Privacy Policy

Foreman is site software for Australian builders and trades: site inductions, site diaries, safety documents and attendance. In this policy, “Foreman”, “we” and “us” mean the business that runs Foreman.

We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).

Account details. When you sign up we collect your email address and a password, then your business name, your website if you have one, and how you heard about Foreman. If you tell us a friend referred you, we keep the name you give so we can thank them.

Your team. When a business adds someone to its account, it gives us their name, email address and role, and we email them their login details.

Your project records. We store everything you and your team record in Foreman: diary entries and their edit history, photos, documents, form answers, tasks, and check-in and check-out times.

Location. Unless your business turns it off, we record your device's location (latitude, longitude and how accurate it is) once when you start a diary entry, and when you check in or out of a site. Your business uses it to check the entry against the site address. Your browser asks your permission first, and the entry still saves if you say no. We don't track your location at any other time.

Billing. Payments are handled by Stripe. We give Stripe your email address, and we see your plan and billing status, but never your full card number.

Enquiries and bookings. Our contact form collects your name, business name, email address, team size and message, and emails them to our team inbox. If you ask for our templates by email, we collect your email address. Demo bookings are made through TidyCal, which collects the details on its booking form.

How you use our website and app. Pages you visit, links and buttons you click, how far you scroll, the site that referred you, your browser and device type, and your approximate location worked out from your IP address. When you're signed in to the app, this is linked to your email address and your business's name and website. We also record IP addresses for a short time to protect sign-up and sign-in from abuse.

When you complete a site induction, we collect your name, phone number, company, White Card number, an emergency contact's name and phone number, your signature, the time, your device's IP address, and the site address and induction wording you agreed to.

Induction records belong to the builder running the project. We hold them on the builder's behalf so they have a record of who was inducted onto their site. To see or correct your record, contact the builder, or contact us and we'll help.

We use it to run Foreman for you: setting up your account, storing your records, keeping your account secure, taking payments and helping when you need support.

We use it to reply to your enquiries, send the templates you ask for and run the demos you book.

We use it to understand which pages and features help people, and to find and fix problems, so we can improve the website and the product.

We email you about your account and the service. We may also email you about Foreman after you sign up or ask for our templates. Just reply to say stop and we won't email you about it again.

We don't sell your personal information.

We use PostHog, an analytics service, to understand how people find and use Foreman. PostHog sets a cookie that is shared by our website and the app.

If you go on to create an account, that cookie links your earlier website visits to your account, so we can see which pages helped. Until then, your visits aren't linked to your name. Our website sends this data to PostHog through our own domain, so it's collected even if you use an ad blocker.

PostHog also records some visits to our website and app as session recordings: the pages you see, where you click and how you scroll, so we can see where people get stuck. In the app, a recording can show what's on your screen, such as names and records you're viewing. What you type into form fields is hidden. We keep recordings for 30 days. PostHog also receives technical error reports from the app.

On our website, before analytics loads, we remove email addresses, names and phone numbers from the web address, for example after you book a demo.

The app uses cookies to keep you signed in, as well as the analytics cookie.

You can block or delete cookies in your browser settings. The website still works without them; the app needs its sign-in cookies. To ask us to delete the analytics data or recordings we hold about you, contact us.

We use these service providers to run Foreman: Vercel (website and app hosting), Supabase (database, file storage and sign-in), Amazon Web Services (sending our emails), Stripe (payments), PostHog (analytics, session recordings and error reports), Google (looking up project addresses on the map, and our team email), TidyCal (demo bookings) and Anthropic (an AI assistant our staff use to look up account details when helping customers).

Project addresses are sent to Google to find their location on the map. Some sites are a client's home.

Within your business, the people you work with on Foreman can see the records you add, according to their role. If your business connects an AI assistant or other software to Foreman through our API, that software receives your business's records at your business's direction.

We may also disclose information if the law requires us to.

Some of our service providers store or process information outside Australia, mainly in the United States. PostHog, Vercel, Stripe, Google, TidyCal and Anthropic process information in the United States. We take reasonable steps to make sure our providers keep your information secure.

We protect your information from misuse, loss and unauthorised access with security measures such as encryption in transit and access controls, so people in a business only see what their role allows.

We keep account and project records while your account exists, including on the Free and read-only plans, because builders rely on them as site safety records.

We delete the IP addresses we record at sign-up and sign-in after 2 days, and session recordings after 30 days. We keep enquiries for as long as we need them to reply and follow up.

If you ask us to delete your information, we'll delete or de-identify it, unless the law or a builder's record-keeping obligations mean it has to be kept. If so, we'll tell you.

You can ask to see the personal information we hold about you, ask us to correct it, or ask us to delete it. You don't have to give us your personal information, but without some of it we can't create an account for you or answer your enquiry.

If you think we've mishandled your personal information, tell us. We'll acknowledge it, look into it, and tell you what we found and what we'll do. We aim to respond to requests and complaints within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

We'll update this policy when what we collect or how we use it changes, and change the date at the top of the page. If a change is significant, we'll let account holders know.

For privacy questions, requests or complaints, email harri@foremanapp.com.au.