ask every worker: "Do you have any allergies or health conditions that might need first aid in an emergency?" The worker either agrees to Anchorlog keeping their answer for the builder, for site safety and emergencies, and then answers Yes or No, or chooses "I'd rather tell the site manager in person". That choice never blocks the induction: no health details are kept from this answer, only that they chose it. A details box appears only if the worker answers "Yes", and filling it in is optional. The agreement and the answer are saved with that induction's other answers. Separately, before the form, the worker reads our collection notice and taps "I acknowledge this notice". The site's administrators can see the answer when they open the induction, and it goes into an induction report only if an owner or admin ticks to include it. It is not copied into the worker's next induction at another site; the worker answers it fresh each time. Operators' custom forms may also ask health questions, and this agreement and this choice do not cover them. This is sensitive information under the Privacy Act 1988. |
| Sign on / sign off | Date, time, site. Your phone's location at sign on is kept only where the builder has recorded giving you its notice about location tracking at that site; otherwise it is dropped. |
| Induction responses | Answers (including free text) to the site's induction form. |
| Visitors | If you sign in to a site as a visitor (including a delivery), we collect your name, mobile number, a signature drawn on screen, who you are visiting or why you are there, your visit type, and a coded form of your internet address and browser type. You are shown a short visitor notice before you sign in. |
| Incident records | If a builder records a notifiable incident at a site, the record holds a description of the incident and, for each worker or visitor involved, a description of any injury and its outcome. Injury details are health information. The builder can attach evidence files to the record (photos and PDFs). A photo can hold the time and place the phone recorded when it was taken. |
| Silica worker register | Where a worker does work involving crystalline silica, the builder may add them to its silica worker register: the date they were added, supporting evidence, and the date that work ended. |
| Subcontractor companies | The company's name and contact details (contact person, email, mobile, and a site supervisor), and the compliance documents it uploads: workers compensation, public liability and professional indemnity certificates, certificates of currency, subcontractor statements, licences and safety data sheets. |
| Builder and subcontractor accounts | Name, email, password and organisation name for people who sign up or are invited. If you choose to sign in with Google or Microsoft, that provider confirms who you are and passes us your name and email address. If someone in a builder's account books a printed site sign, the delivery address and contact they enter. |
| Technical | IP address; truncated user-agent; QR and pass tokens (not independently identifying). |
About your emergency contact.
When you complete an induction you may be asked to provide the name, phone number, relationship and address of an emergency contact — for example, a spouse, a parent, or a trusted friend.
This is personal information about a third party that you are giving us, and we use it only for the purpose of reaching that person in an emergency during your attendance at a site.
We do not contact this person for any other purpose.
If your emergency contact becomes aware that we hold their information and wishes to access or correct it, or to have their information removed from your record, they can contact us using the details in §9 / §1.
We will verify their identity proportionately and take reasonable steps to respond.
Please consider letting the person you nominate know that you have provided their details, so they can make an informed decision about the nomination.
Where an operator's custom form collects categories beyond those listed, the operator's own privacy notices apply to that collection; we act in relation to that information as described in §1 (see Appendix A).
03Why we collect it
Primary purposes:
- Operate induction, sign on, sign off and visitor sign-in — e.g. verify a worker has completed the required induction before signing on.
- Maintain a WHS record of who was on site, when, holding which credentials, under which induction.
- Provide site administrators with dashboards, reports, and exports to meet their WHS obligations, including incident records and the silica worker register.
- Contact workers with induction-completion confirmations, credential-expiry reminders, and operational messages.
- Contact site administrators about their account, subscription, and platform usage.
- Verify the identity of the person completing induction (photo ID check by the site operator).
Secondary purposes (permitted under APP 6):
- Platform improvement — aggregated usage-pattern analysis; de-identified or aggregated data preferred where practicable.
- Legal, regulatory, contractual obligations — lawful requests from a WHS regulator, a court, or an Anchorlog customer whose contract specifies audit support.
- Security-incident and suspected-misuse investigation.
We do not use personal information for marketing to workers. Marketing (if any) goes only to site administrators or operator contacts who have opted in.
04Who we share it with
We share your information with:
- Site operators and administrators — the people running induction, sign on, and site safety at the sites you are inducted for or visit.
