Privacy, written plainly.

1. Who this policy covers

This policy applies to personal information handled through cheqzen.com.au, the Cheqzen customer portal, Platform Administration, support channels, billing workflows and SMS safety check-ins. A subscribing organisation decides which workers, supervisors and administrators are added and how its safety workflow is configured. Cheqzen processes that information to provide and secure the service and also handles information for our own account, billing, support, legal and security purposes.

2. Information we collect and hold

Depending on how a person interacts with Cheqzen, we may collect and hold:

• Account and identity information: name, work email address, mobile number, role, organisation membership, authentication status and account-security records.
• Organisation information: business name, ABN, business address, country, timezone, subscription, billing contact and service configuration.
• Worker and supervisor information: name, mobile number, employee or internal reference, role, availability, assigned supervisors and schedule information.
• Safety workflow information: scheduled check-ins, message templates, outbound and inbound SMS records, delivery status, replies, reminders, alerts, escalations, acknowledgement and resolution records.
• Billing information: subscription selection, invoices, payment status, renewal and cancellation dates, Stripe customer references and limited payment-method information. Full card details are handled by Stripe and are not stored by Cheqzen.
• Support and communication information: enquiries, support conversations, feedback and records of authorised assistance.
• Technical and audit information: IP address, browser and device information, session and security events, access logs, timestamps, changes made and diagnostic information.

Safety-event information may reveal or suggest information about a person's wellbeing or circumstances. Customers and users should only enter information that is necessary for the safety workflow and should not include medical details or other sensitive information unless it is lawful and genuinely required.

3. How we collect information

We collect information directly from account holders and website visitors, from subscribing organisations that add or administer their personnel, from workers and supervisors who reply to messages, automatically when the website or platform is used, and from service providers such as Stripe and ClickSend that return billing or communications evidence.

If a customer provides another person's information, the customer must be authorised to do so, provide any required privacy notice, and ensure the collection and use is lawful.

4. Why we use information

We use personal information where reasonably necessary to:

• create, authenticate, administer and secure accounts;
• schedule and send safety check-ins, process replies, issue reminders and follow configured escalation paths;
• show authorised users current status, history, audit evidence and reports;
• provide support and carefully controlled Platform Administration;
• calculate entitlements, process subscriptions and maintain billing records;
• detect misuse, investigate incidents, protect the service and meet legal obligations;
• communicate service, security, billing and support information; and
• understand and improve the service using aggregated or de-identified information where practical.

We do not sell personal information.

5. SMS safety messages and opt-outs

Cheqzen sends safety workflow messages at the direction of a subscribing organisation. The organisation is responsible for having a lawful basis to provide each mobile number and initiate those messages. A reply of STOP, or another recognised opt-out instruction, suppresses further Cheqzen safety messages to that destination for the relevant organisation and provider context. Suppression is not removed merely because an SMS sender number changes.

If a worker has opted out, the organisation must use an appropriate alternative safety procedure. Restoration is controlled and requires a verified request. It must not be used to override a person's choice without a lawful and documented basis.

6. Automated processing

Cheqzen uses rules configured by authorised customer administrators to send scheduled messages, detect whether an expected reply has been recorded, send reminders and create or escalate alerts. These rules support the customer's process. They do not determine whether a person is actually safe, make employment decisions or replace review by a responsible person. Customers must apply human judgement and their own emergency and workplace procedures.

7. When information is shared

We may disclose or make information available:

• to authorised administrators and supervisors within the relevant customer organisation;
• to providers that host, secure, communicate, support or bill for the service, including Framer, Vercel, Supabase, Stripe, Resend and ClickSend or Sinch;
• to professional advisers, insurers, auditors or contractors who are subject to appropriate confidentiality obligations;
• where required or authorised by law, court order or a regulator;
• to protect a person, investigate suspected misuse or respond to a security incident; or
• as part of a genuine business restructure or transfer, subject to appropriate privacy protections.

