Privacy Policy

1Welcome

We are serious about protecting your online privacy. It is important to us to be clear about what data we collect, why we collect it and how we use it.

Vuqira is a product of Automatorr (ABN 18 648 549 955), Sydney, NSW 2000, Australia. In this policy, "we", "us" and "our" mean that company. "You" and "your" mean the person using Vuqira.

We aim to comply with the Australian Privacy Principles under the Privacy Act 1988 (Cth) and, where it applies to you, the General Data Protection Regulation. By using Vuqira you agree to this privacy policy, our terms of service and our disclaimer.

2Contacting us about your privacy

Automatorr (ABN 18 648 549 955), Sydney, NSW 2000, Australia. Our Privacy Officer can be reached at support@vuqira.com.

We will usually respond to you within 30 days and take action, within reason, as quickly as possible.

If you are not satisfied with our response, you may contact your local data protection authority. In Australia that is the Office of the Australian Information Commissioner, in the European Union the European Data Protection Supervisor or your national authority, and in the United Kingdom the Information Commissioner's Office.

3What is personal information

Personal information, or personal data, is information that directly identifies you, such as your name and email address, or data that could be used together with other information to identify you.

We do not intentionally collect sensitive personal information such as health data, racial or ethnic origin, or religious beliefs. Please do not put that kind of information into free text fields such as timesheet notes, task descriptions or messages to the assistant.

4Staying anonymous

You can read our public pages anonymously, although cookies may be used to collect information as described below.

Vuqira itself cannot be used anonymously. It records who worked which hours so that an approver can review them, which only works if accounts identify real people.

5Collection of data of minors

Vuqira is not intended to be used by minors and we do not intentionally collect the personal data of persons under the age of 18.

If you are a parent or guardian and believe a minor has provided us with personal data, contact us at support@vuqira.com and we will delete it.

6How we collect personal data

We collect data when your organisation creates an account, when you are invited into an organisation and complete your profile, when you record time, and when you communicate with us by email or through the product. Depending on how your organisation configures Vuqira, we may collect:

• First and last name
• Work email address
• Job role and the organisation you belong to
• Profile photo, if you upload one
• Messages you send to people in your organisation, including group messages, and any photos you attach to them
• A photo taken with your phone when you clock in, if your organisation asks for one. Only you and your organisation's admins can see it. It is a picture for a person to look at: Vuqira does not use it for face recognition. It is deleted automatically after the number of days your organisation sets, which is 90 days unless they change it
• Your location at the moment you clock in, if your organisation asks Vuqira to check that people are at work when they start. It is read once, when you clock in, and never tracked while you work or in the background. Your organisation's admins can see whether you were at the work location and how far away you were
• The date you joined your company, used to work out which timesheets are due
• Hours worked, and the client, project, task and notes you record against them
• Approval decisions, including who approved or declined and any reason given
• Messages you send to the AI Assistant, and the answers it gives, so a conversation can be continued
• Billing contact details for the organisation, and payment details held by Stripe
• IP address, browser and device information, and sign-in records

7Summary of the categories of personal information we collect

Communication Data. Emails and support requests you send us. Our lawful ground for processing this data is our legitimate interests to reply to communications sent to us, to keep records and to establish, pursue or defend legal claims.

Customer Data. The account, subscription and billing information for your organisation, including payment information held by our payment processor. Our lawful ground for this processing is the performance of a contract between you and us and taking steps at your request to enter into such a contract.

Timesheet Data. Hours, clients, projects, tasks, notes, approvals and, and approval history. Our lawful ground is the performance of our contract with your organisation and our legitimate interests in providing the service your organisation has asked us to provide.

Roster Data. Where your organisation uses rostering: the shifts you are given, whether you accepted or declined them and any reason you gave, the days you said you were available or unavailable, shift swaps you asked for or agreed to, and the times you clocked in and out together with the late, early and overtime figures worked out from them. Our lawful ground is the performance of our contract with your organisation and our legitimate interests in providing the service your organisation has asked us to provide.

Assistant Data. What you type to the AI Assistant and what it replies. Our lawful ground is the performance of our contract and our legitimate interests in operating and improving the feature.

User Data. Information about how Vuqira is used. Our lawful ground for processing this data is our legitimate interests to operate the service, ensure relevant content is provided to you, maintain security and backups, and properly administer our business.

Technical Data. IP address, sign-in data, browser details and analytics. Our lawful ground for processing is our legitimate interests to administer, protect and grow our business.

8Who the data belongs to

This section has no counterpart in a policy written for a public website, and it is the most important one here.

When you use Vuqira through an employer, that organisation decides what is recorded and who may see it. Your administrators can read the hours you record, the notes you attach, and your approval history. Where rostering is in use they can also see your shifts, your answer to each one, the availability you submit, your swap requests, and the times you clocked in and out, including how late or early against the shift as planned. Some of that is visible to them while it is happening rather than afterwards.

This means a request to delete or correct your timesheet data usually has to be made to your organisation rather than to us. If you ask us and we are not the right party, we will tell you so rather than leaving you waiting.

9How we use personal data

We use personal information to provide the service, to bill for it, to contact you about it, and to respond to your enquiries. We use it to send operational email such as verification links, invitations, approval notifications, reminders that a timesheet is outstanding, and notices that a payment is due.

With your permission, we may use your email address to send you emails about our activities. You may withdraw your consent at any time by using the unsubscribe link in our emails or by contacting us.

Our system email is sent from an automated address that is not monitored. Anything that needs a person should go to support@vuqira.com.

