Privacy Policy

Onboardly is operated by HomeSwim Australia Pty Ltd (ABN 66 640 753 877), trading as TopDev Australia ("we", "us", "our"). We are committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, how we use it, and your rights in relation to that information.

This policy applies whenever you use onboardly.com.au or our platform.

1. Who we are

Onboardly is an Australian software-as-a-service platform designed to help businesses manage staff onboarding, compliance tracking, and HR documentation. Our services are accessible at onboardly.com.au.

For privacy enquiries, contact us at support@onboardly.com.au.

2. Information we collect

Business account information

When you create a business account, we collect:

• Business name and contact details
• Name and email address of the account owner
• Password (stored as a secure hash)
• Billing information (processed securely by Stripe)

Staff and employee information

When your business uses Onboardly to onboard staff, the following information may be collected:

• Full name, date of birth, address, and contact details
• Tax file number (TFN), bank account and superannuation details
• Your tax declaration answers: whether you are an Australian resident, a foreign resident or a working holiday maker for tax purposes; whether you claim the tax-free threshold; and whether you have a study or training support loan. Working holiday makers are also asked their country of residence.
• Work rights and visa information
• Qualifications, certifications, and licence details (including expiry dates)
• Emergency contact details
• Uploaded documents (e.g. identification, first aid certificates, Working With Children Checks)
• Employment offer and contract records

Time and attendance

If your employer uses Onboardly's time clock, we record when you clock in and out, the centre, and whether you used your phone or the centre's shared tablet (the kiosk). Each entry is matched to your rostered shift where there is one, which sets the length of your break, and we work out the hours you worked from these. Your rostered shifts — start and end, break, centre and any note — are entered by your employer, and you can see them in the app.

Your employer's managers can see your entries, correct the times, break or note, and approve them; we keep a record of who changed or approved an entry and when. Approved hours are sent to your employer's Xero payroll as the number of hours you worked each day — not your clock times, location or notes.

Clocking in in the Onboardly staff app. The time recorded is the time on your phone when you tapped, so a clock-in made without signal counts from that moment and is sent when the phone is back online. We also record how far your phone's clock was from ours at that moment, so a manager can see when a phone's clock was wrong; it is never used to change your times. If you clock in away from your centre, you can add a note for your manager saying why, and it is stored with the entry.

Clocking in on the kiosk. You enter a four-digit PIN. We store it only as a one-way hash, which can't be turned back into the PIN, and lock it temporarily after five wrong attempts. The kiosk doesn't record your location.

Training courses

If your employer assigns you training courses, we record when each course was assigned to you, when you completed it, and which version of the course you completed, so your employer can tell whether a course has changed since. Your employer's managers can see who has completed each course and can ask everyone to complete a course again. How far you've got through a course is kept only on the phone you're reading it on and isn't sent to us.

Using the Onboardly staff app

Location at clock-in and clock-out. If you use Onboardly to clock in or out on your phone, we record your device's location at that moment — only then, never in the background — and compare it with your centre's location to show your employer whether the clock-in happened on site. Location is optional: you can refuse the permission and still clock in. The coordinates are stored with the time entry; your employer's managers see whether the clock-in was on site. Your employer can also set the time clock to refuse clock-ins from outside the centre's area: if they have, a clock-in sent with a location outside that area is refused and nothing is recorded, and the app tells you so. Clocking out is never refused, and nor is a clock-in made without a location — it is recorded without one.

Certificates you add in the app. To add a certificate you can photograph or scan it with your phone's camera, choose a photo, or choose a file (a PDF or an image). The app only uses the camera, your photos or your files when you choose to add a certificate, and only the photo or file you pick is uploaded. Until the certificate has been saved, the app keeps a copy in its own storage on your phone (not in your photo library), so it can still be sent if you lose signal; the copy is deleted once the certificate is saved or you stop adding it. Once uploaded, the certificate is stored with your other documents and can be seen by the people at your employer who manage staff records. When you upload a certificate with signal, in the app or on the website, we read the dates and the name printed on it automatically so you can check them; you confirm or correct the dates yourself before they are saved. A certificate added without signal isn't read: you type the dates yourself.

Notifications on your phone. If you allow notifications, your phone gives the app a push token — an identifier that lets us send notifications to that phone. We store it with your account and use it only to send you reminders about your qualifications: before a certificate expires, after it has expired, and when a required certificate is missing or has been sent back. A notification shows the certificate's name and, where relevant, its expiry date. We delete the token when you sign out of the app on that phone, or when Apple or Google tell us the phone can no longer receive notifications. You can turn either kind of reminder off in the app's notification settings, or turn notifications off in your phone's settings; the same reminders still reach you by email. We keep a record of each reminder sent, as we do for emails, and of when you read it in the app's Notifications list.

What the app keeps on your phone. So it works without signal, the app keeps a copy of your own information on your phone: your details, your certificates list, shifts, courses and notifications, and how far you've read in each course. Signing out deletes this copy and stops notifications to that phone. Clock-ins and certificates you've added that haven't been sent yet are different: they exist only on your phone until they're sent, so the app sends them before you sign out, and anything it can't send stays on the phone and is sent when you next sign in there. Deleting the app deletes everything.

3. Why we collect and use your information

We use personal information to provide and operate the platform, process payments, send transactional emails, maintain compliance records, improve our services, and meet legal obligations. We do not sell your personal information.

4. Third-party service providers

We use these providers to run Onboardly. Each receives only what it needs for the job described.

