Privacy Policy | AtmoJob

Effective date: [[EFFECTIVE_DATE]] Version: 1.0

This Privacy Policy explains how [[LEGAL_ENTITY_NAME]] (ABN [[ABN]]) ("AtmoJob", "we", "us") handles personal information. It covers our website at atmojob.com, the AtmoJob web app, the customer portal, and the AtmoJob mobile apps for iOS and Android (together, the "Service"). It should be read with our Terms of Service. To delete your account, see Delete your account.

1. Summary

AtmoJob is job management software for trade and field service businesses.
A business (we call it a "Business") subscribes to AtmoJob and adds its staff and its own customers.
For the Business's customer records and job records, the Business decides what is collected and why. We store and process that data for the Business, on its instructions. Our Data Processing Addendum sets out these terms.
For account sign-up, billing, support, security and our own marketing, we decide how the data is used.
The mobile app records a worker's location only while the worker is on duty, when the worker takes a job photo, and when the worker starts or stops a job timer. The worker's employer can see that location.
We do not sell personal information. We do not use advertising identifiers, we do not track you across other companies' apps or websites, and we do not share data with data brokers.
We do not send your data to any artificial intelligence (AI) provider. If we ever add a feature that sends personal information to a third-party AI provider, we will update this policy and ask for your permission in the app first.
Our main servers are in Australia. Some service providers we use are in the United States and other countries (see section 9).
You can delete your account in the app, and you can ask us for access to or correction of your information at any time.

2. Who is responsible for your information

When the Business is responsible. The Business that uses AtmoJob is responsible for the information it puts into the Service about its customers, sites, jobs and staff. This includes client and contact records, job notes, forms, photos, invoices, quotes, timesheets and the location records of its workers. In privacy law terms, the Business is the controller of that information, and we are its service provider (processor). If you are a customer of a Business, or you work for one, please contact that Business first about your information. We will help the Business respond to your request.

When we are responsible. We are responsible for:

account information of the people who sign up for and sign in to AtmoJob;
information we need to run, secure, support and improve the Service (for example, device records, crash reports and usage analytics);
billing information for AtmoJob subscriptions;
visitors to our website, and people who contact us or receive our marketing emails.

We handle personal information under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where they apply, we also follow the New Zealand Privacy Act 2020 and the EU and UK General Data Protection Regulation (GDPR) (see section 16).

3. Information we collect

3.1 From people who use AtmoJob (owners, office staff and field workers)

Type: Account details; What it includes: Name, email address, phone number, job title, time zone, username, a hashed sign-in PIN (never the PIN itself), and trade licence numbers you choose to add; Why we use it: To create and run your account, sign you in, and show your details to your team
Type: Sign-in and security; What it includes: Session records, multi-factor authentication settings, and one-time codes sent to your phone by SMS; Why we use it: To keep your account secure
Type: Precise location; What it includes: GPS position, its accuracy, the time and your on-duty status, recorded while you are on duty; the position where a job photo was taken; and the position where you start or stop a job timer; Why we use it: Duty tracking, the team's live map, automatic arrival at job sites, photo evidence, and checking where time was recorded (see sections 4 and 5)
Type: Photos, videos, audio and documents; What it includes: Photos and videos you take or attach for jobs, forms and chat, including the sound recorded with a video, and documents (such as PDFs) you attach to a job; Why we use it: To keep a record of the work for the Business
Type: Chat; What it includes: Team and direct messages, chat photos, and reports and blocks you make. A report keeps a copy of the reported message; Why we use it: To let your team talk about work, and to keep chat safe. An automatic filter on our servers checks chat text before it is sent. Our staff and the Business's admins see reported messages
Type: Job content; What it includes: Notes, checklists, forms, signatures, time entries, leave, quotes and invoices; Why we use it: To provide the Service to the Business
Type: Device information; What it includes: A random ID for each app install, platform, operating system and version, device model, app version and build, and when the device was last seen; Why we use it: To manage the Business's devices, including remote wipe of a lost device. This is required to use the mobile app
Type: Push notification address (only if you turn on notifications); What it includes: A push address (token) for your phone, linked to your sign-in on that phone; Why we use it: To send work notifications to your phone. We delete it when you sign out on that phone, or when Apple or Google tell us the app is no longer on it
Type: Feedback; What it includes: The message you send, and technical details: the screen you were on, app version and build, platform, operating system, device model, language setting and network state. We never include a screenshot; Why we use it: To answer and act on your feedback
Type: Crash and performance data; What it includes: Technical details of errors and app performance, the screen you were on, and the Business's ID; Why we use it: To find and fix problems (see section 6)
Type: Usage analytics; What it includes: Which features are used and how, linked to your user ID, the Business's ID and your role; Why we use it: To understand and improve the Service (see section 6)
Type: Contacts (only if you choose); What it includes: The single contact you pick from your phone's contact list; Why we use it: To create a client record without retyping it. We do not read your whole contact list