- Subcontracting companies — the company you are working under on site, if you are engaged by a subcontractor.
- Australian WHS regulators — when required by law (for example, SafeWork NSW under the WHS Act 2011).
- Observability (error monitoring): when part of the platform fails on our servers, a report of that failure is sent to Sentry, our error-monitoring sub-processor, so we can fix it. Its collection of request contents, cookies, headers, IP addresses and user details is switched off.
- Sub-processors — the third-party service providers we use to operate the platform. The current sub-processor list (function, jurisdiction, contract basis) follows:
| Sub-processor | Function | Jurisdiction |
|---|---|---|
| Apple Inc. | Wallet pass distribution | US |
| Amazon Web Services Australia Pty Ltd | Nightly backup copies (database + stored files) | Sydney, Australia (ap-southeast-2) |
| Microsoft Azure AI Translator | Machine translation of site induction content | Australia (australiaeast) for processing; control plane US |
| Google LLC | Wallet pass distribution | US |
| Mobile Message Pty Ltd | SMS OTP + notifications | Sydney, Australia; some data processed in the US (OpenAI) |
| Resend Inc. | Transactional email | US |
| Sentry (Functional Software, Inc.) | Error monitoring | US |
| Stripe Inc. | Subscription billing + payment processing | US (control plane); global processing per Stripe data-residency posture |
| Supabase Inc. | Database + auth | Sydney, Australia (ap-southeast-2) |
| Ubicloud Inc. | Machines that run the deploy + database update jobs, and the checks that compare the code with the live database | Germany |
| Vercel Inc. | Hosting + CDN edges | Global CDN; control plane US |
Translation of induction content. If you choose to read a site induction in a language other than English, the induction text written by your site operator — section headings, safety information and question labels — is sent to our translation sub-processor so it can be shown in your language. Your own answers are not sent, and neither is your name, your contact details, your photo, your signature or any document you upload. Translations are produced once per published version of an induction and reused, so the same text is not sent again for each worker. Machine translation is provided to help you understand; the English version remains the official one.
Signing in with Google or Microsoft. If you sign in to a builder or subcontractor account with Google or Microsoft, that provider handles the sign-in and tells us your name and email address.
Address lookup. When someone in a builder's account types a delivery address for printed site signs, what they type is sent to Google's address service to suggest and check the address.
If you book a call with us, your name, email and chosen time are held in our Google Calendar.
We do not sell your information and we do not use it for marketing.
05How we store it and where
Your personal information is stored on Supabase infrastructure in Sydney, Australia (AWS ap-southeast-2). Some of the services we use to run the platform are global services, and the limited information we share with each of them may be handled on infrastructure outside Australia. Every one of them is named in §4, so you can see who they are and what they do.
Each night we also copy the database, and the files stored with it, to backup storage we hold with Amazon Web Services in Sydney, Australia. A nightly copy is kept for 30 days, and the first copy of each month for a year. Once a year we also copy the silica worker register and its evidence, and keep that copy for 30 years. Something deleted from the platform stays in these copies until they expire: a file for up to 30 days, and a database record for up to a year (a silica register record or its evidence for up to 30 years).
Certain secondary recipients listed in §4 (Stripe, Resend, Apple, Google, Vercel, Mobile Message, Microsoft, Sentry) are global services whose handling of the limited information we share with them may involve infrastructure outside Australia; we disclose them explicitly so you can make an informed decision. Induction-content translation is processed in Microsoft's Australian region (australiaeast), with the service's control plane in the United States.
Google is used for Wallet passes, account sign-in, address lookup and call bookings; Microsoft for induction translation and account sign-in. Ubicloud supplies the machines that run the jobs that deploy new versions of the platform and update its database; it says its data centres are in Germany, and while a job runs the machine holds the passwords and settings the job needs to reach the platform and its database.
Sentry stores error reports in the United States; its account settings are held in the United States. PostHog is not in use.
Access inside Supabase is controlled by our Row-Level Security (RLS) model (§6).
