Effective 27 July 2026
Privacy Policy
Worksheets helps organisations manage staff, venues, timesheets, operational forms, receipts and invoices. This policy explains what personal information the service handles, why it is handled, and the choices available to organisations and their staff.
Who is responsible
The organisation that gives you access to Worksheets controls its workplace records and decides who can access them. Worksheets operates the service and processes those records for the organisation. Questions about employment decisions or the contents of a workplace record should normally be directed to the organisation first. Questions about the operation, security or privacy of Worksheets can be sent to us using the contact details below.
Information we handle
We may process names, contact and account details; organisation and venue information; staff profile, bank, tax, superannuation and payroll details; availability and leave requests; shift and time records; incident reports; cash declarations; audit records; and receipts, invoices and related accounting information. Some records may contain sensitive information, including health information entered in an incident or employment record.
How information is collected
Information is collected when you or an authorised organisation user creates an account, completes a form, records a shift, uploads a document, accepts an invitation or contacts us. We also collect limited technical and security information when the service is used. An organisation may provide information about its staff when setting up or administering an account.
Location information
Location is requested when a staff member clocks in or out and is used to check proximity to the selected venue. Worksheets does not continuously track a staff member's location. The clock action, location result and related verification details may be retained as part of the organisation's time and attendance record.
How information is used
Information is used to provide and administer the service, verify authorised workplace actions, process uploaded documents, prepare operational and payroll reports, communicate about accounts and invitations, maintain security, diagnose faults, prevent misuse and meet legal obligations. Worksheets does not sell personal information or use personal information for third-party advertising.
Document processing
Uploaded receipts and invoices may be processed by Google Cloud services to extract text and accounting fields. Temporary Batch OCR can process files for immediate CSV download without retaining the source images after processing. Organisation administrators control access to saved documents.
Access and sharing
Access depends on the role assigned by an organisation. Owners and authorised managers can access records required for their duties. Staff access is restricted to their own permitted workflows and assigned venues. Information may be disclosed where required by law, to protect the service or its users, or to service providers that host, secure, communicate and operate the service.
Service providers and overseas processing
Worksheets uses service providers including Google Cloud and Firebase for hosting, authentication, storage and document processing; Netlify for website delivery; and Resend for service emails. Stripe may be used for subscription payments when billing is enabled. Depending on the service configuration and the location of a provider's systems or support personnel, information may be processed in Australia, the United States and other countries in which those providers operate. We take reasonable steps to use reputable providers and appropriate access controls, but overseas recipients may be subject to different privacy laws.
Storage and security
Data is stored using Firebase and Google Cloud with organisation-level access controls. Sensitive staff profile fields are encrypted by the service. We use audit records, access rules and restricted administrative functions to reduce unauthorised access. No online service can guarantee absolute security.
Retention and deletion
Information is retained while it is needed to provide the service and for security, backup, dispute and legal purposes. Australian employers are generally required to keep employee time and wage records for seven years, so an organisation may be unable to delete those records earlier. Temporary OCR files are scheduled for deletion automatically. Organisation owners can request an export or deletion of organisation data, subject to legal retention and backup requirements.
Access and correction
You may ask to access or correct personal information held about you. Where the information forms part of an organisation's employment records, we may refer the request to that organisation. We may need to verify your identity before acting. If access or correction cannot be provided, we will explain the reason where the law requires us to do so.
Privacy complaints
Send a description of your concern and enough information for us to investigate to the email address below. We will acknowledge the complaint, investigate it and respond within a reasonable period. If you are not satisfied, you may be able to contact the Office of the Australian Information Commissioner.
Data breaches
We investigate suspected unauthorised access, disclosure or loss of personal information. Where the Australian Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required.
Changes to this policy
We may update this policy when the service, providers or legal requirements change. The effective date at the top of this page identifies the current version.
Contact
Privacy, access, correction, complaint and deletion requests can be sent to worksheetsxyz@gmail.com.