3.2 About a Business's own customers

A Business can store information about its customers and their contacts, such as names, email addresses, phone numbers, street addresses and site details. This information can come from the Business's staff, from a contact a worker imports from their phone, or from an address search (see Google in section 9). It can also come from the customer, in these ways:

Lead and enquiry forms. When you fill in a Business's public form, we store your answers and how you arrived at the form. When you send an enquiry through a Business's website form, we record your IP address and browser type. We use them only to tell the Business's advertising accounts (such as Google Ads and Meta) that an ad click led to an enquiry. We delete your IP address after 30 days. We also keep a one-way scrambled (hashed) form of your IP address, to stop people from sending too many forms.
Customer portal. When you view a quote or invoice in the portal, we record what you do there, for example accepting a quote.
Payments. When you pay an invoice online, you pay through Stripe's hosted checkout. The payment goes directly to the Business's own Stripe account. Your card details go only to Stripe. We do not see or store your full card number.
Emails and text messages from the Business. Invoices, receipts and reminders are sent by email, and some invoices by SMS. Invoice, receipt and onboarding emails contain an open-tracking image and tracked links. These tell the Business when an email was opened or a link was clicked. We store these events with a hashed IP address, not the raw address.

We handle this information only to provide the Service to the Business, and on the Business's instructions.

3.3 From website visitors and people who contact us

Information you send us, such as your name, email address and message.
Information from cookies and similar technologies (see section 13).
When a new Business signs up, our team gets an internal notice with the business name, subdomain, industry and time zone. This notice does not include personal email addresses.

3.4 Information we do not collect

We do not collect advertising identifiers (such as Apple's IDFA or Google's advertising ID).
We do not use ad networks or sell data to anyone.
We do not record your screen.
We do not ask for sensitive information such as health or religious information. Please do not put sensitive information into the Service unless it is needed for the job.

4. Mobile app permissions

The app asks for each permission only when you use the feature that needs it. You can say no, or turn a permission off later in your phone's settings. If you do, the rest of the app still works, but the feature that needs that permission will not.

Permission: Location while using the app (iOS "While Using"; Android precise and approximate location); When the app asks: When you go on duty, open a form that records location, look at nearby clients, or take a photo with the in-app camera; Why: To record where work happens, keep job locations accurate, show clients near you, and record where a job photo was taken or a job timer was started or stopped. Your position for the nearby search stays on your phone; Can you say no?: Yes. You can still use the app, but you cannot go on duty. Nearby clients, photo location and timer location will not work
Permission: Location all the time (iOS "Always"; Android "Allow all the time"); When the app asks: When you go on duty, or turn on "Automatic site attendance"; Why: To keep recording your location while you are on duty when the app is closed or in the background, and to mark you as on site when you arrive at a job (see section 5); Can you say no?: Yes. Background duty tracking and automatic site attendance will not work
Permission: Motion and fitness (iOS Motion; Android physical activity); When the app asks: With location, when you go on duty; Why: To pause location tracking while you are not moving, which saves battery. Motion data stays on your phone; Can you say no?: Yes
Permission: Camera; When the app asks: When you take a photo or video, or scan text, a barcode or a QR code; Why: To capture photos and videos for jobs, forms and chat, and to read text or codes into a field. Text and code reading happens on your phone; Can you say no?: Yes. You can still attach existing photos
Permission: Microphone; When the app asks: When you record a video; Why: To record sound with a job video. There is no voice dictation or other audio recording; Can you say no?: Yes. Videos will have no sound
Permission: Photos (iOS); When the app asks: When you attach an existing photo or video; Why: To attach photos and videos from your library to a job; Can you say no?: Yes
Permission: Contacts; When the app asks: When you choose to import a contact, or save a client to your phone; Why: To import one contact you pick into a client record, and to save a client's details to your phone as a new contact; Can you say no?: Yes. You can type client details instead
Permission: Notifications; When the app asks: When you tap "Turn on" for notifications in the app, and on Android when you go on duty. Never when you first open the app; Why: To send you work notifications, such as a new enquiry or a lead given to you, a job assigned to you or a change to its time or status, and team chat messages. On Android, also to show the "On duty" notice while location is being recorded; Can you say no?: Yes. You will not get these notifications, but you still see the same updates in the app. On Android, the on-duty notice may also be hidden