We may share data where required by law, with the service providers listed below, and with our professional advisers. If our business is acquired by or merged with another company, your personal data may be transferred to the new owners. We never sell or rent your personal information.

10Service providers we use

These are the third parties that process personal data on our behalf. The list is read off our own configuration rather than assembled from a template, because a list of this kind is only worth publishing if it is true and complete.

• Microsoft Azure (Australia). Cloud hosting for the application servers and the database.
• OpenAI (United States). Processes AI Assistant questions and the data needed to answer them. Only sent when the assistant is used.
• Stripe (United States and Australia). Payment processing and subscription billing. Card details go to Stripe directly and are never held by Vuqira.
• Microsoft 365 (Australia). Sends transactional email, verification, invitations, approvals and billing reminders.
• Google Maps Platform (United States). Address suggestions when a residential address is typed. Only the partial address text is sent.
• Xero (New Zealand and Australia). Receives invoice lines, and the timesheet or shift breakdown behind them, when an organisation has connected its own Xero account and raises an invoice from Vuqira.

The AI Assistant is worth calling out. When you use it, the text of your question and the Vuqira data needed to answer it are sent to our model provider so a reply can be generated. If you would rather that did not happen, do not use the assistant. Everything else in Vuqira works without it.

Xero is the other place data leaves, and it only happens if your organisation connects its own Xero account and then raises an invoice. When it does, the invoice lines and, if the organisation chooses to attach it, the timesheet or shift breakdown behind them are sent to that Xero account. That breakdown names the people whose hours are being billed. The connection is made by your organisation and can be removed by it at any time.

11Links to other websites

Vuqira may link to sites operated by third parties, including our payment processor's billing portal and the invoice documents it hosts, and the Xero account your organisation has connected. These sites have their own privacy policies and may collect your personal information and handle it for their own purposes. We are not responsible for the privacy policies or privacy practices of any third-party site.

12Storage and security of data

We aim to store your personal data only for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements and rights.

In practice that means timesheet records are kept for as long as your organisation's account is open, because they are the record of work that was paid for and an organisation may need them for its own tax and employment obligations.

When an organisation closes its account, we keep its data for 90 days so it can be restored if the closure was a mistake, and then delete it. Nothing is deleted while an organisation's account is open, including one that is suspended for non-payment. Backups are overwritten on their ordinary cycle rather than being reached into individually.

We use third-party providers for hosting, and data may be transferred across international borders. Where data originating in the EEA is transferred, we rely on transfers to countries approved by the European Commission, to participants in an approved framework, or on approved contractual terms that require equivalent protection.

Our security measures include industry-standard hosting security, firewall protection, encryption of stored assistant conversations, restricted internal access, multi-factor authentication, and secure data handling practices. We have breach management procedures and will notify regulators and affected people where the law requires it. However, no storage or transmission over the internet is 100% secure.

13Data rights where you are an EEA resident

Under the GDPR you have the following rights:

• The right to request access to your personal data
• The right to correction
• The right to erasure
• The right to restrict processing
• The right to object to processing
• The right to data portability
• Rights relating to automated decision-making
• The right to withdraw consent

We try to respond to all legitimate requests within 30 days. We may charge a reasonable fee for requests that are unfounded, repetitive or excessive, but you will not pay a fee simply to access your data or exercise your other rights. We may refuse to comply in some circumstances, and if we do we will tell you why.

Where the data you are asking about is held on behalf of your employer, see clause 8. We will tell you promptly if your request needs to go to them instead.

14Data rights where you are not an EEA resident

You may request a copy of the information we hold about you, which we will provide electronically, and you may request that we amend or correct it. You can update much of your personal information yourself from your account page.

15Changes to this privacy policy

It is important to us that our privacy policy is regularly reviewed, and we will do so to keep it relevant and up to date with changing laws. Any updates will be posted on this page with a new "last updated" date. Continued use of Vuqira indicates your acceptance of those updates.

16Cookie Policy

The rest of this document explains how we use cookies and similar storage in your browser.

17What is a cookie?

Cookies are small text files a website may put on your device when you first visit a site or page. They help a site recognise your device on a return visit.

Certain cookies store personal information. For example, if you select "remember me" when logging in, your sign-in will be remembered on that device.

You can manage cookies through your browser settings. By not blocking cookies and continuing to use our website you are authorising the use of cookies. If you block all cookies, you may not be able to sign in to or use Vuqira.

18How do we use cookies?

Cookies and similar browser storage let Vuqira function and let us understand how it is used. They are either first-party, set by us, or third-party, set by a service provider.

Strictly necessary cookies. Some are essential for the operation of Vuqira and cannot be turned off. These keep you signed in and protect the sign-in form. Disabling them means you cannot use the service you have subscribed to.

Functionality cookies. These allow Vuqira to remember your preferences, such as light or dark theme, whether you prefer the calendar or the timer, and which view you last had open.

Performance cookies. We use these to understand how Vuqira is used and to monitor performance so we can find and fix problems.

We do not use cookies to serve you advertising, and we do not build advertising profiles from your use of Vuqira.

Session cookies are stored only during your session and are deleted when you close your browser. Persistent cookies remain on your device after you close your browser, which is what lets "remember me" work.

19Does anyone else use cookies on our website?

Our payment processor sets cookies on the pages where you enter card details and in its billing portal, in order to process payments and prevent fraud. We do not control those cookies. We do not permit advertising networks to place cookies in Vuqira.

20Governing law

This privacy policy is governed by the laws of New South Wales, Australia.