Privacy

Two roles

• We are the controller for accounts and sign-in, billing, the details of reps who sign, our sales contacts, support, and this website. We decide why and how that information is used, and this notice covers it.
• We are the processor for the content a company keeps in Workstamp: its sheets, summaries, photos, attachments and records. The company is the controller and we act only on its instructions, under our data processing agreement. If you are named on a sheet, the company that sent it is the first place to ask about it.

What we hold

About members of a company: name, email address, phone number, role, sign-in details (a password stored only as a one-way hash, or the account id from Google or Apple if you sign in with them), and the sessions and devices you are signed in on.

About reps who sign: name, email address, phone number, the signature you draw, the time you signed, your IP address and your browser or device. If a supervisor adds you from their phone’s contacts, we receive only the contact they pick.

On sheets: the names of the people who did the work, photos (which may show people), attachments such as delivery notes and receipts, and the location of an in-person signature or a photo if the phone allowed it.

For support: the messages and screenshots you send us.

About companies that sign up: the founder’s name and email, the company name, its region, plan and how it found us. We keep these in our sales contact system, HubSpot. No sheets, reps or other members go there.

Why

To record work done and agreed between a company and its client, prove later that a signed record has not changed, deliver requests and notifications, bill for the service, and answer support. We rely on our contract with the company and on legitimate interest.

We email you about your account and getting started. We send marketing email only if you agreed to it at sign-up; it is off unless you turn it on.

What we do not do

• We do not sell personal information.
• The field app and the signing page contain no analytics or advertising code.
• We use only cookies and similar browser storage that are strictly necessary to run the service, such as keeping you signed in. No tracking, analytics or advertising cookies. This website sets none at all.

Where it is stored

Each company chooses a region when it is created: Australia, New Zealand or the United Kingdom. Stored records and backups stay in that region. Photos, signatures, attachments and PDFs are stored with Cloudflare, which we ask to keep them in Oceania for Australia and New Zealand and in western Europe for the United Kingdom. Cloudflare does not guarantee that location, and New Zealand’s files may be kept in Australia. Email, text messages, payments, error reports and service metrics are handled by the providers listed below, some outside your region. The region cannot be changed later without asking us.

Account details needed to sign in and billing are held in a small global directory so we can route you to your company’s region. It holds no sheets, photos or signatures.

Founder and company details for our sales contacts go to HubSpot’s data centre in the European Union, whatever the company’s region. For Australia (APP 8) and New Zealand (IPP 12), HubSpot is bound by contract to protect them to a standard comparable to the Australian Privacy Principles and the New Zealand Privacy Act, and EU data protection law gives them similar protection. For the United Kingdom, the EU is recognised as giving adequate protection under UK data protection law.

When a company sends a sheet to a client company that also uses Workstamp, a copy is stored in the client’s region. The client is a party to that sheet.

Who processes it for us

The companies that process personal information for us, and which of them handle it outside your company’s region, are listed on the sub-processors page.

How long we keep it

Signed records are kept while the company has an account, because their purpose is to be evidence later. If a company closes its account, its admins can download everything for 90 days, after which we delete it. Deleted data leaves our backups within a further 30 days.

Your rights

You can ask to see, correct or erase personal information about you. If it is on a company’s records, ask that company’s admin; they can have us correct or erase it. Otherwise email privacy@workstamp.app. We answer within 20 working days.

Erasing your details removes your name, contact details, signature image and photos of you from the records. The record that a signature happened, and its fingerprint, stays, so the remaining evidence can still be checked.

If you are not satisfied, you can complain to the regulator where you live: the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner or the UK Information Commissioner’s Office.

Security

Connections are encrypted. Passwords are stored as one-way hashes. Admins must set up a second factor within 30 days. Files are private and served by short-lived links. Our staff can view a company’s account only to give support, read-only, logged, and the company is told.

Changes

We post changes here and email account holders about significant ones before they take effect.