On Android, the app also uses standard system permissions to run the on-duty location service in the foreground, restart it after your phone restarts, and keep it running while the screen is off.

5. Location while on duty, in plain words

You control it. Tracking starts when you tap to go on duty, and stops the moment you go off duty.
What is recorded. While you are on duty, the app records your position about every 10 seconds or every 25 metres you move, whichever comes first. It pauses when you are not moving.
It keeps going in the background. While you are on duty, the app records your location even when the app is closed, not in use, or after your phone restarts. It stops only when you go off duty.
You can always see it. On Android, an "On duty" notification shows the whole time. On iPhone, the location indicator shows in the status bar.
Offline. If you have no signal, positions are saved on your phone and sent when you are back online.
Who can see it. Your employer (the Business) and the team members it allows can see your location on the team map and in reports. AtmoJob staff do not look at it except to give support or keep the Service secure.
Arriving on site. The app can use a "geofence" (an invisible boundary around a job site) to mark a job scheduled for today as "On Site" when you arrive. "Automatic site attendance" is off until you turn it on.
Job timers. When you start or stop a timer on a job, the app saves your position with that time entry, if you have already allowed location. It never asks for permission at that moment.
Job photos. When you take a photo with the in-app camera, the app records where the photo was taken, even if you are off duty. This location is saved inside the photo file, so it stays with the photo if the photo is shared or downloaded. A Business can turn off photo location for all its workers.
How long we keep it. On-duty location history is deleted after 90 days. Photo and timer locations stay with the photo or time entry, as part of the Business's records. See section 11 for the latest-position record.
Employers. Workplace surveillance laws (for example, the Workplace Surveillance Act 2005 (NSW)) may require the Business to give its workers notice before tracking. The Business is responsible for giving that notice and for using location data lawfully.

6. Analytics and crash reports

We use Sentry for crash and performance reports and PostHog for usage analytics.

In the mobile app:

The first time you open the app, you choose whether to send diagnostics. This is off unless you turn it on.
If you turn it on, the app sends crash reports, performance data and usage events. Crash reports include technical details about the app and your device and the screen you were on. We remove details that look personal before a report is sent, but a report can sometimes contain a small piece of the data the app was working with.
You can change your choice at any time in the app's Settings.

In the web app and on our website:

Before you sign in, usage analytics are off.
After you sign in, for Businesses in Australia, New Zealand, the United States and Canada, usage analytics are on by default, and you can turn them off.
For Businesses in the EU, the UK, Quebec, and anywhere we cannot tell, usage analytics are off unless you turn them on.
We do not run PostHog analytics on the customer portal.

Error monitoring on our servers and in the web app:

To keep the Service running and secure, our servers and the web app (including the customer portal) always report errors to Sentry. This is needed to operate the Service and cannot be turned off.
Server error reports may include your AtmoJob user ID (a random code, not your name or email).
We turn off Sentry's collection of personal details such as IP addresses, and we do not use screen replay.

Product analytics from our servers:

Our servers record some product events, such as signing in and creating or updating a job, with your user ID, the Business's ID and your role. These events are sent to PostHog as part of running the Service, and today they do not follow the analytics choice you make in the app or on the web.

