Privacy Policy

Worklane(“Worklane”, “we”, “our”, “us”) provides a project and workflow platform for engineering and consulting teams (the “Service”). This Privacy Policy explains how we collect, hold, use and disclose personal information, and how you can access and correct it or make a complaint. We handle personal information in accordance with the Privacy Act 1988(Cth) (the “Privacy Act”) and the Australian Privacy Principles (“APPs”).

1. Our two roles

It helps to distinguish two kinds of data we handle:

• Account and site data — information about you as a user of Worklane (your account, our website, support and billing). For this data, we decide how and why it is handled, and this policy applies directly.
• Workspace content— the projects, tasks, meeting notes, documents, contacts and other material your organisation puts into its workspace. Your organisation controls this content and decides who can access it. We process it only to provide the Service on your organisation's instructions. Questions about how a particular organisation uses its workspace (for example, a client contact stored in its CRM) are best directed to that organisation; we will assist where required.

2. What we collect

• Account information — name, email address, password (stored only as a salted hash by our authentication provider), profile photo if you add one, and workspace membership details. If you were invited by a workspace administrator, we received your name and email from them.
• Workspace content — anything you or your team add: projects, tasks, deliverables, fee calculations, meeting notes, client directions, CRM records, documents and attachments, time entries and comments. This may include personal information about third parties (for example, client contacts); your organisation is responsible for having a lawful basis to record it.
• Technical and usage data — IP address, browser and device type, pages accessed and timestamps, collected through server logs and essential cookies used for sign-in sessions and security. We do not use third-party advertising trackers.
• Communications — messages you send us (support, sales, feedback) and our records of responding.

We do not knowingly collect sensitive information (such as health information) and ask that you do not store it in Worklane unless your organisation has a clear need and lawful basis to do so. Dealing with us anonymously or under a pseudonym is generally impracticable because the Service requires an identified account.

3. How we use personal information

We collect, hold and use personal information to:

• provide, operate, maintain, secure and improve the Service;
• authenticate users and enforce workspace permissions;
• send service communications — invitations, notifications you have enabled, security notices and administrative messages;
• provide support and respond to enquiries;
• bill for the Service where fees apply;
• understand aggregate usage so we can improve reliability and features (in de-identified or aggregated form wherever practicable); and
• comply with our legal obligations.

We do not sell personal information. We do not use workspace content for advertising, and we do not use it to train machine-learning models. Any marketing email we send will comply with the Spam Act 2003 (Cth), will only go to people who have opted in or reasonably expect it, and will always include a working unsubscribe.

4. Disclosure and overseas recipients

We disclose personal information only to the service providers who help us run Worklane, to your workspace (content you create is visible to teammates according to your organisation's permission settings), or where the law requires or permits it. Our core sub-processors are:

• Supabase — database, authentication and file storage.
• Vercel — application hosting and content delivery.
• Mailtrap — delivery of transactional email such as invitations, notifications and sign-in links.

These providers process data only to provide their services to us and under contractual confidentiality and security obligations. Their infrastructure may be located outside Australia (including in the United States and the European Union). Where personal information is disclosed to an overseas recipient, we take reasonable steps as required by APP 8 to ensure the recipient handles it consistently with the APPs, including through our agreements with those providers. We may update this list from time to time; the current version is always in this policy.

We may disclose information where required by law, a court order, or a regulator with lawful authority, and, if we ever sell or restructure the business, to a purchaser under confidentiality obligations — with notice to affected users where required.

5. Storage, security and retention

• Every workspace is logically isolated with database row-level security — one organisation's data is never queryable by another.
• Data is encrypted in transit (TLS) and at rest on our providers' infrastructure.
• Access within Worklane is governed by role-based permissions your organisation controls; our own administrative access is limited to what is necessary to operate and support the Service.
• We retain workspace content while the workspace is active. After a workspace is closed, or on a verified deletion request from its owner, we delete or de-identify its content within 60 days, subject to short-lived backups (which expire on their own cycle) and any records we must keep by law.

6. Data breaches

We maintain a data breach response process. If a data breach occurs that is likely to result in serious harm to individuals, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, and we will tell affected workspace owners promptly so they can meet their own obligations.

7. Access, correction and deletion

You can view and update most of your account information directly in the app (Profile). You may also ask us for access to, or correction of, the personal information we hold about you — we will respond within a reasonable period (usually 30 days) and will not charge for making a request. If we refuse a request we will tell you why in writing and how to complain. For workspace content, we may refer your request to the workspace owner, who controls that data.

8. Complaints

If you believe we have mishandled your personal information, please contact us first using the details below — we take complaints seriously and will respond within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or by calling 1300 363 992.

9. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top reflects the current version, and we will notify workspace owners of material changes. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.

10. Contact us

Privacy questions, requests or complaints: hello@worklane.com.au. Please put “Privacy” in the subject line so we can prioritise it.