นโยบายความเป็นส่วนตัว

About WorkCheck

WorkCheck is an independent, Australia-focused service for checking business ABNs and reading or submitting employment-related worker reports. It is not a government service and is not affiliated with the Australian Business Register (ABR), Australian Taxation Office (ATO), Fair Work Ombudsman or another government agency. This policy describes the current service; it does not claim compliance certification.

Information we collect

When you verify your email, Supabase Auth processes your email, verification requests and account/session identifiers. We associate submitted reports with the authenticated user ID and verified email. Email verification is not proof of the truth of a report.

Reports contain your selected issues, employment type, work dates, workplace location, description and language. Optional evidence includes private employment documents and their filename, type, size and review metadata. Avoid sending unnecessary sensitive information.

ABN searches are sent to the service and may lead to an ABR/ABN Lookup request. Official business records may be cached. Search URLs contain the ABN and may appear in browser history and hosting/security logs. We do not currently create a personal search-history account feature.

Hosting, authentication, email delivery and anti-abuse providers may process IP addresses, browser/device information, request times, delivery information and security events. Turnstile processes challenge signals to help detect abuse. WorkCheck does not add advertising analytics or tracking through these policy pages.

Why information is used

We use information to provide ABN lookups, verify email, accept and display eligible reports, handle private evidence, moderate content, respond to disputes, prevent abuse and maintain service security. Moderation and audit records help document decisions and investigate misuse.

Text-based PDFs may be processed automatically on the server to identify a checksum-valid ABN. Extracted text is transient rather than saved as report content. Matching the report ABN can make an eligible new report publish automatically. Images and unreadable PDFs require manual review in this MVP; no external OCR provider is enabled. An ABN match does not establish that the allegation is true.

Public and private information

Only approved reports with a publication date that has arrived are eligible for public display. Public information can include the report ID, ABN, issues, employment type, work period, workplace location, description, dates and simplified evidence indicators. Public material may be indexed, copied or retained by others.

Reporter email, user ID, internal notes, moderation audit data, original evidence, filenames, storage paths and private evidence metadata are not publicly displayed. Authorised reviewers can access information needed for moderation; evidence downloads use restricted, short-lived access. Do not put identifying or sensitive details in public descriptions. We cannot promise anonymity if your own description identifies you.

Reporter identity and email remain private unless disclosure is legally required. We may disclose other information where legally required or reasonably necessary to handle legal claims or protect rights and safety, subject to applicable law and privacy safeguards. Private evidence is never publicly displayed and is not publicly disclosed merely because a report is published or disputed.

Providers and overseas processing

Supabase provides database, authentication and private storage services. Cloudflare Turnstile provides anti-bot checks. ABR/ABN Lookup provides official registry information. Email verification is delivered through the configured email-delivery provider. Vercel may process hosting and technical logs where WorkCheck is deployed on Vercel.

Cloud providers and their subprocessors may process data outside Australia. The operator must confirm the actual hosting deployment, email provider, storage regions and relevant overseas countries before public launch; these details are not yet confirmed in this draft. Access is limited to what is needed for the relevant service.

Cookies, sessions and security

The current reporter verification flow keeps its browser session in memory rather than enabling persistent Supabase browser storage. Admin access uses an HTTP-only session cookie, secure in production. Security providers may use browser storage or cookies as part of their configured operation. No new cookie banner or tracking technology is introduced by this policy.

We use access controls, private evidence storage and server-side checks to reduce unauthorised access. No internet service can guarantee absolute security. Keep verification codes private and do not send documents through public descriptions.

Retention, correction and deletion

These are MVP operational retention targets, not statements of legally required periods or guarantees of immediate deletion. Public reports are retained while active, published, under moderation or reasonably necessary to operate the service. They may be removed earlier through moderation, a reporter request where applicable, or dispute/review.

Original employment evidence is private and never publicly displayed. If a report is permanently removed or deleted and its evidence is no longer reasonably required for an active dispute, security investigation, legal obligation or legal claim, we target deletion of that evidence within 90 days. We do not promise deletion where retention is legally required.

For moderation, audit and security records, our normal retention target is up to 12 months where reasonably necessary for abuse prevention, security, moderation integrity and dispute history. Longer retention may be reasonably required for an active dispute, legal obligation, investigation or legal claim.

Email verification and account-related information is retained only as long as reasonably necessary to provide the service, maintain security, prevent abuse, resolve disputes and satisfy applicable legal obligations. This does not mean that OTP codes themselves are permanently stored by WorkCheck.

Official public ABR business information may be cached temporarily for performance and may not reflect the latest ABR record. This cache is distinct from private reporter information. Cache freshness checks do not guarantee deletion of older cached records.

Residual copies may remain temporarily in protected backups or provider systems, subject to normal deletion cycles where applicable. We do not currently guarantee a provider-backup deletion timeline.

The current MVP does not automatically enforce the 90-day evidence or 12-month record targets. Operational review and deletion procedures must be established to meet these targets. Hiding a report is not permanent deletion and does not itself erase evidence or audit records.

Contact support@workcheckau.com to request access, correction, deletion or review of how your information was handled. A reporter may request correction or removal of their own report; we may reasonably verify that they are the original reporter. Removal does not guarantee unconditional deletion where retention remains reasonably necessary for security, disputes, legal obligations or legal claims. We may limit disclosure to protect others or comply with law and seek to explain a refusal and available review options. There is no self-service report deletion feature in this MVP.

Children and changes

The service is intended for adult workers and other adult users. Do not submit children’s information or unnecessary information about minors. If such information has been supplied, request a privacy review.

We may update this policy as the service changes and show the revised date. Material changes should be communicated appropriately; an updated policy does not remove rights that apply under law.

Contact WorkCheck

For privacy, access/correction, report removal, dispute/review requests, legal demands or notices, email support@workcheckau.com. Include the relevant report ID or URL where applicable. Do not send verification codes or unnecessary sensitive documents. Use this contact for legal demands and notices unless a dedicated legal contact is later advised by Australian counsel.