Privacy Policy
Last updated October 2026
1. About this policy
This policy explains how Shackled ("Shackled", "we") handles personal information in the Shackled software and on www.shackled.com.au. We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Workshops that use Shackled decide what they record about their own staff and customers. For that information, the workshop is responsible for its own privacy obligations, and we handle it on the workshop's behalf.
2. What we collect
| Whose information | What | Where it comes from |
|---|---|---|
| Workshop owners and staff using Shackled | Name, email, phone, role, sign-in times, device verification for two-step sign-in, team colour, profile photo (optional) | The person, or their workshop's office |
| Workshop staff (employment records) | Start date, employment status and type, qualification, award and level, pay type (rules only, no pay rates), licences and their files, site inductions, emergency contact, contracts and signatures, performance reviews, policy sign-offs and answers (e.g. uniform sizes), issued items, leave requests, hours worked, exit interview answers | The workshop's office and the person themselves |
| Workshop staff (health and safety) | Incident, injury and near-miss reports, which may include details of an injury | The person reporting it |
| Workshops' customers | Business name, contact names, emails, phone numbers, addresses, ABN, vehicle and machine details, regos, job and invoice history | The workshop |
| Customer portal users | Name, email and sign-in codes (the customer portal is not yet in use) | The workshop |
| Workshop billing contacts | Name, email, subscription status. Card details are held by Stripe, never by us | The workshop |
| Website visitors | Basic technical information (pages visited, browser, IP address) for security and fixing problems; questions typed into the help chat | The visitor |
We do not collect or store tax file numbers, bank account details or superannuation details. Those stay in the workshop's own payroll system (Xero Payroll).
3. Why we use it
- To provide Shackled to the workshop: jobs, timesheets, forms, staff records, reminders and notifications
- To send emails the service needs: invites, sign-in codes, password resets, timesheet reminders, billing notices
- To bill the workshop for its subscription
- To keep accounts secure: sign-in checks, two-step codes, security logs and audit records
- To give support, but only when the workshop's Owner/Admin has allowed support access, for up to 7 days, with every section opened recorded. HR records are never shown to support
- To fix problems and improve Shackled
We do not sell personal information or use it for advertising.
4. Who can see it inside a workshop
Each workshop decides what each role can see in Settings → Roles & permissions. Some records are always restricted: an incident report is seen only by the person who filed it and the people who handle incident reports, and a performance review is not shown to the employee while it is a draft. Workshops can never see each other's information.
5. Services we use
We use these providers to run Shackled. They handle information only to provide their service to us.
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage (all records and uploaded files) | Sydney, Australia |
| Vercel | Hosts the website and runs Shackled's server code | Sydney, Australia |
| Resend | Sends Shackled's emails | USA |
| Stripe | Subscription payments | Australia/USA |
| Xero | Draft invoices, quotes, timesheets and leave, only when the workshop connects its own Xero account | Xero's own locations |
| Anthropic | AI features: help chat, form-template builder, rewording | USA; only the text or PDF sent for that request |
| carregistrationapi.com | Rego lookup, when someone taps it | Australia; the rego only |
| Google Workspace | Our own support email (info@shackled.com.au) | Google's locations |
Where information is sent overseas, we take reasonable steps to make sure the provider protects it.
6. How we protect it
- Every workshop's information is kept separate by database rules on every table, and was independently tested in October 2026
- Uploaded files are private and opened only through short-lived links
- Optional two-step sign-in for staff; always on for Shackled's own administrators
- Records of changes to staff records and job invoicing, and of security events such as sign-ins and role changes
No system is perfectly secure. If a data breach is likely to cause serious harm, we will notify the affected workshops and the Office of the Australian Information Commissioner and affected people, as the law requires.
7. How long we keep it
We keep a workshop's information while its account is open. After cancellation we keep it for 30 days so it can be exported or restored, then delete it, except where we must keep records by law (for example billing records). Some records in backups may take up to 30 more days to be removed.
8. Access, correction and complaints
You can ask to see or correct personal information we hold about you. Staff and customers of a workshop should usually ask that workshop first, as it controls their records. You can also contact us at info@shackled.com.au.
If you have a complaint about how we handled your information, email us and we will reply within 30 days. If you are not satisfied, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.
9. Cookies
Shackled uses cookies only to keep you signed in and to remember a device you have verified for two-step sign-in.
10. Changes to this policy
We will post any changes here with a new date, and email workshops' Owner/Admin about important changes.
11. Contact
Shackled, info@shackled.com.au