Privacy policy

UpToDocs is run by VectorOdds, ABN 23 040 828 124 ("we"). We handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, where it's kept and how it's protected.

What we collect

• Businesses that use UpToDocs to track their subcontractors: your name, email address and business name, and a record of when you log in.
• Subcontractors, entered by a business: business and contact names, email, phone, ABN, ACN, licence number and address, plus any notes the business adds.
• Coaches, volunteers and others, entered by a club or community group: the same details as for subcontractors, and their checks and certificates, such as a Working with Children Check, coaching accreditation or first aid certificate. In this policy, "subcontractor" includes them, and "business" includes clubs and groups.
• Documents: certificates of currency, licences, checks and white cards uploaded by a business or subcontractor, and the details on them (insurer, policy number, cover, expiry). Licences, checks and cards can include personal details such as a name, date of birth and card number.
• Subcontractors with their own login: their email address, when they log in, the documents they keep in their Wallet, which businesses they choose to share with, and their share links and who opened them.
• Records: a log of the emails we send, document requests, uploads and changes, kept so a business has a history of each subcontractor's compliance.
• Business contacts we email about UpToDocs: the name, town, website and email address a business or club publishes on its own website, and whether our emails were delivered, which links in them were clicked, and any reply.

Why we collect it

To run the service: tracking which documents each subcontractor holds and when they expire, sending login links, requests and reminders, and keeping the records businesses rely on. We don't sell personal information or use it for advertising.

When a business adds a subcontractor, the business decides what to enter and is responsible for having a reason to share it with us. We act on the business's behalf for that information.

We send a short series of emails (at most three) about UpToDocs to businesses and clubs whose email address is published on their own website. Every one says who we are and has an unsubscribe link, and we stop straight away when someone unsubscribes, replies or signs up. We keep a record of an unsubscribe so we don't email that address again.

Subcontractor accounts: who owns which documents

A subcontractor can log in to UpToDocs with the email address the businesses they work for hold for them. Logging in with an emailed link proves the address is theirs; that is the only way their login is linked to the records businesses keep about them, and they see only businesses that hold that address.

• The subcontractor owns their Wallet. Documents a subcontractor stores in their own Wallet are theirs. We hold them on their behalf, and they can download or delete them at any time.
• Each business owns the copy shared with them. Nothing in a Wallet is shared with a business until the subcontractor ticks that business. When they do, the business's account gets its own copy of each document, which the business checks like any other upload and can reject. That copy is the business's record and stays with the business if the subcontractor later stops sharing, closes their Wallet or stops paying for it.
• Stopping a share stops future documents going to that business. It doesn't take back what the business already received.
• Share links a subcontractor makes for anyone else show only the documents they choose, expire (after 30 days unless they choose otherwise), can be revoked at any time, and record each time they are opened.
• Deleting a Wallet removes the subcontractor's own copies within 90 days. Businesses' copies are kept under the business's account.

Where it's kept

UpToDocs is hosted in Australia. The app, the database and every uploaded document are stored on servers in Sydney, and emails are sent from Sydney too. We use these service providers:

Two parts of the service use providers outside Australia. When a document is uploaded and document reading (OCR) is on, the file is sent to our OCR provider, Anthropic, in the United States so its details can be read. Anthropic's commercial terms say documents sent to it aren't used for training. Card payments are handled by Stripe, and we never see or store card numbers. Each provider handles the information only to provide its part of the service. By using UpToDocs you consent to this. We'll update this page if where we keep information changes.

How we protect it

• All traffic to UpToDocs is encrypted in transit (HTTPS).
• Uploaded documents are encrypted before they are stored (AES-256), with a key kept separately from the database. A copy of the database on its own can't be read.
• Businesses log in with single-use email links that expire after 30 minutes. There are no passwords to leak.
• Subcontractors upload through a private link that stops working 30 days after it was last sent.
• Uploads are limited to PDF, JPG and PNG files, and PDFs containing scripts or attachments are refused.
• Each business's information is visible only to that business's account.

How long we keep it

While a business's account is open, so the compliance history stays complete. When a business closes their account, we delete their information within 90 days, except where the law requires us to keep it longer.

Access, correction and complaints

You can ask to see or correct the personal information we hold about you by emailing hello@uptodocs.com.au. Subcontractors can also ask the business that added them. If you have a concern about how we handle your information, email us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Contact

VectorOdds, ABN 23 040 828 124
hello@uptodocs.com.au