Privacy Policy

1. Information we collect

Account and authentication

When you sign in, our identity provider may process information such as your email address, name (if provided), and a unique user identifier. We use this to authenticate you and associate your activity with your account.

Team and project data

We store the content you and your collaborators create in the Service, including team and project metadata, tasks (titles, descriptions, points, assignments, status, due dates), comments, documents, meeting notes, activity and audit-style events, and similar workspace data needed to provide features you use.

Technical and usage data

We may collect logs and diagnostic information (for example, IP address, device or browser type, request timestamps, and error reports) to secure the Service, troubleshoot issues, and understand aggregate usage patterns.

2. How we use information

We collect personal information by fair and lawful means, and usually directly from you (or from someone who invites you or administers your account on your behalf). We use and disclose it only where reasonably necessary for our functions and activities in operating the Service, unless a permitted exception under the Privacy Act applies.

• Provide, maintain, and improve the Service.
• Authenticate users and enforce access controls within teams and projects.
• Communicate with you about the Service, security, or policy updates.
• Detect, prevent, and respond to fraud, abuse, or technical issues.
• Comply with legal obligations and enforce our terms.

3. How we share information

We do not sell your personal information. We share information only as described below:

• With your team: Content you add to a team or project is visible to members according to product permissions.
• Service providers: We use trusted vendors (for example, cloud hosting, authentication, and email delivery) who may process personal information on our behalf. Where those providers are overseas, we take steps that are reasonable in the circumstances to ensure overseas recipients do not breach the APPs in relation to that information (APP 8.1), subject to the exceptions in the Privacy Act.
• Legal: We may disclose information if required by Australian law, court order, or a regulator with lawful authority, or to protect the rights, safety, and security of users, the public, or us.
• Business transfers: In connection with a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to confidentiality commitments.

4. Retention

We retain information for as long as your account is active and as needed to provide the Service. We may retain certain records after you delete data or close an account where required for legal, security, or legitimate business purposes (for example, backups for a limited period), after which we delete or anonymize the information where feasible.

5. Security and data breaches

We implement reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, or alteration. No method of transmission or storage is completely secure; we cannot guarantee absolute security.

If we become aware of an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act, we will assess the breach and, where required, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals in accordance with Australian law.

6. Overseas disclosure and storage

We are based in Australia, but some of our service providers may process or store information in other countries (for example, the United States or the European Economic Area). Those locations may have different privacy laws. Where we disclose personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the overseas recipient complies with the APPs, except where the Privacy Act permits us to disclose without such steps (for example, where you consent after we clearly inform you, or where a lawful exception applies).

7. Access, correction, and complaints

Subject to the Privacy Act, you may request access to the personal information we hold about you and request corrections if you believe it is inaccurate, out of date, incomplete, irrelevant, or misleading. Contact us using the email below and we will respond within a reasonable period. If you are not satisfied with our response, you may complain to the OAIC. The OAIC's website is https://www.oaic.gov.au/.

8. Children

The Service is not directed to children under 15 without appropriate parental, guardian, or institutional consent. We do not knowingly collect personal information from children in a way that would require such consent without obtaining it. If you believe we have collected personal information from a child in error, contact us and we will take reasonable steps to delete it.

9. Cookies and similar technologies

We and our authentication partners may use cookies or similar technologies that are essential for sign-in and session security. We do not use third-party advertising cookies on the Service as described in this policy.

10. Slack integration

FairWork offers an optional Slack app so teams can manage workload from Slack. You only share Slack data with us if a workspace admin installs the app and a FairWork team owner or admin links a Slack channel to a FairWork project. Installing the Slack app is entirely optional and separate from using the web Service.

Permissions we request

We request only the minimum Slack scopes needed to function: the ability to add slash commands (commands), to post messages such as the weekly digest and command replies (chat:write), and to send you a direct message where needed (im:write). We do not request access to read your channel message history, search your workspace, or access files or messages beyond the commands you explicitly invoke.

Slack information we store

When the app is installed and linked, we store the workspace (team) ID and name, the linked channel ID and name, the installing and linking user IDs, the OAuth bot token issued to us by Slack, and the mapping between a Slack channel or user and the corresponding FairWork project and account. When you run a command (for example creating or completing a task), we process the command text and the Slack IDs involved to carry out that action against your linked project. We do not store your Slack messages or channel history.

How we use it

We use Slack information solely to authenticate the integration, route your commands to the correct FairWork project, post replies and the scheduled weekly digest to the channel you linked, and maintain an audit record of integration actions. The Slack app reaches your FairWork data only through a project-scoped, signed machine credential — a Slack identity alone can never read or change your project data.

Retention and deletion

You can revoke the integration at any time by uninstalling the FairWork app from your Slack workspace or by unlinking the channel in FairWork. Uninstalling or unlinking disables the stored credentials for that channel; relinking issues fresh credentials and revokes the old ones. To request deletion of the Slack installation and link records we hold, uninstall the app and email us at the address in section 12, and we will delete them subject to the retention exceptions described in section 4.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and revise the "Last updated" date. Where changes are material, we will provide additional notice as appropriate.

12. Contact

KS Engineering Studios (Australia) — privacy questions and data requests: info.ks.engineeringstudios@gmail.com