• Supabase — database, file storage (including uploaded certificates and documents) and sign-in, hosted in Sydney, Australia (AWS ap-southeast-2)
• Vercel — hosts the website and runs its code in Sydney, Australia. Vercel's own systems, including the technical request logs it keeps for a short time, are primarily in the United States.
• Amazon Web Services — keeps our nightly backups in Sydney, Australia, for up to 30 days. The backups are encrypted before they reach AWS, and AWS doesn't hold the key.
• Resend — sends our emails: invitations, sign-in codes, reminders, offer letters, and the payroll-setup email to your employer's accountant (your employment and contact details and super fund; never your tax file number, bank account or super member number, which stay on your record behind a sign-in). If you are a working holiday maker and your employer hasn't recorded that it is registered with the ATO for working holiday maker tax rates, that email, and the email telling your employer's managers that you accepted your offer, also say that you are a working holiday maker, so the right tax is withheld from your first pay. Resend keeps a copy of each email for 30 days, in the United States.
• Stripe — takes your employer's subscription payment. Stripe receives the business name and the account owner's email address and collects the card and billing address itself; we never see the card. Stripe processes data in the United States and other countries. Staff details are not sent to Stripe.
• Xero — your employer's payroll, at their direction. When your employer sets you up for payroll we send Xero your name, date of birth, email address, mobile number, home address, start date, job title, employment basis, pay rate, tax file number, bank account, superannuation fund and member number, and your tax declaration answers: your residency for tax purposes and, unless you are a working holiday maker, whether you claim the tax-free threshold and whether you have a study or training support loan. If you are a working holiday maker we also send your country of residence. Afterwards we send your approved hours. When a manager opens your staff record we read the tax settings Xero holds for you and show them beside what you declared, so a difference can be corrected; we don't keep a copy. Xero hosts data in the United States and processes it in Australia, New Zealand and the United States.
• Anthropic — reads the dates and name printed on certificates you upload. Anthropic may process them in the United States, Europe, Asia or Australia and stores data in the United States. It deletes them within 30 days unless it must keep them longer for a safety review or by law, and doesn't use them to train its models without our permission.
• Expo — passes push notifications from Onboardly to Apple and Google for delivery. It stores your push token but not what the notification says (United States).
• Apple Push Notification service and Google Firebase Cloud Messaging — deliver notifications to your phone (United States)
• Google ML Kit — on Android phones, the certificate scanner in the app is Google's. The scan itself happens on your phone and the image is not sent to Google, but ML Kit sends Google usage and performance data about the scanner: your phone's make, model and operating system version, our app's name and version, and timing and error details.
• OpenStreetMap Foundation — the map on the website's centre-settings page (used by managers to set a centre's location, not by staff) loads map images from the OpenStreetMap Foundation, which receives the IP address, browser details and the page address. The Foundation is based in the United Kingdom and serves maps from a worldwide network.
• YouTube and Vimeo — if a training course includes a video hosted on YouTube or Vimeo, playing it on the website loads their player, which sends your IP address and browser details to Google (YouTube) or Vimeo in the United States and other countries and may set cookies. We use YouTube's privacy-enhanced player, so what you watch in a course isn't used to personalise your YouTube. Onboardly uses YouTube API Services for this; Google's privacy policy is at www.google.com/policies/privacy. In the app, videos open outside Onboardly in your browser or the YouTube app.
• Google Fonts — emails we send may load fonts from Google when they are opened. Google then receives the IP address and browser details of the device opening the email; it sets no cookies and says it does not use this for profiling or advertising.

5. Data storage, security and overseas processing

All primary data is stored in Australia (Sydney region), encrypted at rest and in transit. We enforce role-based access control and MFA for manager-level accounts and above.

Some of your information is processed outside Australia by the providers listed in section 4, when it is sent to them:

• The website's code runs on Vercel in Sydney. Vercel's own systems, including the technical request logs it keeps for a short time, are primarily in the United States.
• Emails about you — including the payroll-setup email to your employer's accountant, which carries your employment and contact details and super fund (and, in the case described in section 4, that you are a working holiday maker), but never your tax file number, bank account or super member number — are sent through Resend in the United States, which keeps a copy for 30 days.
• Your payroll details are sent to Xero when your employer sets you up for payroll; Xero hosts data in the United States and processes it in Australia, New Zealand and the United States.
• Certificate images and files are sent to Anthropic for automatic reading, which may happen in the United States, Europe, Asia or Australia; Anthropic stores data in the United States and deletes it within 30 days.
• The push token and the text of each notification go to Expo, Apple and Google in the United States for delivery.
• Your employer's subscription payment is taken by Stripe in the United States and other countries.
• Smaller amounts of technical information — an IP address, device or browser details — reach Google (ML Kit usage data on Android phones; fonts in emails), the OpenStreetMap Foundation (the centre map on the website) and YouTube or Vimeo (course videos), as described in section 4.

These providers are not bound by the Australian Privacy Principles in the same way we are. We send each one only what its job needs.

6. Data retention

We retain personal information for as long as your account is active. When a business account is deleted, associated data is permanently removed within 30 days. Encrypted backups are kept for up to 30 days, so information deleted from Onboardly is also gone from the backups within 30 days. Billing records at Stripe (invoices, with the business name and the account owner's email address) are kept for as long as tax law requires. We keep a record that the account was deleted: an internal ID, the date and counts of what was removed, with no names or contact details.

7. Cookies

Onboardly uses session cookies solely to maintain your logged-in state. We do not use tracking or advertising cookies. Course videos are shown in YouTube's or Vimeo's own player, which may set its own cookies — see section 4.

8. Your rights

Under the Australian Privacy Act, you have the right to access, correct, or request deletion of your personal information, and to lodge a complaint with the OAIC at oaic.gov.au. Contact us at support@onboardly.com.au.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email.

10. Contact us

For privacy enquiries: support@onboardly.com.au