WalkTheSite Privacy Policy

Who we are: Synergy Safety Solutions (ABN 11 672 184 833), Parkhurst, Queensland 4702, Australia ("Synergy", "we", "us"). Privacy contact: info@synergysafetysolutions.com.au

This policy explains how we handle personal information in WalkTheSite in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1. What we collect

Account information: your name, business name, ABN, business email, mobile number, trading address, logo, password (stored only as a secure hash; we cannot see it), your subscription and plan details, and, if you choose to answer, whether your business is women-owned or women-led (see section 3).

Sign-in with Google: if you sign in with Google, we receive your name, email address and Google account identifier from Google. We do not receive your Google password.

Payment information: Stripe, our payment processor, collects and stores payment card details. We receive only a payment token, the last four digits of the card, and billing status.

Content you create or upload: site names and addresses, audit answers, notes and photos, documents you generate or upload, corrective actions, chemical and plant registers, and the names, roles, mobile numbers, licence and certificate details, expiry dates, signatures, training and induction records of workers you enter or who complete forms.

Worker sign-in: workers sign in with a mobile number and a PIN. We record sign-ins, acknowledgements, completed forms, QR code scans and, where the worker chooses, their preferred language.

Health-related records: incident reports, first aid records, health monitoring records, and any form you mark as Restricted (for example a medical questionnaire in an induction) may contain health information about workers. This is health information under the Privacy Act. Restricted records are visible only to administrators you authorise. We ask you to enter only what the law requires. You are responsible for informing your workers that you hold this information in WalkTheSite.

Voice notes: if a worker uses the microphone, the audio is transcribed to text and then deleted; only the text is kept. Where the worker records in a language other than English, both the original text and an English translation are stored.

Ask WHS: the questions you ask, the answers given, and your feedback.

Usage and technical information: login times, pages used, device and browser type, IP address, notification preferences, and error logs. We use cookies and similar technologies for login sessions and, if enabled, analytics and advertising measurement (see section 8).

2. Why we collect it

To provide the Service (accounts, audits, documents, worker sign-in and records, registers, Ask WHS, translation, support); to send SMS and email messages on your behalf to your workers (for example acknowledgement reminders and expiry alerts); to process payments and manage subscriptions; to communicate with you about your account, legislation updates, maintenance and product changes; to improve the Service and its content; to keep the Service secure; and to comply with law.

3. The women-owned or women-led question

We may ask whether your business is women-owned or women-led. Answering is optional, the answer is not shown to your users or workers, it never affects your account, and it is used only for aggregate reporting (for example, the percentage of paying accounts that are women-led).

4. Who we share it with

We share personal information only as needed to run the Service:

• Stripe: payments and subscription billing.
• Supabase: database, authentication and file storage, hosted in Sydney, Australia.
• Lovable: application hosting.
• Anthropic: to answer Ask WHS questions and to translate text. Questions and text are sent with the relevant content; we do not send your business name, worker details or audit records unless they are part of what you type or the document being translated.
• OpenAI: to transcribe voice notes to text.
• ClickSend: to send SMS messages to your workers.
• Google: if you sign in with Google.
• Our transactional email provider: account, billing and notification emails.
• Analytics and advertising tools: only if enabled; see section 8.
• Users and workers you add to your account, according to the permissions you set.
• Professional advisers, regulators and law enforcement where required by law.

Our AI providers do not use your content to train their models. We do not sell personal information.

5. Where it is stored

Your data is stored in Australia (Sydney) on Supabase infrastructure. Some providers listed above (Stripe, Anthropic, OpenAI, Google, email and analytics services) process data in the United States and other countries when providing their service. By using the Service, you consent to those overseas disclosures. We take reasonable steps to ensure those providers protect your information.

6. Security

We use encryption in transit and at rest, row-level access controls so each account can only see its own data and each worker can only see their own record, secure password hashing, checks against known leaked passwords, two-factor authentication where offered, restricted administrator access with logging, and regular backups. No system is completely secure; you are responsible for keeping your login details confidential and for the users you invite.

7. Access, correction and deletion

You can view and update most of your information in Settings. You can export your data (Settings > Privacy > Download my data) and delete your account (Settings > Privacy > Delete my account). Self-deletion removes your account data and files after a 7-day grace period. Accounts scheduled for deletion by Synergy are deleted 30 days after notice. We delete cancelled account data 90 days after cancellation. We may retain limited records where required by law (for example, tax records of payments) or to resolve disputes.

Workers can view and update their own contact details in the Service. For anything else, workers whose details you have entered may contact you or us to access or correct their information; we will refer such requests to you as the account holder where appropriate.

8. Cookies, analytics and advertising

We use essential cookies for login. If enabled, we use analytics and advertising tools (such as Meta Pixel or Google Analytics) on our public website and sign-up pages to measure marketing performance. These tools may set cookies and collect device and browsing information. You can limit this in your browser settings. We do not use advertising tools inside the logged-in application or the worker view.

9. Marketing

We may email account holders about legislation updates, new features and offers relevant to WalkTheSite. You can unsubscribe from marketing at any time via the link in any email; you will still receive essential account, billing and service messages. We do not send marketing to workers.

10. Data breaches

If a data breach is likely to result in serious harm to individuals, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

11. Children

The Service is for businesses and their workers and is not directed at people under 18.

12. Complaints

If you have a concern about how we handle your information, contact us at info@synergysafetysolutions.com.au. We will respond within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

13. Changes

We may update this policy from time to time. We will post the new version in the Service and notify account holders of significant changes by email or in-app notice.