7. How we use information

We use personal information to:

provide, run and support the Service for the Business;
create and secure accounts, including sign-in codes and device management;
process AtmoJob subscription billing;
send service messages, such as security notices, sign-in codes and important changes (you cannot opt out of these while you have an account);
understand how the Service is used and fix problems, as described in section 6;
respond to feedback, support requests, abuse reports and legal requests;
check trade licence numbers against the public NSW Government register, when you ask us to;
send you marketing about AtmoJob, if the law allows it. Every marketing email has an unsubscribe link.

We do not use a Business's customer data for our own marketing. We do not use your data to train AI models. If we ever add a feature that sends personal information to a third-party AI provider, we will update this policy and ask for your permission in the app first.

To keep chat safe, an automatic filter on our servers checks chat text for objectionable content before it is sent, and blocks the message if it fails. When someone reports a message, our staff and the Business's admins see the report and a copy of the reported message.

Automated decisions

We do not make decisions that significantly affect your rights or interests using only automated processing of your personal information.

We share personal information only:

Inside your Business. Your team and the Business's administrators can see the information the Business's settings allow.
With the Business's customers. For example, a customer sees your name on a quote or invoice.
With our service providers listed in section 9, who help us run the Service. They may use the data only to provide their service to us. We require them, by contract or their standard terms, to protect it to a standard at least equal to ours.
With integrations the Business turns on. When a Business connects another service (for example, Stripe), that service receives the data needed for the connection and handles it under its own privacy policy.
When the law requires it, or to protect people, property or the Service.
If our business is sold or restructured. The buyer must continue to protect your information under this policy.

9. Service providers and where data goes

Our main database, file storage, sign-in service and sync service run on servers we manage in Australia ([[HOSTING_CITY]]).

Provider: Cloudflare; What they do for us: Network security, speed and DNS for all our web addresses; What they receive: All traffic to and from the Service passes through its network; Where: Global network (United States company)
Provider: Sentry; What they do for us: Crash and performance reports; What they receive: Technical error details, the Business's ID, and your user ID for server errors; Where: United States
Provider: PostHog; What they do for us: Usage analytics (sent through our own address, p.atmojob.com); What they receive: Usage events, user ID, Business ID and role; Where: United States
Provider: Stripe; What they do for us: Online invoice payments and payment account setup for Businesses; What they receive: Payment details, amount, and the payer's name and email; when we set up a Stripe account for a Business, its email address and country; Where: United States and other countries where Stripe operates
Provider: Google; What they do for us: Address search and map display, map service on Android, turning addresses into map positions, and the barcode reader in the mobile app (Google ML Kit); What they receive: Address search text, map positions, and your IP address when your browser loads Google Maps; ML Kit may send Google technical usage and performance data about the barcode reader, but never the images; Where: United States and other countries
Provider: Twilio; What they do for us: SMS sign-in codes, invoice SMS and service SMS; What they receive: Phone number and message text; Where: United States
Provider: Slack; What they do for us: Internal alerts to our team about feedback and new sign-ups; What they receive: Feedback text and its technical details with your user ID and the Business's ID; new Business name, subdomain, industry and time zone; Where: United States
Provider: Expo (650 Industries); What they do for us: Sending notifications to the AtmoJob phone app, through Apple and Google, if you turn them on; What they receive: The push address for your phone, and the notification title and text. The text can include a lead's or client's name, a job number, or the start of a chat message; Where: United States
Provider: Push services (Apple, Google, Mozilla); What they do for us: Delivering notifications to your phone (Apple and Google) and chat notifications to your web browser, if you allow them; What they receive: A push address for your phone or browser, and the notification; Where: United States and other countries, depending on your phone or browser's vendor
Provider: NSW Government (OneGov API); What they do for us: Checking trade licence numbers; What they receive: The licence number you enter; Where: Australia
Provider: Amazon Web Services; What they do for us: Encrypted file storage; What they receive: [[CONFIRM_WHAT_THE_S3_BUCKET_HOLDS]]; Where: Australia (Sydney)

On iPhone, maps are shown by Apple Maps. Text and barcode reading in the mobile app runs on your phone and does not send images to anyone. The text-reading model is downloaded from our own servers.

We will update this table before we add a new service provider that receives personal information.

Overseas disclosure (APP 8)

Some of the providers above are in the United States or operate global networks. This means personal information may be sent to, stored in or accessed from the United States and other countries where those providers operate. Before we send information overseas, we take reasonable steps to make sure the provider protects it in a way that is consistent with the APPs. We choose providers with published security and privacy commitments, and we use their data protection agreements where available.

