Privacy
Last updated 21 September 2026
Site Paperwork is a tool for writing and filing site health and safety paperwork. Using it means putting information about real people into it, including injuries. This page says exactly what happens to that information.
Who holds it
Site Paperworkis operated from Australia. To ask anything here, to see what's held about you, to have it corrected, or to complain, use the contact form. A person reads it.
What it collects
- Your account. Your email address, the name you enter, and a phone number if you add one. There is no password — signing in uses a link sent to your email.
- What you record. Site names and addresses, job descriptions, site conditions, toolbox talk minutes, incident reports, the names of workers and subcontractors you add, ticket and licence expiry dates, photos you attach, and the signatures people give when they sign off a talk.
- What you say. When you use the microphone, the recording is sent away to be turned into text, and the text is kept. The audio is not stored.
- Page views. Which pages get visited and where visitors arrived from. No cookies, nothing tied to an individual, nothing that follows anyone across other sites.
Injury details are health information
An incident report usually describes what happened to a named person. Under Australian privacy law that is health information, and it is treated as more sensitive than the rest. It is only visible to people signed in to your own company — every record is scoped to the company that created it, and that is enforced by the database itself rather than by the app remembering to check.
Where it is stored
In a Postgres database and file store hosted by Supabase in Sydney, Australia. Generated PDFs, photos, uploaded documents and company logos all sit in a private bucket — they are not publicly reachable, and downloads use links that expire after a minute.
Who else processes it, and where
Some of it leaves Australia. This is the part worth reading before you put real records in.
| Who | What they get | Where |
|---|---|---|
| Anthropic | The text you type or dictate, to draft the document from | United States |
| OpenAI | Voice recordings, to turn speech into text | United States |
| Resend | Outgoing email, including approved documents sent as attachments | United States |
| Vercel | Hosting — requests pass through, nothing is stored there | Global |
| Supabase | The database and file storage | Sydney, Australia |
Anthropic and OpenAI both state that content sent through their APIs is not used to train their models. That is their policy, not a promise Site Paperwork can make on their behalf.
Nothing is sold, and nothing is shared with anyone else — no advertisers, no data brokers, no other customers.
How long it is kept
Records stay until you delete them. Deleting a record deletes its files too, including photos and generated PDFs. Archiving hides a record without deleting it. If you stop using Site Paperwork and want everything removed, ask through the contact form and it will be.
If something goes wrong
If there is a data breach that is likely to cause serious harm, you will be told, and so will the Office of the Australian Information Commissioner. If you are not satisfied with how a privacy complaint is handled, you can take it to the OAIC at oaic.gov.au.
Changes
If this page changes in a way that affects what happens to your records, the date at the top changes and account holders are emailed.