We limit access to what is reasonably necessary for the relevant function.

8. Overseas handling

Some service providers and their subprocessors operate outside Australia. Depending on the service and hosting configuration, information may be processed in Australia, the United States, countries in the European Economic Area and other locations disclosed by those providers. We take reasonable steps appropriate to the circumstances to assess providers, limit their use of information and require suitable privacy and security protections.

9. Security

Cheqzen uses role-based access, account authentication, multi-factor protection for privileged access, tenant separation, audit records and other technical and organisational safeguards appropriate to the information handled. No internet service can guarantee absolute security. Customers must protect their account credentials, use appropriate access roles, remove access that is no longer required and promptly report suspected misuse.

10. Retention and deletion

We retain information for as long as reasonably needed to provide the service, maintain safety and audit evidence, meet legal and accounting requirements, resolve disputes and protect the platform. Retention may continue after an account or worker is removed where historical safety, billing, security or audit records must be preserved. When information is no longer required, we take reasonable steps to delete it or de-identify it, subject to backups, legal holds and technical limitations.

11. Website data and cookies

Our website and platform may use essential cookies and similar technologies for sessions, security, preferences, performance and reliable operation. Optional analytics or marketing technologies will only be used in accordance with applicable notice and consent requirements. Browser settings can restrict cookies, although doing so may prevent protected account features from working correctly.

We use Microsoft Clarity on our public marketing website to understand page views, clicks and scrolling and review limited session recordings. Clarity is configured without cookies and with strict text masking. Microsoft receives technical usage data to help us improve the website. Clarity is not installed in signup, the Customer Portal or Platform Administration. See the Microsoft Privacy Statement for more information.

11A. Trial administration and optional measurement

Trial signup uses business, contact and billing details to establish the workspace, assess eligibility, record consent and administer subscriptions. Stripe handles card details. Cheqzen retains limited billing identifiers and payment and consent evidence, not raw card numbers.

Trial and subscription service emails are sent through Resend to a verified Owner-Admin contact. They contain company, plan, price, dates and a protected billing link. They do not contain worker details or SMS replies. Cancellation or payment suspension does not immediately erase company settings or safety history. Retention, access and deletion remain subject to section 10 and applicable requirements.

Optional trial measurement requires a separate, unchecked choice. If you consent, we may share a pseudonymous browser measurement identifier, a broad referral category and limited subscription lifecycle events with Google Analytics to understand the signup journey. This information is not anonymous. We exclude names, email addresses, phone numbers, worker identities, SMS content, card details and Stripe customer or payment identifiers.

The local measurement linkage expires after 90 days. You may withdraw through verified Cheqzen support; this stops future queued sharing but does not itself delete information already held by Google. Internal service-administration metrics use counts and milestone dates independently of this optional marketing measurement. Test records are excluded from live marketing reports.

12. Marketing communications

We may send business contacts information about Cheqzen where permitted by law. Commercial electronic messages will identify the sender and provide a functional unsubscribe method. Unsubscribe requests will be honoured within the period required by law. Service, security, safety and billing messages are separate from marketing, although SMS safety-message suppression is respected as described above.

13. Access and correction

A person may ask for access to personal information Cheqzen holds about them or request correction if it is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify identity and consult the relevant customer organisation. We will respond within a reasonable period and explain any lawful reason for refusing or limiting a request.

14. Privacy questions and complaints

Contact us with the subject line Privacy request and explain the issue or request. We will acknowledge the matter, investigate it fairly and aim to provide a substantive response within 30 days. If a person is not satisfied, they may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.

15. Data breaches

We investigate suspected data breaches and take steps to contain and reduce harm. Where the Notifiable Data Breaches scheme applies and a breach is likely to result in serious harm, we will notify affected individuals and the Australian Information Commissioner as required by law.

16. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version and effective date will appear on this page. If a change materially affects how existing personal information is handled, we will take reasonable steps to provide additional notice.