10. Security

We protect personal information with reasonable technical and organisational measures, including:

encrypted connections (HTTPS/TLS) between your device or browser and our network, with the mobile app refusing connections that are not secure;
an encrypted database on the phone for the data the mobile app stores, with a separate key for each Business and user, kept in the phone's secure storage;
the ability for a Business to remotely wipe AtmoJob data from a lost device;
multi-factor authentication, which a Business can require for its users;
access to production systems limited to the staff who need it.

No system is completely secure. Keep your sign-in details and PIN to yourself. If you think someone else has used your account, contact us as soon as you can.

Data breaches

If we have a data breach that is likely to cause serious harm, we will notify the people affected and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme. If the breach affects information we hold for a Business, we will tell the Business without undue delay and help it meet its own obligations.

11. How long we keep information

Information: Worker location history; How long we keep it: 90 days, then deleted
Information: Each worker's latest position; How long we keep it: Until the Business account is deleted. It is replaced each time a new position is recorded
Information: Photo and job timer locations; How long we keep it: As long as the photo or time entry is kept
Information: Sign-in sessions; How long we keep it: Up to 30 days
Information: Email open and click records; How long we keep it: 36 months
Information: IP address from a lead or enquiry form; How long we keep it: 30 days, then deleted
Information: Record of emails sent (recipient, subject, status); How long we keep it: While the Business's account is active
Information: Business data export files; How long we keep it: 7 days after they are created
Information: Email server logs; How long we keep it: 30 days
Information: Chat reports (including the copy of the reported message); How long we keep it: Until the Business account is deleted
Information: Chat blocks; How long we keep it: Until you unblock the person, or the Business account is deleted
Information: Database backups; How long we keep it: About 9 weeks, then overwritten
Information: Record that a Business was deleted (Business ID, web address, the ID of the person who asked, dates and counts, but no names or emails); How long we keep it: Kept with no end date, to show the deletion happened
Information: A deleted Business's web address (subdomain); How long we keep it: Held back for 12 months, so no one else can use it to receive the old Business's links
Information: Everything else in the Service (jobs, clients, photos, chat, invoices and so on); How long we keep it: Until the Business or user deletes it, or the Business account is closed (see section 12)

A Business may need to keep some records, such as invoices and timesheets, for longer to meet tax and employment laws. That is the Business's decision.

12. Deleting your account

In the mobile app

Open the More tab.
Tap Account.
Tap Delete account and confirm.

On the web

If you are the only owner of a Business, go to Settings > Business > Advanced > Delete workspace, click Delete workspace, type DELETE, and click Delete workspace and my account. Team members cannot delete only their own account on the web; use the mobile app or email us. You can also follow the steps on our account deletion page, which works without the app.

What happens when a team member deletes their account

We remove your name, email, phone number, username, profile, sign-in details and licence numbers straight away, and you can no longer sign in.
Records you made for the Business stay with the Business, because they belong to its business records. This includes jobs, time entries, invoices, chat messages and photos. They are shown as made by "Deleted user".
Your on-duty location history is deleted within 90 days. Your last recorded position stays with the Business, linked to "Deleted user", until the Business account is deleted.
Your sign-in identity is deleted if you do not belong to another Business on AtmoJob.
Your sessions are signed out, and the app deletes the AtmoJob data on the phone you used.
If your Business signs you in through its own company sign-in system (single sign-on), ask your Business administrator to remove you.

What happens when the only owner deletes the Business

The deletion is scheduled for 30 days later. During those 30 days the Business keeps working as normal, and any owner can cancel the deletion. We recommend you download a data export first (web Settings > Business > Advanced > Data export).
After 30 days, we close the Business, wipe AtmoJob data from its registered devices, sign out all its users, and delete its database records, users, sign-in organisation, email records, photos, documents and logos.
The Business's Stripe account belongs to the Business and is not deleted by us. If the Business connected its own Stripe account, we remove AtmoJob's access to it. If we set up the Stripe account for the Business, we leave it in place so any balance and payout records are kept, and we can help the Business close it. The Business can close it with Stripe.
Deleted data may remain in our backups for about 9 weeks until they are overwritten.
The mobile app deletes the encryption key for its local data, so the data left on the phone can no longer be read.