06How we keep it secure
We take reasonable steps (APP 11.1) to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure.
| Control | What we do |
|---|---|
| Row-Level Security (RLS) | Database enforces access at the row level. A worker's record is visible only to authorised administrators of the sites they inducted at. Cross-tenant access is blocked at the database, not just the application. |
| Authentication | Builder and subcontractor accounts sign in with a password (at least 12 characters) or with Google or Microsoft. Workers reach their own records at /my-data with a code sent to their mobile. Sessions managed via secure HTTP-only cookies. |
| Rate limiting | Public endpoints (induction, sign on, sign off, pass) rate-limited by token + IP address. |
| Transport encryption | HTTPS (TLS) on all traffic. |
| At-rest encryption | Database and object storage encrypted at rest by the underlying provider. |
| Audit logging | Activity affecting personal information recorded in an append-only audit log. RLS permits INSERT by the application role; UPDATE and DELETE blocked under normal operation. |
| PII minimisation in logs | Log metadata does not duplicate identifier fields (worker name, mobile). IP and user-agent values hashed and truncated respectively. |
| Administrative access | Production access limited to authorised personnel under least privilege. Administrative actions logged. |
What we do not claim.
We do not claim that our records can never be changed, or that we can give a mathematical proof that a record has not been.
"Append-only" means the database rejects UPDATE and DELETE against the log table under normal operation.
Positive cryptographic integrity proofs (hash-chain or similar) are on our roadmap, not in place today.
Customers whose use case requires such a proof should contact us for current posture detail.
If there is a data breach.
If we suspect a data breach, we assess it. If it is likely to cause serious harm to the people whose information is involved, we notify the Office of the Australian Information Commissioner, we notify the people affected by text message or email, and we tell the affected builder's owner and administrators by email.
07How you can access or correct your information
Under the APPs you can request access (APP 12) and correction (APP 13) of the personal information we hold about you.
Workers: /my-data. Sign in at /my-data with your mobile number and the code we text you. There you can see your details, your credentials and the builders you have engaged with (and whether your consent is recorded or withdrawn), and:
- Request my data. We prepare a file of your records (your worker details, inductions and their answers, sign on and sign off history, credentials, employer details and the messages we sent you). Requests are processed once a day. When the file is ready we text you a link, and the link works once.
- Request a correction. Pick the detail that is wrong and give the right value. Our staff review each request and either make the change or explain why not. Corrections on this page can reach your name, email, mobile number and date of birth, your emergency contact's name, phone and relationship, your employer details, and your licence numbers and expiry dates. They cannot reach the answers saved inside a completed induction form, such as your residential address, your medical answer, your emergency contact's address or your photo ID. For those, email us.
Everyone else, or anything the page does not cover: email privacy@anchorlog.com.au. This includes visitors, emergency contacts, and a worker who wants to withdraw consent for a builder.
If you withdraw consent. When a withdrawal is recorded, your /my-data page shows it as withdrawn, and you cannot sign on at that site again until you accept the collection notice again. Withdrawing does not delete records already made; they are kept for the periods in §8.
How we respond.
Within a reasonable time (typically 30 days), we acknowledge, verify your identity proportionately to the sensitivity of the information, and then either (1) provide the information, (2) make the correction, or (3) explain in writing why we cannot and how to complain about that decision.
Who can ask. Workers, through /my-data, via the site administrator who invited them, or directly to Anchorlog. Visitors and emergency contacts (see the emergency-contact note in §2), directly to Anchorlog.
08How long we keep your information
We retain personal information only for as long as we need it for the purposes in §3, or as required by Australian law. APP 11.2 requires us to take reasonable steps to destroy or de-identify personal information once it is no longer needed.
How long we keep each kind of record:
- Induction records (completion evidence, answers, SWMS acknowledgement, signature): at least 7 years after the induction was last active.
- Your worker record, and with it your sign on and sign off history, employer details, SWMS acknowledgements and site authorisations: until the latest of 7 years after your last sign on, sign off or engagement with a builder, the end of every one of your induction periods, and, if you are on a silica worker register, the end of that register period.
- Credentials (licences, tickets, qualifications and their images): kept as part of your worker record. An expired credential is not removed on its own. We send expiry reminders, and the credential is removed from view with the rest of your worker record when that record's period ends.
- Photo ID images (driver licence or passport, front and back): deleted 3 months after the site the induction belongs to is archived by the builder, or 3 months after the account owner deletes the account if that comes first. The record that the ID was checked stays with the induction. If neither happens, the images are deleted 12 months after the later of the induction and the worker's last sign on or sign off at that site, as long as the site is still in the same builder's account. If the site has moved to another builder's account, the images from before the move are kept.
