Privacy Policy

Effective 21 August 2026 · Updated 13 October 2026 · Dayboard Pty Ltd · ABN 44 701 498 044

The rest of this page is the full policy. It is written to comply with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), and we hold ourselves to those standards regardless of whether an exemption might technically apply to a business our size.

1. Who we are

Dayboard Pty Ltd (ABN 44 701 498 044) ("Dayboard", "we", "us") is an Australian company that provides scheduling software for field crews at dayboard.com.au. This policy covers the Dayboard application and this website.

2. Whose information this covers

Dayboard is a workplace tool, so personal information reaches us in two different ways, and your rights work slightly differently for each:

• Account holders: the person who signs a company up, and the administrators who run its account. You give us your information directly and we are responsible for it.
• People whose information a company enters: crew members, plant operators, client contacts, and anyone who appears in uploaded documents or photos. The company using Dayboard decides what to enter and is responsible for having a proper basis to record it; we store and process it on that company's behalf, under this policy. If you are a crew member with a question about information your employer put into Dayboard, your employer is the right first contact, but you can always reach us too, and we will help (see section 10).

Companies using Dayboard must make the people they enter into it, their crews above all, aware of this policy, and must not enter sensitive information (such as health information) beyond what their own legal obligations genuinely require and the person concerned is aware of. A medical certificate attached to a timesheet is health information: it should be attached only where the company needs it as evidence for leave, and it is kept, like everything else, until the company deletes it or leaves Dayboard.

You can read this website without identifying yourself. It sets no cookies and runs no trackers. Using the Dayboard service itself requires an account, because a schedule with anonymous people on it would not be much of a schedule.

3. What we collect

• Account details. Company name, your name, your email address, and a password. We store only a one-way cryptographic hash of your password (scrypt), so we cannot see or recover the password itself. For the person who signs a company up, we also record the date and the version of the terms of service that was accepted.
• What your company puts into Dayboard. Jobs and site addresses, clients and their contact people, quotes (the prices, descriptions and line items your company offers its clients, their status from draft to won or lost, and internal notes about them), each job's value, its variations and the invoices your company records against it (number, date, amount and the invoice document), a job's purchase order, resources (crew, plant and vehicles, including registrations, meter readings, servicing records and maintenance bookings), schedules and bookings, competency and induction records for crew, subcontractors' insurance details (the policy type, insurer, policy number and expiry, with any certificate of currency uploaded against them), and, where a company chooses to record them, a crew member's date of birth and the date they started, which Dayboard uses only to show birthday and work-anniversary reminders to that company's own managers; both are optional and neither is required to use the product. Also posts and comments, acknowledgement records, form templates and filled-in form submissions (answers, photos and signatures), and, for a company that uses them, timesheets: the start and finish times, breaks, leave and allowances a person records for each day and the jobs they were on, their signature on the week, who approved it or sent it back, and every change made to it afterwards. Documents can be attached to a person's week, such as a medical certificate; those are visible only to that person and their company's managers and admins. Dayboard records hours only and holds no pay rates. Also uploaded documents: drawings, safety documents, licences, photos from site. Any of these can contain personal information; what is entered is the company's choice.
• Billing records. Subscription invoices: who was billed, for which users, for how much. Card details go directly from your browser to our payment processor (Stripe) and never touch our servers; we hold only a reference to the payment method, never the number.
• Technical records. Standard web-server logs, which include IP addresses, kept briefly for security and troubleshooting, then rotated out automatically. A session cookie keeps you signed in (see section 6).

We do not collect anything else. There are no analytics trackers watching how you use the app, no advertising pixels, and no data brokers.

4. What we use it for

We use personal information only to:

• provide the service: scheduling, documents, notifications, and the rest of what you signed up for;
• bill your company for its subscription and issue tax invoices;
• send emails the service requires: sign-up, invitations, invoices, export-ready notices, and important account or security notices;
• keep the service secure, diagnose faults, and prevent abuse;
• meet our legal obligations.

We will not send you marketing email unless you have opted in, and any such email will have a working unsubscribe link. We never use your company's data to build marketing lists.

5. What we never do

• We never sell personal information, to anyone, for anything.
• We never share it with advertisers or data brokers.
• We never use your data, or your company's data, to train AI or machine-learning models.
• We never read your company's jobs, documents or messages except when needed to support you at your request, to investigate abuse, to protect the safety of a person, or as required by law.

6. Cookies

The Dayboard app uses one cookie: a session cookie that keeps you signed in. It is httpOnly (script on the page cannot read it), it is not used for tracking, and it is not shared with anyone. This marketing website sets no cookies at all.

Storage on your device. So that forms can be filled in with no signal, the app also keeps some data in your browser's own storage on the device you use it on. This is not a cookie and is not used for tracking. It holds: a copy of your company's published forms and the lists needed to fill them in (its machines and their meters, your open jobs, and the names a form's questions offer); the name, email address and role of the person signed in on that device, and their company's details; and any form filled in there, with its photos and signature, until Dayboard has received it. A form is removed from the device once it has been sent. Signing out removes the copy of the lists and the signed-in details, and keeps any form not yet sent so that it can still be sent. Clearing your browser's data for Dayboard removes all of it.

