Privacy Policy — Onboardly

Onboardly ("we", "us", "our") is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, how we use it, and your rights in relation to that information.

By using onboardly.com.au or our platform, you agree to the collection and use of information as described in this policy.

1. Who we are

Onboardly is an Australian software-as-a-service platform designed to help businesses manage staff onboarding, compliance tracking, and HR documentation. Our services are accessible at onboardly.com.au.

For privacy enquiries, contact us at support@onboardly.com.au.

2. Information we collect

Business account information

When you create a business account, we collect:

Business name and contact details
Name and email address of the account owner
Password (stored as a secure hash)
Billing information (processed securely by Stripe)

Staff and employee information

When your business uses Onboardly to onboard staff, the following information may be collected:

Full name, date of birth, address, and contact details
Tax file number (TFN) and superannuation details
Work rights and visa information
Qualifications, certifications, and licence details (including expiry dates)
Emergency contact details
Uploaded documents (e.g. identification, first aid certificates, Working With Children Checks)
Employment offer and contract records

3. Why we collect and use your information

We use personal information to provide and operate the platform, process payments, send transactional emails, maintain compliance records, improve our services, and meet legal obligations. We do not sell your personal information.

4. Third-party service providers

Supabase — database and authentication, hosted in Sydney, Australia (AWS ap-southeast-2)
Stripe — PCI-DSS compliant payment processing
Resend — transactional email delivery
Xero — payroll integration (at your direction)
Vercel — platform hosting

5. Data storage and security

All primary data is stored in Australia (Sydney region), encrypted at rest and in transit. We enforce role-based access control and MFA for manager-level accounts and above.

6. Data retention

We retain personal information for as long as your account is active. When a business account is deleted, associated data is permanently removed within 30 days.

7. Cookies

Onboardly uses session cookies solely to maintain your logged-in state. We do not use tracking or advertising cookies.

8. Your rights

Under the Australian Privacy Act, you have the right to access, correct, or request deletion of your personal information, and to lodge a complaint with the OAIC at oaic.gov.au. Contact us at support@onboardly.com.au.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email. Continued use of the platform constitutes acceptance.

10. Contact us

For privacy enquiries: support@onboardly.com.au