If you work for a Business and want your data removed from its records, ask the Business. We will help it act on your request.

13. Cookies and similar technologies

Website and web app:

Name: atmo_session; Type: Essential; Purpose: Keeps you signed in. It is secure and cannot be read by page scripts; How long: Up to 30 days
Name: sidebar_state; Type: Essential (preference); Purpose: Remembers whether the side menu is open; How long: 7 days
Name: atmo_privacy_consent_v1 (browser storage); Type: Essential; Purpose: Remembers your analytics choice; How long: Until you clear it
Name: Display preferences (browser storage); Type: Preference; Purpose: Remembers your schedule, client list, time zone and banner settings; How long: Until you clear it
Name: PostHog cookie and browser storage; Type: Analytics; Purpose: Counts visits and feature use, if analytics are on (see section 6); How long: Up to 1 year
Name: atmo_attr_ft and atmo_attr_lt; Type: Campaign; Purpose: Remember which of our ads or links brought you to AtmoJob, so we know which of our campaigns work. They hold only the campaign tags and page addresses, and are sent only to us when you sign up. Not set if you turn analytics off; How long: 90 days

When a page shows a Google map, Google may set its own cookies under Google's privacy policy. We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but you will need the essential cookies to sign in.

Mobile app: The app keeps your session, your privacy choices, a random install ID and its database encryption key in your phone's secure storage. It keeps your synced work data in an encrypted database on your phone.

14. Access, correction and your choices

You can:

see and change most of your account details in the app or web app;
ask us for a copy of the personal information we hold about you;
ask us to correct information that is wrong, out of date or incomplete;
change your analytics choice at any time (section 6);
turn off app permissions in your phone's settings (section 4);
unsubscribe from our marketing emails using the link in each email;
delete your account (section 12).

To make a request, email [[PRIVACY_CONTACT_EMAIL]]. We may need to confirm who you are first. We will reply within 30 days. There is no fee to ask. If we refuse a request, we will tell you why in writing and how to complain.

If your request is about information a Business holds (for example, you are its customer or employee), we will pass it to the Business and help it respond.

15. Children

AtmoJob is a tool for businesses and their workers. It is not made for children, and people under [[MINIMUM_USER_AGE]] must not use it. If we learn that we hold personal information of a child under [[MINIMUM_USER_AGE]] who is not a worker authorised by a Business, we will delete it. We do not use Apple's or Google's age-range signals.

16. People in New Zealand, the EU and the UK

New Zealand. We handle personal information in line with the Privacy Act 2020 (NZ). If we have a privacy breach that causes or is likely to cause serious harm, we will report it to the New Zealand Privacy Commissioner and tell the people affected, when the Privacy Act 2020 requires it. You can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz.

EU and UK. If the GDPR applies to you, you also have the right to ask us to delete, restrict or transfer your information, and to object to some uses. Where we are responsible for your information, we rely on:

the contract with you or your Business, to provide the Service;
our legitimate interests, to keep the Service secure, fix errors and improve it;
your consent, for optional analytics, which you can withdraw at any time;
legal obligations, where the law requires us to keep or share information.

You can complain to your local data protection authority.

17. Emails and text messages

We follow the Spam Act 2003 (Cth). Our marketing emails identify us and have a working unsubscribe link. Businesses that send emails and SMS to their customers through AtmoJob are responsible for having consent where the law requires it, as described in our Terms of Service.

18. Complaints

If you have a concern about how we handle your personal information, please contact us first at [[PRIVACY_CONTACT_EMAIL]]. We will reply within 30 days.

If you are not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC):

Website: www.oaic.gov.au
Phone: 1300 363 992

19. Changes to this policy

We will update this policy when our practices change. If a change is significant, we will tell you by email or in the Service before it applies. The date at the top shows when this policy last changed.

20. Contact us

[[LEGAL_ENTITY_NAME]] ABN [[ABN]] [[REGISTERED_ADDRESS]] Privacy: [[PRIVACY_CONTACT_EMAIL]] Support: [email protected] and atmojob.com/contact