Privacy Act 1988 (Cth) • Australian Privacy Principles (APP 11) • UK Data Protection Compliance
WorkCatch ("we", "our", or "us"), operated under Australian Business Number (ABN): 64 257 674 634, located in Sydney, NSW, Australia, is dedicated to protecting the privacy of trade contractors and callers in strict compliance with the Privacy Act 1988 (Cth) and Australian Privacy Principles (APPs, specifically APP 11 security and retention obligations), alongside applicable UK data protection laws for UK users.
1. Information We Collect & Express Recording Consent
To deliver real-time missed-call notifications and mobile Job Cards, we collect and process:
- Contractor Account Data: Business name, ABN, mobile contact number, trade specialisation, and operating hours.
- Telephony & Caller Data: Inbound caller phone numbers (E.164 normalized), call timestamps, call duration, and call status.
- Call Recording Express Consent: All inbound voicemail greetings explicitly instruct callers to "leave a recorded message after the tone", establishing express consent before recording begins in compliance with Australian Surveillance Devices legislation.
2. Purpose & Use of Information
All audio recordings and customer phone numbers are processed strictly for automated alert notifications directed to the contractor. We do not sell, rent, monetize, or disclose customer audio or personal information to third-party advertisers or data brokers under any circumstances.
3. Exact 3-Stage Data Retention & Deletion Lifecycle
In accordance with Australian Privacy Principle 11, data is retained strictly as long as necessary under an automated 5-step lifecycle:
- Short / Pocket-Dial Calls (≤ 4 seconds): Immediately discarded and permanently deleted from cloud storage with zero SMS sent.
- Hours 0 to 72 (Days 1 to 3): Job Card (
/j/:token) is interactive with voicemail audio streaming, tap-to-call, and polite decline buttons.
- Hours 73 to 336 (Days 4 to 14): Job Card converts to a read-only billing docket; interactive buttons are disabled while job summary details remain visible for contractor invoicing.
- Day 14 (336 Hours): Voicemail audio recordings are permanently purged from Twilio and cloud servers, and the
/j/:token web docket expires so no personal data is displayed on the link.
- Day 30: Automated PII de-identification permanently redacts customer names (
[Redacted]), voicemail transcripts, notes, media URLs, and SMS message bodies ([Redacted after 30 days]) from the database, retaining only non-identifying statistical counters (suburb, postcode, genuine job flag).
4. Verified Sub-Processors & Infrastructure Security
All data is processed through verified, enterprise-grade cloud sub-processors with TLS 1.3 encryption in transit and AES-256 encryption at rest:
- Twilio: Telephony and SMS routing.
- Supabase: Encrypted database storage with Row-Level Security (RLS) and strict tenant isolation.
- Google Cloud: Automated voice transcription and text extraction.
- Stripe: PCI-DSS Level 1 payment processing — WorkCatch never stores raw card numbers.
- Render / Cloudflare: Application hosting and TLS edge security.
5. Contact Us
Contractors may request access to, correction of, or permanent deletion of their lead history and audio records at any time. Inquiries and deletion requests can be submitted directly to:
WorkCatch Privacy Officer
Email: admin@workcatch.com.au
Sydney, NSW, Australia