7. Where your data lives, and who we share it with

Dayboard runs on infrastructure in Sydney, Australia (DigitalOcean, with a second, independent copy of our backups held with Amazon Web Services, also in Sydney). Your account, your company's records, all uploaded documents, and our backups are stored in Australia. The one category of information processed overseas is technical error reports, which are stripped of personal details before they leave our server. See Sentry in the list below.

The complete list of who personal information may be disclosed to:

• DigitalOcean (hosting and file storage): everything Dayboard stores sits on their Sydney infrastructure.
• Amazon Web Services (backup storage): a second, independent copy of our backups (the database and uploaded documents), stored in Sydney, Australia, so that a problem with one provider cannot take the service's data with it. Backups there age out on the same 30-day timetable as everywhere else (see the table below).
• Stripe (payments): handles your card details and processes subscription payments, primarily in the United States. Stripe receives billing contact details and payment amounts; we never see the card number.
• Postmark (email delivery): delivers the service's emails, primarily from the United States, so it processes recipient names, email addresses, and the content of those emails (for example, an invitation or an invoice notice).
• Sentry (error monitoring): when the software hits a fault, a technical report of the failure is sent to Sentry and processed in the European Union, so we find out straight away rather than from a support email. These reports are deliberately stripped before they leave our server: no names, no addresses, no document or message content, and no request data, only the technical description of the fault and internal record identifiers.
• Our professional advisers (such as our accountant): only what a task requires, under obligations of confidentiality. In practice this means billing records, never your company's operational data.
• Regulators, law enforcement, or courts: only where the law requires or authorises it, and only in response to valid legal process.
• A buyer of the business: only in the circumstances, and with the protections, described in section 14.

Nobody else. If this list of providers changes, this policy will be updated before or when the change takes effect.

We take reasonable steps, as APP 8 requires, to ensure providers we use handle personal information consistently with Australian privacy law, and we limit what each one receives to what its job needs. Your company's scheduling data and documents are not sent overseas.

8. How we protect it

• All traffic is encrypted in transit (HTTPS/TLS).
• Passwords are stored only as scrypt hashes, never in a readable form.
• Every company's data is isolated from every other company's, enforced at the database layer, not just in application code.
• The application connects to the database with least-privilege credentials.
• Backups run nightly to Australian storage and age out automatically (see the table below).
• Access to production systems is limited to the people who operate the service.

No system is perfectly secure, and we will not pretend otherwise, which is why section 11 explains exactly what we do if something goes wrong.

9. How long we keep it

Our position is the opposite of lock-in: your data is yours, you can export all of it whenever you like, and when you leave it gets deleted, on this timetable:

Two deliberate exceptions:

• Safety records are tamper-proof by design. Acknowledgements of safety posts are never edited or deleted by anyone, including us and including your company's administrators, while the company's account exists. That is the point of them: they are a record your company can stand behind. They are deleted with everything else when the account is deleted.
• Records the law requires us to keep, such as our own tax and transaction records, may be retained for as long as the law requires (generally five years for tax records) even after an account is deleted.

10. Access, correction, export and deletion

• Access and export. Your company's administrators can export every record and every document, self-serve, from the billing page, any time. You can see and update your own profile in the app.
• Correction. If anything we hold about you is wrong, tell us and we will correct it. Information entered by your employer is usually fastest to fix through them, since they control it, but we will help either way.
• If your employer entered your information, you do not have to go through them: you can ask us directly what Dayboard holds about you, and we will answer within 30 days. Going through your employer is usually faster; it is never mandatory.
• Deletion. A company can cancel and be deleted on the timetable above. If you are an individual asking us to delete information a company entered about you, we will pass the request to that company and assist, since the records are theirs to manage while their account exists.

Send any request to privacy@dayboard.com.au. We will respond within 30 days, and we do not charge for access or correction requests.

11. If something goes wrong

If a data breach occurs that is likely to result in serious harm, we will follow the Notifiable Data Breaches scheme: we will investigate promptly, notify the affected companies and individuals, and notify the Office of the Australian Information Commissioner (OAIC), as the Privacy Act requires. We will tell you what happened, what information was involved, and what we are doing about it, plainly and without burying it.

12. Complaints

If you think we have mishandled your personal information, email privacy@dayboard.com.au and we will look into it and reply within 30 days. If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.

13. Children

Dayboard is a workplace tool. It is not directed at children and we do not knowingly collect personal information from children.

14. If Dayboard changes hands

If Dayboard Pty Ltd is ever sold or merged, personal information would transfer with the business under the protections of this policy (or one at least as protective), and we would notify account administrators before it happened.

15. Changes to this policy

If we change this policy, the new version will be posted here with a new effective date. If a change meaningfully reduces your privacy (which is not the direction we intend to move) we will email account administrators before it takes effect.

16. Contact

Dayboard Pty Ltd
ABN 44 701 498 044
Email: privacy@dayboard.com.au