- Visitor records: at least 7 years from the day you sign in, and at least 5 years from the incident if your visit is part of a notifiable incident record, whichever is later.
- Incident records: at least 5 years from the date the regulator was notified. Records tied to the incident (such as the inductions of the workers involved and the SWMS in effect) are kept at least 5 years from the incident.
- Silica worker register records: at least 30 years from the date the worker's silica work ended, or from the date they were added if no end date is recorded.
- Email copies: the copies of emails we send are deleted 6 months after sending.
- Account records (builder and subcontractor team members): kept while the account is open. If an account owner deletes the account, team members' names, email addresses and phone numbers are replaced straight away and their sign-ins are closed. The site records are removed from view and kept for at least 7 years from the deletion (incident and emergency drill records at least 5 years, silica worker register records at least 30 years), or until a later date their own period above sets. Four kinds of record do not follow that floor: notifications, wallet passes and the site's high-risk work list are deleted straight away; subcontractor document reviews are kept for at least 12 months from the deletion; photo ID images are deleted 3 months after the deletion, or sooner where the Photo ID line above sets an earlier date, except images from before a site moved to another builder's account, which are kept; and the records of which induction content someone viewed are kept for at least 7 years from the day the site was completed, or from the deletion if the site was still open. Billing and contractual records are kept for 7 years per Corporations Act s 286.
- Technical logs and audit_log records: retained per the integrity policy in §6 — append-only under normal operation.
- Marketing or communication records: retained while the communication relationship is active, plus 12 months after last contact (for contact records); opt-out markers retained indefinitely so that an unsubscribe request (Spam Act 2003 s 18) stays in effect.
What happens when a period ends. Every night, worker records whose period has ended are removed from view, together with their inductions, sign on and sign off history, credentials, employer details, engagements, SWMS acknowledgements and site authorisations. "Removed from view" means builders can no longer see them; they stay in our database, and we do not yet have a step that destroys them permanently. Three kinds of record are deleted outright today: photo ID images and email copies, as set out above, and workplace surveillance notice lists, seven years after the notice stops applying. Visitor, incident and silica register records are not yet removed automatically when their periods end.
Holds. Records can be placed on hold for an investigation or legal matter. While a hold is open, the nightly removal and the photo ID deletion wait for those records.
If a builder cancels. Cancelling a subscription deletes nothing. The records stay on the schedules above. An account that has cancelled can export its site records from its billing page. If the account owner then deletes the account, the steps under "Account records" apply.
We take reasonable steps to destroy or de-identify personal information once no longer needed, consistent with APP 11.2. Full retention detail is available on request.
09How to complain
If you believe we have breached the APPs or any registered APP code binding us, you can complain.
How.
Email privacy@anchorlog.com.au.
Please describe what happened, when, what personal information was involved, and the outcome you are seeking.
How we handle your complaint.
We acknowledge receipt within 7 days, investigate, and provide a written response within 30 days — or explain any delay with an updated timeframe.
If you are not satisfied with our response, you may refer the complaint to the Office of the Australian Information Commissioner (OAIC):
| Channel | Detail |
|---|---|
| Website | https://www.oaic.gov.au |
| Phone (within Australia) | 1300 363 992 |
| Post | Office of the Australian Information Commissioner, GPO Box 5288, Sydney NSW 2001 |
Alternative formats.
You can request this privacy policy in an alternative form (printable PDF, screen-reader-friendly version, etc.) by contacting us at the address above. This discharges APP 1.6.
10Updates to this policy
We update this policy when there is (a) a material change to how we collect, hold, use, or disclose personal information, (b) a change to our regulatory posture, or (c) an underlying platform architecture change that affects §§1–9.
Version and date.
The version and the date it took effect are shown at the top of this policy. They change only when we publish a new version. Changes we are drafting do not change them until they are published.
Each earlier published version stays viewable at its own address, linked from the top of this page.
Availability (APP 1.5 / APP 1.6).
The policy is available free of charge at /privacy, linked from the marketing footer. The collection notices workers and visitors see before they give their details point to it.
Alternative formats are available on request (see §9).