Privacy policy

Who we are

Workhr (workhr.app) is a workforce management platform for labour-hire and recruitment agencies in New Zealand and Australia, operated by AiTearoa (“we”, “us”). For anything in this policy, contact us at privacy@workhr.app or via workhr.app/contact.

Our role: mostly a processor

Most personal information in Workhr belongs to our customers — the agencies. When an agency stores candidate profiles, worker timesheets or client contacts in Workhr, that agency is the party responsible for the information, and we process it on their instructions. If you are a candidate or worker and want your information corrected or removed, the fastest path is your agency; we give them the tools to do it (including full erasure).

We act in our own right only for the information we need to run the service: your login account, billing details for our customers, support conversations, and basic usage of our marketing site.

What we collect

• Account information — name, email address, role, and authentication events.
• Workforce records entered by your agency — candidate and placement details, CVs, credentials and licences, shifts, timesheets, pay and billing records.
• Location at clock-in and clock-out — when a worker signs in or out of a site through the worker app, we record GPS coordinates and accuracy at that moment, and the distance from the rostered site. We do not track location in the background — only at the moment of a punch, and workers can decline GPS (the punch is then flagged as location-unavailable rather than blocked).
• Content you upload — documents, photos and videos shared inside the platform (for example on the team feed), and meeting recordings where your organisation uses the meeting recorder, together with their transcripts.
• Service and device data — logs, IP addresses, and the pages and features used, for security and to make the product better.

Where your data lives

Production data is hosted in Sydney, Australia (AWS ap-southeast-2 via Supabase, with the application served from Fly.io’s Sydney region). Backups stay in the same region. Data is encrypted in transit and at rest.

How we use information

• To provide the service: rosters, attendance, timesheets, payroll and billing.
• To power AI features your organisation turns on — for example summarising meetings, drafting CVs, or answering questions over your own data. AI features only see data belonging to your own organisation.
• To secure the platform, investigate misuse, and meet legal obligations.
• To improve Workhr — using aggregated or de-identified usage data, never the content of your records.

Who we share it with (subprocessors)

We do not sell personal information. We share it only with the service providers that run Workhr, under contracts that limit what they can do with it:

• Supabase (database, authentication and file storage — Sydney) and Fly.io (application hosting — Sydney).
• Anthropic (AI processing). Data sent to Anthropic’s API is not used to train their models.
• Deepgram (speech-to-text for meeting and voice-note transcription, where your organisation uses those features).
• Resend (transactional email delivery).
• Integrations your organisation connects — for example Xero, JobAdder, Astute Payroll, or Google/Microsoft calendars. These move data on your organisation’s instructions and are governed by those providers’ own terms.

How long we keep it

We keep information for as long as the agency’s account is active or as needed to meet legal record-keeping duties (for example wage and time records, which NZ and AU law require employers to retain for set periods). When an agency leaves Workhr, they can export their data; we then delete it from production systems within a reasonable period, with backups aging out on a fixed schedule.

Your rights

Under the New Zealand Privacy Act 2020 and the Australian Privacy Principles, you can request access to and correction of your personal information. Where your information is held on behalf of an agency, we will route your request to them and support them in answering it. Contact privacy@workhr.app. If you are unhappy with our response you can complain to the NZ Office of the Privacy Commissioner or the Office of the Australian Information Commissioner.

If something goes wrong

If a privacy breach occurs that is likely to cause serious harm, we will notify affected organisations and the relevant regulator as required by the Privacy Act 2020 (NZ) and the Notifiable Data Breaches scheme (AU), and tell you what happened, what we’ve done, and what you can do.

Cookies

The application uses essential cookies for sign-in sessions. The marketing site uses minimal, first-party analytics to understand page visits. We don’t run third-party advertising trackers.

Changes

We will post any changes to this policy here and update the date at the top. For material changes we will notify account administrators by email.